Техническая информация
- %WINDIR%\tasks\amqvbfj.job
- <SYSTEM32>\tasks\amqvbfj
- %PROGRAMDATA%\bktdmv\amqvbfj.exe
- http://12#.31.0.34/tor/status-vote/current/consensus
- http://19#.#8.81.140/tor/status-vote/current/consensus
- http://20#.#3.164.118/tor/status-vote/current/consensus
- http://19#.#09.206.212/tor/status-vote/current/consensus
- http://94.##0.116.25/tor/server/fp/cc2a573e9049fef0d3982627c28b87cd876ca628
- http://94.##0.116.25/tor/server/fp/5628495d9939a8c139dd441402de42f7012b7092
- http://94.##0.116.25/tor/server/fp/cefbcb5fce5fb37784ad489bcdec46f1d59c06cb
- http://94.##0.116.25/tor/server/fp/aaffa68ab61238f9044b6ecba62e25264113eb88
- http://ad###xd19.xyz/atx222.exe
- DNS ASK gm###r23.xyz
- DNS ASK sc####tat14tp.xyz
- DNS ASK ap#.#pify.org
- DNS ASK ad###xd19.xyz
- '%PROGRAMDATA%\bktdmv\amqvbfj.exe' start
- '%PROGRAMDATA%\bktdmv\amqvbfj.exe' start' (со скрытым окном)