Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690bece9-122c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690bece9-d20.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690bece9-1488.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690becee-1358.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\487615d9b8285ab1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d666d429bbff20c5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2c2b3393fbfc6416_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c7da40f64d803756_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c8f378e17a122e0c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0cf646726443aa03_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\49ff348f57cd8654_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0890291f916dd335_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f40f69d3cc224c83_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9514fe88e0ef4ea6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b262caa497161fd1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\559fa56f9251ecbd_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d0b808f0a8fc8feb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1bb9ae137f060dc3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c4aa9dbdebe75e1d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b6625f84f3ef86ef_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\84e004b4eee299f9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a3c5872ff15fc98d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\49a8f33e5361830a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\62e446b239b7188c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5eaf167de8e3205d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a643443ac95a13d3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3c6a5f28dc955f47_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\origins\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\origins\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\origins\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\origins\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\000\t\paths\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\000\t\paths\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\000\t\paths\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\000\t\.usage
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %TEMP%\3b88f285-4180-40d4-ba7b-8f523ec76a46.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\662ee94676ffd8fa_0
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %TEMP%\4952_917048104\manifest.json
- %TEMP%\4952_917048104\license.txt
- %TEMP%\4952_917048104\filtering rules
- %TEMP%\4952_917048104\_metadata\verified_contents.json
- %TEMP%\4952_917048104\manifest.fingerprint
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir4952_466332405\ruleset data
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690bece9-122c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690bece9-1488.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690bece9-d20.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690becee-1358.pma
- %TEMP%\edge_bits_4952_887201551\dde93974-5cbc-4ecc-898f-436e62207c34
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\origins\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\file system\origins\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\file system\000\t\paths\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\file system\000\t\paths\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Сетевая активность
Подключается к
- 'un####ncheats.me':443
- 'co####.edge.skype.com':443
- '16#.#59.142.9':80
- 'go#####agmanager.com':443
- 'cd#.###eplatform.net':443
- 'yandex.ru':443
- 'go#####a###ytics.com':443
- 'st####.##oudflareinsights.com':443
- 'av#####.mds.yandex.net':443
- 'ad#.#dfox.ru':443
- 'ya###tic.net':443
TCP
Другие
- 'un####ncheats.me':443
- 'co####.edge.skype.com':443
- 'go#####agmanager.com':443
- 'cd#.###eplatform.net':443
- 'yandex.ru':443
- 'go#####a###ytics.com':443
- 'st####.##oudflareinsights.com':443
- 'av#####.mds.yandex.net':443
- 'mc.##ndex.md':443
- 'ad#.#dfox.ru':443
- 'ya###tic.net':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK un####ncheats.me
- DNS ASK cd#.###eplatform.net
- DNS ASK go#####agmanager.com
- DNS ASK st####.##oudflareinsights.com
- DNS ASK yandex.ru
- DNS ASK go#####a###ytics.com
- DNS ASK ya###tic.net
- DNS ASK av#####.mds.yandex.net
- DNS ASK mc.yandex.ru
- DNS ASK ad#.#dfox.ru
- DNS ASK mc.##ndex.md
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Запускает на исполнение
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.unknowncheats.me/forum/index.php
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.unknowncheats.me/forum/index.php (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,12805187803125210548,1017811042226381324,131072 --lang=en-US --service-sandbox-type=none --mojo-...
