Техническая информация
Вредоносные функции
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\microsoftedgecp.exe
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240311\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_cbdccbfe4f7a916411c1e69bdd97bb04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\river-feed.ae3dae95d95f7e4c6530[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\conditionalbanner.56094bd1813102189372[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\bbkvxnk[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\topic-data.9122c25159afd52c051b[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\iris-data-connnector.08994c0de46d3d4e8cd0[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\pivots-nav.fada94a36efa9191ecc0[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\vendors.c47bf4f4981f23895ddb[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\topsites.a339bbcb9841b908ff57[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\pivot-content.b6fb2ee68a27298082a9[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\appcache\wk4mz7ic\1\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\appcache\wk4mz7ic\1\appcache[1].man
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\96664fa8619f9d65bb0bfd4ff653da7c_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\all58db.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_f9e4dc0b9d5c777357d7db8def51118a
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_f9e4dc0b9d5c777357d7db8def51118a
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\bannermanager.0a0ecda75bc311f70c4e[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\fav5c66.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\e2c6cbaf0af08cf203ba74bf0d0ab6d5_cbdccbfe4f7a916411c1e69bdd97bb04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\8.4afc41bd922db2692762[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\native-ad.1238efed9d6663e6cd5a[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\breaking-news.d11fb0f65233cc7311d2[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\card-action.2ad3cec190aef8ec85f4[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\user-profile-display.3f2029dddf02ce5fe4e7[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\onefooter.982b320cf4a2a85e7315[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\showfeed.876d1b9a714f071957cd[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\feedbacklink.5475db40602c075e0172[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\aad40wh[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\bb156afc[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\bbo3aug[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\aazobni[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\aac9dpu[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\aac9vhk[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\msimgsiz.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\pagesettings.bb435d36341a2ef34a3a[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\microsoft.8aa91a5fe4f5d8517ae1[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\copa864p\common.5dd7cff85de67632bfd7[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240311\microsoftedgecookiesbackup.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\user\default\domstore\l02tcq6j\ilang[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\msimgsiz.dat
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240311\microsoftedgesettingsbackup.txt
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\downloads\beautifulimagesoftheroselookingveryprettyandgreatthingsitslikeverynicetoundersandhowbeautiuflitsisanndr___beaut...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240311\schema.txt.~tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240311\edb00001.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\nddd6uuh\beautifulimagesoftheroselookingveryprettyandgreatthingsitslikeverynicetoundersandhowbeautiufl...
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240311\protected - it is a violation of windows policy to modify\backup.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\eea658139b1f4714acd794ff5e5c8408_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_c0427f5f77d9b3a439fc620edaab6177
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_c0427f5f77d9b3a439fc620edaab6177
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\d5e9cf4669e5dc9217b1bff5bde58799
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\d5e9cf4669e5dc9217b1bff5bde58799
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\tgplq7zh\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\config[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\web-worker.440858f9fe4973b6d967[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\d5e9cf4669e5dc9217b1bff5bde58799
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\d5e9cf4669e5dc9217b1bff5bde58799
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\domstore\m29zuodv\www.msn[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\onxduzvt\weather-card.c6cef55d540a2f97de22[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\lmun5m67\weather-data-connector.682c31544bc49f2ce3c9[1].js
Изменяет следующие файлы
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.jfm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edb.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edbtmp.log
Подменяет следующие файлы
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Сетевая активность
Подключается к
- 'il##g.in':80
- '17#.#34.239.209':80
- 'il##g.in':443
- 'ms#.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
- 'im######n-com.akamaized.net':443
TCP
Запросы HTTP GET
- http://il##g.in/yBMrU
- http://il##g.in/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?ws##############
- http://17#.#34.239.209/24005/svr/beautifulimagesoftheroselookingveryprettyandgreatthingsitslikeverynicetoundersandhowbeautiuflitsisanndr___beautifulrosehoneygirl.doc
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRAlkS8pKR%2F%2FtmwgIv21F3%2FJQ%3D%3D
- http://il##g.in/favicon.ico
Другие
- 'il##g.in':443
- 'ms#.com':443
- 'as###s.msn.com':443
- 'ar#.msn.com':443
- 'im######n-com.akamaized.net':443
UDP
- DNS ASK il##g.in
- DNS ASK ms#.com
- DNS ASK x1.#.lencr.org
- DNS ASK im######n-com.akamaized.net
- DNS ASK sb.#####cardresearch.com
- DNS ASK r3.#.lencr.org
- DNS ASK ap#.msn.com
- DNS ASK as###s.msn.com
- DNS ASK c.##n.com
- DNS ASK ar#.msn.com
Другое
Ищет следующие окна
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Запускает на исполнение
- '%WINDIR%\systemapps\microsoft.microsoftedge_8wekyb3d8bbwe\microsoftedge.exe' -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
- '<SYSTEM32>\microsoftedgecp.exe' -ServerName:Windows.Internal.WebRuntime.ContentProcessServer
