Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7a3-a88.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7aa-93c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-13a4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-10e4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-bcc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-11bc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2ea71ac9f74f03ef_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2b6ca33525eb26b5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4f6f34500fd9af4b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2982c78ab665d5b1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d7e09d1925dd92f6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\65711d58c1c7e033_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\05bb4de1e9a7cb03_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c73616d46d2bffa6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\efe60ee4ba12f44e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e2fce882034467df_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7a3-a88.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7aa-93c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-10e4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-11bc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-13a4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-bcc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\index
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Сетевая активность
Подключается к
- 'co####.edge.skype.com':443
- 'ab###.xemvn.vn':443
- 'x1.#.lencr.org':80
- 'vi.####oin-price.click':443
- 't.#o':443
- 'cl#####amptearing.com':443
- 'j.###lkin.com':443
- 'pr#####ficinspector.com':443
- 'cr#.####g2.amazontrust.com':80
- 'li##re.com':443
- 'st####.##oudflareinsights.com':443
- 'x.##2.us':80
- 'al#.click':443
- 'st.##static.net':443
- 'g.###cdn.com':443
- 'fo###.gstatic.com':443
- 'ae#######.aliexpress-media.com':443
- 'as####.#liexpress-media.com':443
- 'fo####r.taobao.com':443
TCP
Запросы HTTP GET
- http://cr#.####g2.amazontrust.com/rootg2.cer
- http://x.##2.us/x.cer
Другие
- 'co####.edge.skype.com':443
- 'ab###.xemvn.vn':443
- 'vi.####oin-price.click':443
- 't.#o':443
- 'cl#####amptearing.com':443
- 'j.###lkin.com':443
- 'pr#####ficinspector.com':443
- 'li##re.com':443
- 'st####.##oudflareinsights.com':443
- 'ae######ons.aliexpress.ru':443
- 'al###press.ru':443
- 'fo#####.aliexpress.com':443
- 'st.##static.net':443
- 'ae##.alicdn.com':443
- 'fo###.gstatic.com':443
- 'ae#######.aliexpress-media.com':443
- 'as####.#liexpress-media.com':443
- 'fo####r.taobao.com':443
- '4q####.tdum.alibaba.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK ab###.xemvn.vn
- DNS ASK x1.#.lencr.org
- DNS ASK vi.####oin-price.click
- DNS ASK t.#o
- DNS ASK cl#####amptearing.com
- DNS ASK li###nclick.com
- DNS ASK pr#####ficinspector.com
- DNS ASK cr#.####g2.amazontrust.com
- DNS ASK li##re.com
- DNS ASK st####.##oudflareinsights.com
- DNS ASK x.##2.us
- DNS ASK jw##kin.com
- DNS ASK v.###cre.com
- DNS ASK j.###lkin.com
- DNS ASK al#.click
- DNS ASK al###press.ru
- DNS ASK lo###.aliexpress.ru
- DNS ASK st.###express.ru
- DNS ASK st.##static.net
- DNS ASK g.###cdn.com
- DNS ASK fo###.gstatic.com
- DNS ASK ae#######.aliexpress-media.com
- DNS ASK as####.#liexpress-media.com
- DNS ASK fo####r.taobao.com
- DNS ASK ae#####cs.aliexpress.ru
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Запускает на исполнение
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-1/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-2/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://about.xemvn.vn/direct-link-1/ (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-3/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-4/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-5/
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,17179141789371324276,5061500708385156881,131072 --lang=en-US --service-sandbox-type=none --mojo-...
