Техническая информация
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'kissq' = '%HOMEPATH%\Ap'
- %TEMP%\jfiag_gg.exe
- %TEMP%\fjgha23_fa.txt
- %TEMP%\kissq.exe
- http://ip##pi.com/json/
- http://re#####6e4.2ihsfa.com/api/fbtime
- DNS ASK ip##pi.com
- DNS ASK fa###ook.com
- DNS ASK re#####6e4.2ihsfa.com
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt
- '%TEMP%\jfiag_gg.exe' /scookiestxt %TEMP%\fjgha23_fa.txt' (со скрытым окном)