Техническая информация
Вредоносные функции
Запускает большое число процессов
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\python.exe
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\pythonw.exe
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\python3.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\vcruntime140.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\vcruntime140_1.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\license.txt
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\pyexpat.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\select.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\winsound.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_asyncio.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_bz2.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_ctypes.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_decimal.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_elementtree.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_hashlib.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_lzma.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_multiprocessing.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_overlapped.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_queue.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_remote_debugging.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_socket.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_sqlite3.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_ssl.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_uuid.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_wmi.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_zoneinfo.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\_zstd.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\libffi-8.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\python314.zip
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\python314._pth
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\python.cat
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\unicodedata.pyd
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\libssl-3.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\sqlite3.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\libcrypto-3.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\python\python314.dll
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\app\windowsraper.py
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\runcell.json
- %LOCALAPPDATA%\runcell-pyexe\.a7c8a3ef8bdab33218b001d037978980-4284-1790206238304636300\.runcell-complete
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46124-1110.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46124-41c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46124-428.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46124-12f8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46125-218.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46126-dbc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46127-ec.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46129-e64.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4612a-e60.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4612c-e00.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4613a-1504.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4613a-132c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4613a-14ec.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46141-d38.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46148-9a0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46148-48.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46148-1158.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46148-1528.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab46148-ed4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4614a-11f4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4614b-14c0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab4614d-12b4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8e8a22afd5125360_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
Удаляет файлы, которые сам же создал
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
Перемещает следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
Изменяет следующие файлы
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %TEMP%\.ses
Подменяет следующие файлы
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Сетевая активность
Подключается к
- 'co####.edge.skype.com':443
- 'scholar.google.com':443
- 're####chgate.net':443
- 'js##r.org':443
- 'sc####edirect.com':443
- 'do##.python.org':443
- 'ar##v.org':443
- 'cm#.#ature.com':443
- 'en.###ipedia.org':443
- 'ce#######tes.starfieldtech.com':80
- 'pm#.###i.nlm.nih.gov':443
- 'x1.#.lencr.org':80
- 'id#.##ringer.com':443
- 'go#####a###ytics.com':443
- 'cd#.###i.nlm.nih.gov':443
- 'ct.####cha-delivery.com':443
- 'cr#.####g2.amazontrust.com':80
TCP
Запросы HTTP GET
- http://ce#######tes.starfieldtech.com/repository/sfroot-g2.crt.cer
Другие
- 'co####.edge.skype.com':443
- 'scholar.google.com':443
- 're####chgate.net':443
- 'js##r.org':443
- 'sc####edirect.com':443
- 'an#####cs.python.org':443
- 'ar##v.org':443
- 'cm#.#ature.com':443
- 'en.###ipedia.org':443
- 'pm#.###i.nlm.nih.gov':443
- 'go#####a###ytics.com':443
- 'cd#.###i.nlm.nih.gov':443
- 'ct.####cha-delivery.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK scholar.google.com
- DNS ASK re####chgate.net
- DNS ASK js##r.org
- DNS ASK sc####edirect.com
- DNS ASK do##.python.org
- DNS ASK ar##v.org
- DNS ASK sp###ger.com
- DNS ASK en.###ipedia.org
- DNS ASK na##re.com
- DNS ASK ce#######tes.starfieldtech.com
- DNS ASK nc##.#lm.nih.gov
- DNS ASK x1.#.lencr.org
- DNS ASK id#.#ature.com
- DNS ASK li##.#pringer.com
- DNS ASK pm#.###i.nlm.nih.gov
- DNS ASK id#.##ringer.com
- DNS ASK cd#.###i.nlm.nih.gov
- DNS ASK go#####a###ytics.com
- DNS ASK ct.####cha-delivery.com
- DNS ASK cr#.####g2.amazontrust.com
Другое
Ищет следующие окна
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Запускает на исполнение
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://docs.python.org/3/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://arxiv.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://en.wikipedia.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://scholar.google.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.ncbi.nlm.nih.gov/pmc/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.jstor.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.sciencedirect.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.researchgate.net/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.springer.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.nature.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://scholar.google.com/ (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.researchgate.net/ (со скрытым окном)
