Техническая информация
- %WINDIR%\tasks\qxejo.job
- <SYSTEM32>\tasks\qxejo
- %ALLUSERSPROFILE%\xwkw\qxejo.exe
- http://12#.31.0.39/tor/status-vote/current/consensus
- http://11#.#2.66.193/tor/server/fp/7ff23e8d0ab99da78c81d41e51a6e20eb84bfd69
- http://11#.#2.66.193/tor/server/fp/fb58e117d11f87f0a291475d603ec61082c3fb15
- http://11#.#2.66.193/tor/server/fp/023966fbdfdbe45651cd3372a7c1f8dccb871855
- http://11#.#2.66.193/tor/server/fp/023ebbc57beb7f45473b3dc2aa811fb3aaba4466
- http://11#.#2.66.193/tor/server/fp/0258c142ca27dae7fe9cc8ecfc899f3358635989
- http://11#.#2.66.193/tor/server/fp/6c4eb91c94b7d194cb117093a365a1d06fa9bf03
- http://11#.#2.66.193/tor/server/fp/6c5875ab92c8979d0d66c952d017e9866148ddef
- http://11#.#2.66.193/tor/server/fp/6c620c35c0ea16657960882de88b28968ebc8689
- DNS ASK de###coma.com
- DNS ASK de###coma.xyz
- DNS ASK ap#.#pify.org
- '%ALLUSERSPROFILE%\xwkw\qxejo.exe' start
- '%ALLUSERSPROFILE%\xwkw\qxejo.exe' start' (со скрытым окном)