Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\mftchp.exe
- <Текущая директория>\memory.exe
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f58c3-1384.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f58c3-118c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f58ca-9bc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a29073a3a5b46cb8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\46dcc4e70114199b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\be2ccb2e9e4f02a6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b04278298986d34b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\68825d4d751bc32e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bfd9a2b338959655_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\07e7ad52c3f457f7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0399f8ef2f0131cf_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7f21750288a13fc0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\96179167e28d250b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6d59c2ef3947dd93_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c136e3a018afc90c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b9f98f2d038479fc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4d10767b3cdb06ad_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a68594e805aa4b89_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\879795a132b88eb7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\01adacd7fb328172_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d4d20ed7611ecdba_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e87ebefe9cf4a842_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0d123d46960d1ea8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c811e54fad0553b6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\574050242d12e9ba_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8ba37d5edb02a0c1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\569b40f2c69b1b97_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7b300fb9c737cf71_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea808628022f9998_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b537a51f9f19e536_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\76dfecf3b36463a1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6282abf1fd62aa59_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\eee20804b2361760_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cc55ab006a1fb293_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b851209b05da17aa_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\90ad606c80e059eb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\78e8c98c1b20eab6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1715b6ef8530d1b5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\58c28a2733f72764_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b2695d96270b6731_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c6020980679d27b1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cdeaa4dbad5d9c36_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ee101946c454289f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\25850e3348c1b59c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fa4f3c58e5361810_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e68c4287a6bae600_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e417c7e13d50abfb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f7f23aebf40e12c3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\790dcbebbfcddfb3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ce9aae3c8b552752_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8e2e8e9b8a7839c9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %TEMP%\c5d70554-064e-468e-883b-15eb38833715.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f58c3-118c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f58c3-1384.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-699f58ca-9bc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\edge_bits_2492_1736251363\0c17d4e3-9d9d-44b6-9280-2b041bbaf3d9
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Сетевая активность
Подключается к
- 'co####.edge.skype.com':443
- 'di##ord.gg':443
- 'di##ord.com':443
- 'localhost':6463
- 'cd#.##scordapp.com':443
- 'localhost':6464
- 'localhost':6465
- 'localhost':6466
- 'localhost':6467
- 'localhost':6468
- 'localhost':6469
- 'localhost':6470
- 'localhost':6471
- 'localhost':6472
TCP
Другие
- 'co####.edge.skype.com':443
- 'di##ord.gg':443
- 'di##ord.com':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK di##ord.gg
- DNS ASK di##ord.com
- DNS ASK cd#.##scordapp.com
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Создает и запускает на исполнение
- '<Текущая директория>\memory.exe' -p 720
- '<Текущая директория>\memory.exe' -p 2036
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c start "" "https://discord.gg/allianceoficial" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c start "" "https://instagram.com/kellerffx/" (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://discord.gg/allianceoficial
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://instagram.com/kellerffx/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.gg/allianceoficial (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,12607402237316916113,14325634460523092958,131072 --lang=en-US --service-sandbox-type=none --mojo...
- '<Текущая директория>\memory.exe' -p 720 (со скрытым окном)
- '<Текущая директория>\memory.exe' -p 2036 (со скрытым окном)
