For the PowerShell script, the first part contains a variable named dragon_middle, which is an array containing a few hundred URLs ending with connection.php that serve as proxies between victim and C&C.