C2 domain receiving multipart/form-data POST beaconing from MarkiRAT at /up/uploadx.php; note intentional misspelling of 'microsoft'
