Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\tmp_vfs2j\test.zip
- %APPDATA%\tmp_vfs2j\setup.exe
- %TEMP%\nsbd82c.tmp
- %TEMP%\nsmd8ba.tmp\inetc.dll
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1c6e58-d4.pma
- %TEMP%\nsmd8ba.tmp\python3.12.zip
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1c6e5f-f3c.pma
- %APPDATA%\windowshelper\get-pip.py
- %TEMP%\nsmd8ba.tmp\nsisunz.dll
- %APPDATA%\windowshelper\python.exe
- %APPDATA%\windowshelper\pythonw.exe
- %APPDATA%\windowshelper\python312.dll
- %APPDATA%\windowshelper\python3.dll
- %APPDATA%\windowshelper\vcruntime140.dll
- %APPDATA%\windowshelper\vcruntime140_1.dll
- %APPDATA%\windowshelper\license.txt
- %APPDATA%\windowshelper\pyexpat.pyd
- %APPDATA%\windowshelper\select.pyd
- %APPDATA%\windowshelper\unicodedata.pyd
- %APPDATA%\windowshelper\winsound.pyd
- %APPDATA%\windowshelper\_asyncio.pyd
- %APPDATA%\windowshelper\_bz2.pyd
- %APPDATA%\windowshelper\_ctypes.pyd
- %APPDATA%\windowshelper\_decimal.pyd
- %APPDATA%\windowshelper\_elementtree.pyd
- %APPDATA%\windowshelper\_hashlib.pyd
- %APPDATA%\windowshelper\_lzma.pyd
- %APPDATA%\windowshelper\_msi.pyd
- %APPDATA%\windowshelper\_multiprocessing.pyd
- %APPDATA%\windowshelper\_overlapped.pyd
- %APPDATA%\windowshelper\_queue.pyd
- %APPDATA%\windowshelper\_socket.pyd
- %APPDATA%\windowshelper\_sqlite3.pyd
- %APPDATA%\windowshelper\_ssl.pyd
- %APPDATA%\windowshelper\_uuid.pyd
- %APPDATA%\windowshelper\_wmi.pyd
- %APPDATA%\windowshelper\_zoneinfo.pyd
- %APPDATA%\windowshelper\libcrypto-3.dll
- %APPDATA%\windowshelper\libffi-8.dll
- %APPDATA%\windowshelper\libssl-3.dll
- %APPDATA%\windowshelper\sqlite3.dll
- %APPDATA%\windowshelper\python312.zip
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %APPDATA%\windowshelper\python312._pth
- %APPDATA%\windowshelper\python.cat
- %TEMP%\nsmd8ba.tmp\nsexec.dll
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %TEMP%\kk5rg_pb
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8baa13f7b32fb253_0
- %TEMP%\tmptbq1p7z3\pip.zip
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e2e36b3554b40415_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5ed76f39ef4237fa_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1e069b3e4a99c358_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b6d94530601fafd3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8ffb8f78e1fe5174_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a5258a4f0fbb5a46_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\688a4b4b23c2152a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6cc6188b4f04ff45_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\61a0b4d20ae0e222_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7e044207414e80a6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e2db4d65d9947a6c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1f1c4bba1674fa36_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\90d7d7591a1b39bb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5fb19c78263396fc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\74b88724f60b0383_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\45a16ff6d0d9ab5f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d0fa80d4db2d38ea_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e55f0a6d1b533c66_0
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a637561c27fd1c88_0
- %TEMP%\tmpzxs67dqgcacert.pem
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5eaaacda31acb5b6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0b29a005a3f64fe9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b0e9e2ebd2b1cf77_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %TEMP%\dfc470f8-bcd5-4c57-b28d-e7fc5fd09cc9.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\afdc28b58bf8c2c2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e239929a95f56ab5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\40c44a679b6b5767_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fe2f2486b9740e56_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\af2cfcaf6d9b18bc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2415c115aef9278e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\256c6f57ec621f9b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b4c2df920951b707_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %TEMP%\tmptbq1p7z3\cacert.pem
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %TEMP%\kk5rg_pb
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1c6e58-d4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a1c6e5f-f3c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Сетевая активность
Подключается к
- 'de###king.xyz':443
- '19#.#32.210.172':80
- 'x1.#.lencr.org':80
- 'e8.#.lencr.org':80
- 'gi##ub.com':443
- 'oc##.#ectigo.com':80
- 're#########ets.githubusercontent.com':443
- 'r1#.#.lencr.org':80
- 'co####.edge.skype.com':443
- 'lo###.##crosoftonline.com':443
- 'lo###.live.com':443
TCP
Запросы HTTP GET
- http://e8.#.lencr.org/95.crl
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBS3DhJWomGbOJFU%2Fpy58BaOB6aMCwQUF5moBMFv5C1wqAoQPQPT6Rq4JmMCEQDnzsw7E%2Fs7e4pG6ozQrrcc
- http://r1#.#.lencr.org/91.crl
Другие
- 'de###king.xyz':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
- 'co####.edge.skype.com':443
- 'lo###.##crosoftonline.com':443
- 'lo###.live.com':443
UDP
- DNS ASK de###king.xyz
- DNS ASK x1.#.lencr.org
- DNS ASK e8.#.lencr.org
- DNS ASK gi##ub.com
- DNS ASK oc##.#ectigo.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK r1#.#.lencr.org
- DNS ASK co####.edge.skype.com
- DNS ASK lo###.##crosoftonline.com
- DNS ASK lo###.live.com
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Создает и запускает на исполнение
- '%APPDATA%\tmp_vfs2j\setup.exe'
- '%APPDATA%\windowshelper\python.exe' get-pip.py
Запускает на исполнение
- '%WINDIR%\syswow64\rundll32.exe' "<Полный путь к файлу>",main_func
- '%WINDIR%\syswow64\tar.exe' -xf test.zip --passphrase 65dc648e42334c9e8d16fb26829aad62
- '%WINDIR%\syswow64\cmd.exe' /c "Setup.exe"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.bing.com/images/search?q=internet%20explorer%20icon.ico&qs=n&form=QBIR&sp=-1&lq=0&pq=internet%20explorer%20icon.ico&sc=3-26&cvid=D94BDE3159374F4DA18F76C39C350625&f...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.bing.com/images/search?q=internet%20explorer%20icon.ico&qs=n&form=QBIR&sp=-1&lq=0&pq=internet%20explorer%20icon.ico&sc=... (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,3024676194609120247,15082110680904521237,131072 --lang=en-US --service-sandbox-type=none --mojo-...
- '<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
- '%APPDATA%\windowshelper\python.exe' get-pip.py (со скрытым окном)
