Technical Information
- %WINDIR%\syswow64\windowspowershell\v1.0\svc.exe
- %WINDIR%\syswow64\windowspowershell\v1.0\svc.exe
- 'pa###bin.com':443
- 'pa###bin.com':443
- DNS ASK pa###bin.com
- '%WINDIR%\syswow64\windowspowershell\v1.0\svc.exe'
- '<SYSTEM32>\fondue.exe' /enable-feature:NetFx3 /caller-name:mscoreei.dll
- '%WINDIR%\syswow64\windowspowershell\v1.0\svc.exe' ' (with hidden window)
