Technical Information
- 'tr##sfer.sh':80
- 'tr##sfer.sh':443
- http://tr##sfer.sh/get/5WzkVr/Zvhiaxpms_Uwfisikb.bmp
- 'tr##sfer.sh':443
- DNS ASK tr##sfer.sh
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==