Technical Information
- <SYSTEM32>\tasks\loserty
- %TEMP%\sacacrtyfree\whitemanth.exe
- %TEMP%\5114842f0dd2444f9d7295083ca8bde7.xml
- 'ce####1.duckdns.org':5594
- DNS ASK ce####1.duckdns.org
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN loserty /XML "%TEMP%\5114842f0dd2444f9d7295083ca8bde7.xml"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /Create /TN loserty /XML "%TEMP%\5114842f0dd2444f9d7295083ca8bde7.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN loserty /XML "%TEMP%\5114842f0dd2444f9d7295083ca8bde7.xml"