Trojan.Siggen32.26859

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\iso7z.32.exe
%TEMP%\rarsfx0\cybermania.url
%TEMP%\rarsfx0\setting.reg
%TEMP%\rarsfx0\7zx86.msi
%TEMP%\rarsfx0\files\7-zip\7-zip.chm
%TEMP%\rarsfx0\files\7-zip\7-zip.dll
%TEMP%\rarsfx0\files\7-zip\7z.dll
%TEMP%\rarsfx0\files\7-zip\7z.exe
%TEMP%\rarsfx0\files\7-zip\7z.sfx
%TEMP%\rarsfx0\files\7-zip\7zcon.sfx
%TEMP%\rarsfx0\files\7-zip\7zfm.exe
%TEMP%\rarsfx0\files\7-zip\7zg.exe
%TEMP%\rarsfx0\files\7-zip\descript.ion
%TEMP%\rarsfx0\files\7-zip\history.txt
%TEMP%\rarsfx0\files\7-zip\lang\af.txt
%TEMP%\rarsfx0\files\7-zip\lang\an.txt
%TEMP%\rarsfx0\files\7-zip\lang\ar.txt
%TEMP%\rarsfx0\files\7-zip\lang\ast.txt
%TEMP%\rarsfx0\files\7-zip\lang\az.txt
%TEMP%\rarsfx0\files\7-zip\lang\ba.txt
%TEMP%\rarsfx0\files\7-zip\lang\be.txt
%TEMP%\rarsfx0\files\7-zip\lang\bg.txt
%TEMP%\rarsfx0\files\7-zip\lang\bn.txt
%TEMP%\rarsfx0\files\7-zip\lang\br.txt
%TEMP%\rarsfx0\files\7-zip\lang\ca.txt
%TEMP%\rarsfx0\files\7-zip\lang\co.txt
%TEMP%\rarsfx0\files\7-zip\lang\cs.txt
%TEMP%\rarsfx0\files\7-zip\lang\cy.txt
%TEMP%\rarsfx0\files\7-zip\lang\da.txt
%TEMP%\rarsfx0\files\7-zip\lang\de.txt
%TEMP%\rarsfx0\files\7-zip\lang\el.txt
%TEMP%\rarsfx0\files\7-zip\lang\en.ttt
%TEMP%\rarsfx0\files\7-zip\lang\eo.txt
%TEMP%\rarsfx0\files\7-zip\lang\es.txt
%TEMP%\rarsfx0\files\7-zip\lang\et.txt
%TEMP%\rarsfx0\files\7-zip\lang\eu.txt
%TEMP%\rarsfx0\files\7-zip\lang\ext.txt
%TEMP%\rarsfx0\files\7-zip\lang\fa.txt
%TEMP%\rarsfx0\files\7-zip\lang\fi.txt
%TEMP%\rarsfx0\files\7-zip\lang\fr.txt
%TEMP%\rarsfx0\files\7-zip\lang\fur.txt
%TEMP%\rarsfx0\files\7-zip\lang\fy.txt
%TEMP%\rarsfx0\files\7-zip\lang\ga.txt
%TEMP%\rarsfx0\files\7-zip\lang\gl.txt
%TEMP%\rarsfx0\files\7-zip\lang\gu.txt
%TEMP%\rarsfx0\files\7-zip\lang\he.txt
%TEMP%\rarsfx0\files\7-zip\lang\hi.txt
%TEMP%\rarsfx0\files\7-zip\lang\hr.txt
%TEMP%\rarsfx0\files\7-zip\lang\hu.txt
%TEMP%\rarsfx0\files\7-zip\lang\hy.txt
%TEMP%\rarsfx0\files\7-zip\lang\id.txt
%TEMP%\rarsfx0\files\7-zip\lang\io.txt
%TEMP%\rarsfx0\files\7-zip\lang\is.txt
%TEMP%\rarsfx0\files\7-zip\lang\it.txt
%TEMP%\rarsfx0\files\7-zip\lang\ja.txt
%TEMP%\rarsfx0\files\7-zip\lang\ka.txt
%TEMP%\rarsfx0\files\7-zip\lang\kaa.txt
%TEMP%\rarsfx0\files\7-zip\lang\kab.txt
%TEMP%\rarsfx0\files\7-zip\lang\kk.txt
%TEMP%\rarsfx0\files\7-zip\lang\ko.txt
%TEMP%\rarsfx0\files\7-zip\lang\ku-ckb.txt
%TEMP%\rarsfx0\files\7-zip\lang\ku.txt
%TEMP%\rarsfx0\files\7-zip\lang\ky.txt
%TEMP%\rarsfx0\files\7-zip\lang\lij.txt
%TEMP%\rarsfx0\files\7-zip\lang\lt.txt
%TEMP%\rarsfx0\files\7-zip\lang\lv.txt
%TEMP%\rarsfx0\files\7-zip\lang\mk.txt
%TEMP%\rarsfx0\files\7-zip\lang\mn.txt
%TEMP%\rarsfx0\files\7-zip\lang\mng.txt
%TEMP%\rarsfx0\files\7-zip\lang\mng2.txt
%TEMP%\rarsfx0\files\7-zip\lang\mr.txt
%TEMP%\rarsfx0\files\7-zip\lang\ms.txt
%TEMP%\rarsfx0\files\7-zip\lang\nb.txt
%TEMP%\rarsfx0\files\7-zip\lang\ne.txt
%TEMP%\rarsfx0\files\7-zip\lang\nl.txt
%TEMP%\rarsfx0\files\7-zip\lang\nn.txt
%TEMP%\rarsfx0\files\7-zip\lang\pa-in.txt
%TEMP%\rarsfx0\files\7-zip\lang\pl.txt
%TEMP%\rarsfx0\files\7-zip\lang\ps.txt
%TEMP%\rarsfx0\files\7-zip\lang\pt-br.txt
%TEMP%\rarsfx0\files\7-zip\lang\pt.txt
%TEMP%\rarsfx0\files\7-zip\lang\ro.txt
%TEMP%\rarsfx0\files\7-zip\lang\ru.txt
%TEMP%\rarsfx0\files\7-zip\lang\sa.txt
%TEMP%\rarsfx0\files\7-zip\lang\si.txt
%TEMP%\rarsfx0\files\7-zip\lang\sk.txt
%TEMP%\rarsfx0\files\7-zip\lang\sl.txt
%TEMP%\rarsfx0\files\7-zip\lang\sq.txt
%TEMP%\rarsfx0\files\7-zip\lang\sr-spc.txt
%TEMP%\rarsfx0\files\7-zip\lang\sr-spl.txt
%TEMP%\rarsfx0\files\7-zip\lang\sv.txt
%TEMP%\rarsfx0\files\7-zip\lang\sw.txt
%TEMP%\rarsfx0\files\7-zip\lang\ta.txt
%TEMP%\rarsfx0\files\7-zip\lang\tg.txt
%TEMP%\rarsfx0\files\7-zip\lang\th.txt
%TEMP%\rarsfx0\files\7-zip\lang\tk.txt
%TEMP%\rarsfx0\files\7-zip\lang\tr.txt
%TEMP%\rarsfx0\files\7-zip\lang\tt.txt
%TEMP%\rarsfx0\files\7-zip\lang\ug.txt
%TEMP%\rarsfx0\files\7-zip\lang\uk.txt
%TEMP%\rarsfx0\files\7-zip\lang\uz-cyrl.txt
%TEMP%\rarsfx0\files\7-zip\lang\uz.txt
%TEMP%\rarsfx0\files\7-zip\lang\va.txt
%TEMP%\rarsfx0\files\7-zip\lang\vi.txt
%TEMP%\rarsfx0\files\7-zip\lang\yo.txt
%TEMP%\rarsfx0\files\7-zip\lang\zh-cn.txt
%TEMP%\rarsfx0\files\7-zip\lang\zh-tw.txt
%TEMP%\rarsfx0\files\7-zip\license.txt
%TEMP%\rarsfx0\files\7-zip\readme.txt
%WINDIR%\temp\~dff395000022c9dcdc.tmp
%WINDIR%\installer\sourcehash{23170f69-40c1-2701-2401-000001000000}
%WINDIR%\temp\~df5e51bba8d3cf8ec3.tmp
%WINDIR%\temp\~df77113f2273d0427f.tmp
%WINDIR%\temp\~df6739b1de997aa15f.tmp
%ProgramFiles(x86)%\7-zip\7zfm.exe
%ProgramFiles(x86)%\7-zip\7-zip.dll
%ProgramFiles(x86)%\7-zip\7zg.exe
%ProgramFiles(x86)%\7-zip\7z.dll
%ProgramFiles(x86)%\7-zip\7z.exe
%ProgramFiles(x86)%\7-zip\7z.sfx
%ProgramFiles(x86)%\7-zip\7zcon.sfx
%ProgramFiles(x86)%\7-zip\descript.ion
%ProgramFiles(x86)%\7-zip\history.txt
%ProgramFiles(x86)%\7-zip\license.txt
%ProgramFiles(x86)%\7-zip\readme.txt
%ProgramFiles(x86)%\7-zip\7-zip.chm
%ProgramFiles(x86)%\7-zip\lang\en.ttt
%ProgramFiles(x86)%\7-zip\lang\af.txt
%ProgramFiles(x86)%\7-zip\lang\an.txt
%ProgramFiles(x86)%\7-zip\lang\ar.txt
%ProgramFiles(x86)%\7-zip\lang\ast.txt
%ProgramFiles(x86)%\7-zip\lang\az.txt
%ProgramFiles(x86)%\7-zip\lang\ba.txt
%ProgramFiles(x86)%\7-zip\lang\be.txt
%ProgramFiles(x86)%\7-zip\lang\bg.txt
%ProgramFiles(x86)%\7-zip\lang\bn.txt
%ProgramFiles(x86)%\7-zip\lang\br.txt
%ProgramFiles(x86)%\7-zip\lang\ca.txt
%ProgramFiles(x86)%\7-zip\lang\co.txt
%ProgramFiles(x86)%\7-zip\lang\cs.txt
%ProgramFiles(x86)%\7-zip\lang\cy.txt
%ProgramFiles(x86)%\7-zip\lang\da.txt
%ProgramFiles(x86)%\7-zip\lang\de.txt
%ProgramFiles(x86)%\7-zip\lang\el.txt
%ProgramFiles(x86)%\7-zip\lang\eo.txt
%ProgramFiles(x86)%\7-zip\lang\es.txt
%ProgramFiles(x86)%\7-zip\lang\et.txt
%ProgramFiles(x86)%\7-zip\lang\eu.txt
%ProgramFiles(x86)%\7-zip\lang\ext.txt
%ProgramFiles(x86)%\7-zip\lang\fa.txt
%ProgramFiles(x86)%\7-zip\lang\fi.txt
%ProgramFiles(x86)%\7-zip\lang\fr.txt
%ProgramFiles(x86)%\7-zip\lang\fur.txt
%ProgramFiles(x86)%\7-zip\lang\fy.txt
%ProgramFiles(x86)%\7-zip\lang\ga.txt
%ProgramFiles(x86)%\7-zip\lang\gl.txt
%ProgramFiles(x86)%\7-zip\lang\gu.txt
%ProgramFiles(x86)%\7-zip\lang\he.txt
%ProgramFiles(x86)%\7-zip\lang\hi.txt
%ProgramFiles(x86)%\7-zip\lang\hr.txt
%ProgramFiles(x86)%\7-zip\lang\hu.txt
%ProgramFiles(x86)%\7-zip\lang\hy.txt
%ProgramFiles(x86)%\7-zip\lang\id.txt
%ProgramFiles(x86)%\7-zip\lang\io.txt
%ProgramFiles(x86)%\7-zip\lang\is.txt
%ProgramFiles(x86)%\7-zip\lang\it.txt
%ProgramFiles(x86)%\7-zip\lang\ja.txt
%ProgramFiles(x86)%\7-zip\lang\ka.txt
%ProgramFiles(x86)%\7-zip\lang\kaa.txt
%ProgramFiles(x86)%\7-zip\lang\kab.txt
%ProgramFiles(x86)%\7-zip\lang\kk.txt
%ProgramFiles(x86)%\7-zip\lang\ko.txt
%ProgramFiles(x86)%\7-zip\lang\ku.txt
%ProgramFiles(x86)%\7-zip\lang\ku-ckb.txt
%ProgramFiles(x86)%\7-zip\lang\ky.txt
%ProgramFiles(x86)%\7-zip\lang\lij.txt
%ProgramFiles(x86)%\7-zip\lang\lt.txt
%ProgramFiles(x86)%\7-zip\lang\lv.txt
%ProgramFiles(x86)%\7-zip\lang\mk.txt
%ProgramFiles(x86)%\7-zip\lang\mn.txt
%ProgramFiles(x86)%\7-zip\lang\mng.txt
%ProgramFiles(x86)%\7-zip\lang\mng2.txt
%ProgramFiles(x86)%\7-zip\lang\mr.txt
%ProgramFiles(x86)%\7-zip\lang\ms.txt
%ProgramFiles(x86)%\7-zip\lang\ne.txt
%ProgramFiles(x86)%\7-zip\lang\nl.txt
%ProgramFiles(x86)%\7-zip\lang\nb.txt
%ProgramFiles(x86)%\7-zip\lang\nn.txt
%ProgramFiles(x86)%\7-zip\lang\pa-in.txt
%ProgramFiles(x86)%\7-zip\lang\pl.txt
%ProgramFiles(x86)%\7-zip\lang\ps.txt
%ProgramFiles(x86)%\7-zip\lang\pt.txt
%ProgramFiles(x86)%\7-zip\lang\pt-br.txt
%ProgramFiles(x86)%\7-zip\lang\ro.txt
%ProgramFiles(x86)%\7-zip\lang\ru.txt
%ProgramFiles(x86)%\7-zip\lang\sa.txt
%ProgramFiles(x86)%\7-zip\lang\si.txt
%ProgramFiles(x86)%\7-zip\lang\sk.txt
%ProgramFiles(x86)%\7-zip\lang\sl.txt
%ProgramFiles(x86)%\7-zip\lang\sq.txt
%ProgramFiles(x86)%\7-zip\lang\sr-spl.txt
%ProgramFiles(x86)%\7-zip\lang\sr-spc.txt
%ProgramFiles(x86)%\7-zip\lang\sv.txt
%ProgramFiles(x86)%\7-zip\lang\sw.txt
%ProgramFiles(x86)%\7-zip\lang\ta.txt
%ProgramFiles(x86)%\7-zip\lang\tg.txt
%ProgramFiles(x86)%\7-zip\lang\th.txt
%ProgramFiles(x86)%\7-zip\lang\tk.txt
%ProgramFiles(x86)%\7-zip\lang\tr.txt
%ProgramFiles(x86)%\7-zip\lang\tt.txt
%ProgramFiles(x86)%\7-zip\lang\ug.txt
%ProgramFiles(x86)%\7-zip\lang\uk.txt
%ProgramFiles(x86)%\7-zip\lang\uz.txt
%ProgramFiles(x86)%\7-zip\lang\uz-cyrl.txt
%ProgramFiles(x86)%\7-zip\lang\va.txt
%ProgramFiles(x86)%\7-zip\lang\vi.txt
%ProgramFiles(x86)%\7-zip\lang\yo.txt
%ProgramFiles(x86)%\7-zip\lang\zh-cn.txt
%ProgramFiles(x86)%\7-zip\lang\zh-tw.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\7-zip\7-zip file manager.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\7-zip\7-zip help.lnk
%WINDIR%\temp\~df55f6a70e41e9c810.tmp
%WINDIR%\temp\~df757e58fe82640e15.tmp
%WINDIR%\temp\~df2e4271110c8010ad.tmp
%WINDIR%\temp\~df760db95fd283340b.tmp
%WINDIR%\temp\~df68652db844964abd.tmp
%WINDIR%\temp\~dfed1d984aa1f26f3e.tmp
%WINDIR%\temp\~df950f2e98c3bbcb85.tmp
%WINDIR%\temp\~dfe8f5891bcdd7702e.tmp
%ProgramFiles(x86)%\7-zip\formats\iso7z.32.dll
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f68e8-558.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f68ec-f60.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3351369d6616fd1e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f6b2e04d03c656dc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5610223cb6087d2f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9e5c59d5a0eec716_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f8deeab672257e1f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\99a566994112de1e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e831cb81d18d09fc_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\060a09b50906ca92_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7f43a816b2242666_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6019b090dc496db5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b7e6189587e29f0f_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\36afb459346c2d91_0
%LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\60cdcbf5823c0949_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\95b49f02b03fcbd6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c9c4ab9064c07376_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\335e69ddec2b9ac6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a56b18d1aec28207_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c8e3d243213c2816_0
%TEMP%\3bab1bbe-b368-4c90-a6b1-dddbb5e5ad0a.tmp
%TEMP%\1dd763af-cc91-4130-b8df-de488083a2da.tmp
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f93cbb6e16225bfd_0

Удаляет файлы, которые сам же создал

%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f68e8-558.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f68ec-f60.pma

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\videodecodestats\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%TEMP%\.ses

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Сетевая активность

Подключается к

'co####.edge.skype.com':443
'cy###mania.ws':443
'go#####agmanager.com':443
'dr#######bidk.cloudfront.net':443
'x.##2.us':80
'st####.##oudflareinsights.com':443
'st####e.ko-fi.com':443
'ok.###essixes.com':443
'uk####spectsofc.org':443
'gh####ethec.info':443
'ou#####tobeconsist.org':443
'de#####tthatheha.org':443
'cr#.####g2.amazontrust.com':80
'x1.#.lencr.org':80
'uk####ngwithea.com':443
'yo##ube.com':443
'fa###ook.com':443
'accounts.google.com':443
'i.##img.com':443
'fo###.gstatic.com':443
'a###ytics.google.com':443
'st###.#.doubleclick.net':443
'go##le.ru':443
'pa#####.#ooglesyndication.com':443
'go######s.g.doubleclick.net':443
'st####.doubleclick.net':443
'yt#.#gpht.com':443
'jn####.googleapis.com':443
'a.###.#loudflare.com':443

TCP

Запросы HTTP GET

http://x.##2.us/x.cer

Другие

'co####.edge.skype.com':443
'cy###mania.ws':443
'go#####agmanager.com':443
'dr#######bidk.cloudfront.net':443
'st####e.ko-fi.com':443
'st####.##oudflareinsights.com':443
'gb.###tobrolly.com':443
'gh####ethec.info':443
'uk####spectsofc.org':443
'ou#####tobeconsist.org':443
'de#####tthatheha.org':443
'uk####ngwithea.com':443
'yo##ube.com':443
'accounts.google.com':443
'fa###ook.com':443
'i.##img.com':443
'fo###.gstatic.com':443
'a###ytics.google.com':443
'st###.#.doubleclick.net':443
'go##le.ru':443
'pa#####.#ooglesyndication.com':443
'go######s.g.doubleclick.net':443
'st####.doubleclick.net':443
'google.com':443
'jn####.googleapis.com':443
'a.###.#loudflare.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK cy###mania.ws
DNS ASK fo###.#oogleapis.com
DNS ASK go#####agmanager.com
DNS ASK dr#######bidk.cloudfront.net
DNS ASK x.##2.us
DNS ASK gb.###tobrolly.com
DNS ASK ok.###essixes.com
DNS ASK st####e.ko-fi.com
DNS ASK st####.##oudflareinsights.com
DNS ASK ou#####tobeconsist.org
DNS ASK uk####spectsofc.org
DNS ASK gh####ethec.info
DNS ASK de#####tthatheha.org
DNS ASK cr#.####g2.amazontrust.com
DNS ASK x1.#.lencr.org
DNS ASK uk####ngwithea.com
DNS ASK yo##ube.com
DNS ASK di##ord.gg
DNS ASK pa##al.me
DNS ASK t.#e
DNS ASK fa###ook.com
DNS ASK accounts.google.com
DNS ASK i.##img.com
DNS ASK fo###.gstatic.com
DNS ASK a###ytics.google.com
DNS ASK st###.#.doubleclick.net
DNS ASK go##le.ru
DNS ASK pa#####.#ooglesyndication.com
DNS ASK go######s.g.doubleclick.net
DNS ASK st####.doubleclick.net
DNS ASK yt#.#gpht.com
DNS ASK google.com
DNS ASK gs##tic.com
DNS ASK jn####.googleapis.com
DNS ASK a.###.#loudflare.com

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Создает и запускает на исполнение

'%TEMP%\rarsfx0\iso7z.32.exe'

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\RarSFX0\7zx86.msi" /qb
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.cybermania.ws/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.cybermania.ws/ (со скрытым окном)
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,9902201031695903109,3641875036515023661,131072 --lang=en-US --service-sandbox-type=none --mojo-p...

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней