Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a11363c-d78.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a113641-844.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ca3e67bc63def897_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e4c9cb27a9542152_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a83ad75ac1d7a8f0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\dd6a93fd38ae1b30_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d36c6a3ab59d54b5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fbf7f95939888624_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f0e22904e8ab94db_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6702ce3db385200d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b98da9cf0e5d1adf_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\21103d23e607fd9b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fef42a4f19fb0b43_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\34d2f6bfd2c58901_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\622196ee501069ea_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d96ad6f7699537bb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ac71c6b19c4c6ac4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1df5ea835a63c4e4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3d9750b9152a9ee5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %TEMP%\df1fef34-ab17-4be7-af2b-84f952679d55.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1fae4f7248ae1c29_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\37f71edd13fb6f4b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2e8fb5db26b320b2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0b2596f2e960011e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\74c0284e88038329_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ed91afec2749dba4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fa1b6207ed8a4b36_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7ba72afc41a1b843_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\80aa56661ea8d4b1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f7f7033374f1ffec_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c9e81ad791b57a18_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1f221b1fdf928d87_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\625f2f10111a4cad_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\87c3dc04dbf4195b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7a713ce2932fe147_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3caf11df4b062eb6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %TEMP%\2116_2139512466\manifest.json
- %TEMP%\2116_2139512466\license.txt
- %TEMP%\2116_2139512466\filtering rules
- %TEMP%\2116_2139512466\_metadata\verified_contents.json
- %TEMP%\2116_2139512466\manifest.fingerprint
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir2116_2128139320\ruleset data
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a11363c-d78.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a113641-844.pma
- %TEMP%\edge_bits_2116_192350014\dde93974-5cbc-4ecc-898f-436e62207c34
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG
Сетевая активность
Подключается к
- 'co####.edge.skype.com':443
- 'sp#.#aidu.com':443
- 'ps#.##static.com':443
- 'ps#####c.cdn.bcebos.com':443
- 'he#####tatic.baidu.com':443
- 'mb#.#aidu.com':443
- 'he####.baidu.com':443
- 'gi###.baidu.com':443
- 'ca####s.digicert.cn':80
- 'pa####rt.baidu.com':443
TCP
Запросы HTTP GET
- http://ca####s.digicert.cn/DigiCertGlobalRootCA.crt
Другие
- 'co####.edge.skype.com':443
- 'sp#.#aidu.com':443
- 'ps#.##static.com':443
- 'he#####tatic.baidu.com':443
- 'mb#.#aidu.com':443
- 'he####.baidu.com':443
- 'gi###.baidu.com':443
- 'pa####rt.baidu.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK ba##u.com
- DNS ASK ds##.#dstatic.com
- DNS ASK ps#.##static.com
- DNS ASK sp#.#aidu.com
- DNS ASK ss#.##static.com
- DNS ASK ps#####c.cdn.bcebos.com
- DNS ASK he#####tatic.baidu.com
- DNS ASK mb#.#aidu.com
- DNS ASK he####.baidu.com
- DNS ASK gi###.baidu.com
- DNS ASK ca####s.digicert.cn
- DNS ASK pa####rt.baidu.com
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Запускает на исполнение
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' https://www.baidu.com
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.baidu.com (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,15005265870685171786,1503723399674334872,131072 --lang=en-US --service-sandbox-type=none --mojo-...
