Technical Information
- <SYSTEM32>\tasks\foftservices
- %TEMP%\whitefolders\bluerits.exe
- %TEMP%\c320787f426b499da21dec2a995e328c.xml
- 'ce####1.duckdns.org':5594
- DNS ASK ce####1.duckdns.org
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN foftservices /XML "%TEMP%\c320787f426b499da21dec2a995e328c.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN foftservices /XML "%TEMP%\c320787f426b499da21dec2a995e328c.xml"