Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\WinDivert1.1] 'ImagePath' = '%TEMP%\3jm3tucf9v\WinDivert64.sys'
- 'WinDivert1.1' %TEMP%\3jm3tucf9v\WinDivert64.sys
- %APPDATA%\potatovpn\jh8mh9fvr8\a0bf63c39ab71291afab9a0e55c07a9c
- %APPDATA%\kmg\e8vecdvdd6\d6e547b8f544fabae3f123d3a3db544f
- %APPDATA%\kmg\e8vecdvdd6\2786928bd7a7eb27d640679af4019358
- %APPDATA%\cpt55z3yv2\data.uyq4rufrf4uf2tvzg8akctk3
- %TEMP%\3jm3tucf9v\windivert32.dll
- %TEMP%\3jm3tucf9v\windivert64.sys
- %WINDIR%\temp\udd8786.tmp
- %WINDIR%\temp\udd8786.tmp
- 'localhost':50051
- '35.##3.91.95':20025
- '35.##3.91.95':20005
- DNS ASK ge#####buzz-little.com
- DNS ASK ge#####re-links8.com
- DNS ASK po###ovpn.io
- DNS ASK ge####gerie36.com
- DNS ASK ge#####re-link3s.com
- DNS ASK ma#####tiself-api.com