Technical Information
- %WINDIR%\tasks\mqqpom.job
- <SYSTEM32>\tasks\mqqpom
- %PROGRAMDATA%\gxfvog\mqqpom.exe
- http://13#.#88.40.189/tor/status-vote/current/consensus
- http://87.##9.204.111/tor/server/fp/8872857aeada88f5de025c3ada64c224576d90f1
- http://87.##9.204.111/tor/server/fp/3268b4c7dc8d31c30ff14480409dd6d6b0702c9e
- http://87.##9.204.111/tor/server/fp/9dc8b0282a8d3c45212167c454b503243bc93957
- http://87.##9.204.111/tor/server/fp/d1ae7e838df635eb1367f202b84946d73142cdad
- DNS ASK gm###r23.xyz
- DNS ASK sc####tat14tp.xyz
- DNS ASK ap#.#pify.org
- '%PROGRAMDATA%\gxfvog\mqqpom.exe' start
- '%PROGRAMDATA%\gxfvog\mqqpom.exe' start' (with hidden window)