Technical Information
- %WINDIR%\tasks\qvvvww.job
- <SYSTEM32>\tasks\qvvvww
- %ALLUSERSPROFILE%\prtvxb\qvvvww.exe
- '80.#5.84.79':4001
- 'ap#.#pify.org':443
- '20#.#3.164.118':80
- '62.##1.148.119':9001
- '13#.#62.111.238':443
- '78.##.213.47':9001
- '16#.#12.158.82':9011
- '19#.#09.206.212':80
- '87.##1.29.226':9001
- '97.##.100.58':9030
- 'ap#.#pify.org':443
- '62.##1.148.119':9001
- '13#.#62.111.238':443
- '78.##.213.47':9001
- '87.##1.29.226':9001
- DNS ASK ap#.#pify.org
- '%ALLUSERSPROFILE%\prtvxb\qvvvww.exe' start
- '%ALLUSERSPROFILE%\prtvxb\qvvvww.exe' start' (with hidden window)