Техническая информация
- %WINDIR%\tasks\gktcltd.job
- <SYSTEM32>\tasks\gktcltd
- %ALLUSERSPROFILE%\eoxjtfa\gktcltd.exe
- http://13#.#88.40.189/tor/status-vote/current/consensus
- http://88.##0.13.215/tor/server/fp/ed36124515f71e2e2401d70d9efc3caeb08d611b
- http://88.##0.13.215/tor/server/fp/a868303126987902d51f2b6f06dd90038c45b119
- http://88.##0.13.215/tor/server/fp/0d12d8e72ded99ee31bb0c57789352bed0ceeeff
- http://88.##0.13.215/tor/server/fp/0d13fefb150903100af2f9e52a5852ec105a817e
- http://88.##0.13.215/tor/server/fp/0d35a457be0304f2656310c90c774695a3773a6b
- http://88.##0.13.215/tor/server/fp/7aaf5597b18d82cc90ca95fb7976a1cea4a32e06
- http://88.##0.13.215/tor/server/fp/7ab8b08df8b90d108efc37d74ca90a7b939a023d
- http://88.##0.13.215/tor/server/fp/7aba39f796b24333f85fa500a057de9d700e1534
- http://19#.#09.206.212/tor/status-vote/current/consensus
- http://18#.#36.203.203/tor/server/fp/20d2a186a412ea433d9bad2fdbd7b48b36b20b34
- DNS ASK 26###cgd.com
- DNS ASK 26###cgd.xyz
- DNS ASK ap#.#pify.org
- '%ALLUSERSPROFILE%\eoxjtfa\gktcltd.exe' start
- '%ALLUSERSPROFILE%\eoxjtfa\gktcltd.exe' start' (со скрытым окном)