Technical Information
- %WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
- '19#.#8.23.170':80
- http://19#.#8.23.170/new_Jqigtmwp.bmp
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==