Техническая информация
Изменения в файловой системе
Создает следующие файлы
- C:\ho\cj.asp
- C:\hos\h357.asp
- C:\hos\hosts
- C:\iifb\bd.html
- C:\iifb\bd0.html
- C:\iifb\dh.html
- C:\iifb\gg.html
- C:\iifb\mm.html
- C:\iifb\pc.html
- C:\iifb\tp.html
- C:\kl\201903pc1212.cmd
- C:\kl\3msistub2.exe
- C:\kl\apache.msi
- C:\kl\ccc.cmd
- C:\kl\certutil.lnk
- C:\kl\certutil11.exe
- C:\kl\certutilgl.lnk
- C:\kl\cj.lnk
- C:\kl\cj2.lnk
- C:\kl\ddd.cmd
- C:\kl\kl318kj.lnk
- C:\llq\ca15.cer
- C:\llq\certutil.lnk
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
- C:\llq\cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
- C:\llq\cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
- C:\llq\cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension3.db
- C:\llq\cj\appdata\roaming\sogouexplorer\extension4.db
- C:\llq\cj\appdata\roaming\sogouexplorer\favorite3.dat
- C:\llq\cj\favorites\links\desktop.ini
- C:\llq\cj\favorites\links\天 猫.url
- C:\llq\cj\favorites\links\爱淘宝.url
- C:\llq\cj\favorites\links\百 度.url
- C:\llq\cj\favorites\links\网址大全.url
- C:\llq\cj\favorites\links\聚划算.url
- C:\llq\cj\favorites\天 猫.url
- C:\llq\cj\favorites\爱淘宝.url
- C:\llq\cj\favorites\百 度.url
- C:\llq\cj\favorites\网址大全.url
- C:\llq\cj\favorites\聚划算.url
- C:\llq\cs.htm
- C:\llq\seyishi.crt
- C:\llq\seyishi.key
- C:\llq\复件 (2) ca15.cer
- C:\llq\复件 (2) certutil.lnk
- C:\llq\复件 (3) ca15.cer
- C:\llq\复件 (3) certutil.lnk
- C:\llq\复件 ca15.cer
- C:\llq\复件 certutil.lnk
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
- C:\llq\复件 cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
- C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
- C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
- C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
- C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
- C:\llq\复件 cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
- C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
- C:\llq\复件 cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension3.db
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension4.db
- C:\llq\复件 cj\appdata\roaming\sogouexplorer\favorite3.dat
- C:\llq\复件 cj\favorites\links\desktop.ini
- C:\llq\复件 cj\favorites\links\天 猫.url
- C:\llq\复件 cj\favorites\links\爱淘宝.url
- C:\llq\复件 cj\favorites\links\百 度.url
- C:\llq\复件 cj\favorites\links\网址大全.url
- C:\llq\复件 cj\favorites\links\聚划算.url
- C:\llq\复件 cj\favorites\天 猫.url
- C:\llq\复件 cj\favorites\爱淘宝.url
- C:\llq\复件 cj\favorites\百 度.url
- C:\llq\复件 cj\favorites\网址大全.url
- C:\llq\复件 cj\favorites\聚划算.url
- C:\llq\复件 cs.htm
- C:\llq\复件 seyishi.crt
- C:\llq\复件 seyishi.key
- %ProgramFiles%\bangteng\kangle\etc\config.xml
- %ProgramFiles(x86)%\bangteng\kangle\etc\config.xml
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68e77825-38c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68e7782a-2c4.pma
- nul
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %TEMP%\edge_bits_708_1533042931\bit262c.tmp
- %TEMP%\708_1638867374\manifest.json
- %TEMP%\708_1638867374\license.txt
- %TEMP%\708_1638867374\filtering rules
- %TEMP%\708_1638867374\_metadata\verified_contents.json
- %TEMP%\708_1638867374\manifest.fingerprint
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir708_737445980\ruleset data
Присваивает атрибут 'скрытый' для следующих файлов
- %TEMP%\edge_bits_708_1533042931\bit262c.tmp
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
- %TEMP%\edge_bits_708_1533042931\bit262c.tmp в %TEMP%\edge_bits_708_1533042931\dde93974-5cbc-4ecc-898f-436e62207c34
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Сетевая активность
Подключается к
- 'co####.edge.skype.com':443
- '17#.66.2.5':80
- 'localhost':5985
TCP
Другие
- 'co####.edge.skype.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK 42.##r35.com
- DNS ASK google.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Запускает на исполнение
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument C:\iifb\gg.html
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" "
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\ccc.cmd"" h",0)(window.close)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h" (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c tasklist | findstr /i "cmd.exe" 2>nul
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /i "cmd.exe"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate "C:\iifb\gg.html" (со скрытым окном)
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n "60"
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,501368586389474198,14879103165713293765,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
