Техническая информация
- %WINDIR%\tasks\qetj.job
- <SYSTEM32>\tasks\qetj
- %ALLUSERSPROFILE%\bwusqwu\qetj.exe
- http://12#.31.0.39/tor/status-vote/current/consensus
- http://20#.#3.164.118/tor/status-vote/current/consensus
- http://94.##3.211.23/tor/server/fp/64ae86c40ef69d3777e16792c8294c5f125187f5
- http://94.##3.211.23/tor/server/fp/666aade1510e645dbc7e187251595178a62a4d8e
- http://94.##3.211.23/tor/server/fp/7e44e0d39ce8666a98ea5debcbb8e12b3906410f
- http://94.##3.211.23/tor/server/fp/38f21dee29e40dcdf9460a80662b7723562ca008
- DNS ASK mx###gs19.xyz
- DNS ASK sd###ert20.xyz
- DNS ASK ap#.#pify.org
- '%ALLUSERSPROFILE%\bwusqwu\qetj.exe' start
- '%ALLUSERSPROFILE%\bwusqwu\qetj.exe' start' (со скрытым окном)