Trojan.Siggen32.5963

Technical Information

Modifies file system

Creates the following files

%TEMP%\rarsfx0\screenrecordermasterplus.exe
%TEMP%\rarsfx0\getintoway.url
%APPDATA%\the fyine empire llc\screen recorder master plus 1.0.0\install\screen recorder master plus.msi
%TEMP%\shieace.tmp
%TEMP%\msieb4c.tmp
%APPDATA%\the fyine empire llc\screen recorder master plus 1.0.0\install\screen recorder master plus1.cab
%WINDIR%\temp\~df549382a73459123b.tmp
%WINDIR%\installer\sourcehash{7d9ba61f-15e0-4619-b961-f2242cc63235}
%WINDIR%\temp\~dfe0206a19b2fd9e9a.tmp
%WINDIR%\temp\~dfba49903a675b44f7.tmp
%WINDIR%\temp\~dfdcfb8b63a9063dcd.tmp
%ProgramFiles(x86)%\screen recorder master plus\screen recorder master plus.exe
%ProgramFiles(x86)%\screen recorder master plus\screna.dll
%ProgramFiles(x86)%\screen recorder master plus\sharpavi.dll
%ProgramFiles(x86)%\screen recorder master plus\sharpdx.direct2d1.dll
%ProgramFiles(x86)%\screen recorder master plus\sharpdx.direct3d9.dll
%ProgramFiles(x86)%\screen recorder master plus\sharpdx.direct3d11.dll
%ProgramFiles(x86)%\screen recorder master plus\sharpdx.dll
%ProgramFiles(x86)%\screen recorder master plus\sharpdx.dxgi.dll
%ProgramFiles(x86)%\screen recorder master plus\system.appcontext.dll
%ProgramFiles(x86)%\screen recorder master plus\system.collections.concurrent.dll
%ProgramFiles(x86)%\screen recorder master plus\system.collections.dll
%ProgramFiles(x86)%\screen recorder master plus\system.collections.nongeneric.dll
%ProgramFiles(x86)%\screen recorder master plus\system.collections.specialized.dll
%ProgramFiles(x86)%\screen recorder master plus\system.componentmodel.annotations.dll
%ProgramFiles(x86)%\screen recorder master plus\system.componentmodel.dll
%ProgramFiles(x86)%\screen recorder master plus\system.componentmodel.eventbasedasync.dll
%ProgramFiles(x86)%\screen recorder master plus\system.componentmodel.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.componentmodel.typeconverter.dll
%ProgramFiles(x86)%\screen recorder master plus\system.console.dll
%ProgramFiles(x86)%\screen recorder master plus\system.data.common.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.contracts.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.debug.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.fileversioninfo.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.process.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.stacktrace.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.textwritertracelistener.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.tools.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.tracesource.dll
%ProgramFiles(x86)%\screen recorder master plus\system.diagnostics.tracing.dll
%ProgramFiles(x86)%\screen recorder master plus\system.drawing.common.dll
%ProgramFiles(x86)%\screen recorder master plus\system.drawing.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.dynamic.runtime.dll
%ProgramFiles(x86)%\screen recorder master plus\system.globalization.calendars.dll
%ProgramFiles(x86)%\screen recorder master plus\system.globalization.dll
%ProgramFiles(x86)%\screen recorder master plus\system.globalization.extensions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.compression.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.compression.zipfile.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.filesystem.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.filesystem.driveinfo.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.filesystem.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.filesystem.watcher.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.isolatedstorage.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.memorymappedfiles.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.pipes.dll
%ProgramFiles(x86)%\screen recorder master plus\system.io.unmanagedmemorystream.dll
%ProgramFiles(x86)%\screen recorder master plus\system.linq.dll
%ProgramFiles(x86)%\screen recorder master plus\system.linq.expressions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.linq.parallel.dll
%ProgramFiles(x86)%\screen recorder master plus\system.linq.queryable.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.http.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.nameresolution.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.networkinformation.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.ping.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.requests.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.security.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.sockets.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.webheadercollection.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.websockets.client.dll
%ProgramFiles(x86)%\screen recorder master plus\system.net.websockets.dll
%ProgramFiles(x86)%\screen recorder master plus\system.objectmodel.dll
%ProgramFiles(x86)%\screen recorder master plus\system.reactive.dll
%ProgramFiles(x86)%\screen recorder master plus\system.reflection.dll
%ProgramFiles(x86)%\screen recorder master plus\system.reflection.extensions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.reflection.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.reflection.typeextensions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.resources.reader.dll
%ProgramFiles(x86)%\screen recorder master plus\system.resources.resourcemanager.dll
%ProgramFiles(x86)%\screen recorder master plus\system.resources.writer.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.compilerservices.unsafe.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.compilerservices.visualc.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.extensions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.handles.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.interopservices.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.interopservices.runtimeinformation.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.numerics.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.serialization.formatters.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.serialization.json.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.serialization.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.runtime.serialization.xml.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.claims.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.cryptography.algorithms.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.cryptography.csp.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.cryptography.encoding.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.cryptography.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.cryptography.x509certificates.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.principal.dll
%ProgramFiles(x86)%\screen recorder master plus\system.security.securestring.dll
%ProgramFiles(x86)%\screen recorder master plus\system.text.encoding.dll
%ProgramFiles(x86)%\screen recorder master plus\system.text.encoding.extensions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.text.regularexpressions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.overlapped.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.tasks.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.tasks.extensions.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.tasks.parallel.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.thread.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.threadpool.dll
%ProgramFiles(x86)%\screen recorder master plus\system.threading.timer.dll
%ProgramFiles(x86)%\screen recorder master plus\system.valuetuple.dll
%ProgramFiles(x86)%\screen recorder master plus\system.xml.readerwriter.dll
%ProgramFiles(x86)%\screen recorder master plus\system.xml.xdocument.dll
%ProgramFiles(x86)%\screen recorder master plus\system.xml.xmldocument.dll
%ProgramFiles(x86)%\screen recorder master plus\system.xml.xmlserializer.dll
%ProgramFiles(x86)%\screen recorder master plus\system.xml.xpath.dll
%ProgramFiles(x86)%\screen recorder master plus\system.xml.xpath.xdocument.dll
%ProgramFiles(x86)%\screen recorder master plus\xceed.wpf.avalondock.dll
%ProgramFiles(x86)%\screen recorder master plus\xceed.wpf.avalondock.themes.aero.dll
%ProgramFiles(x86)%\screen recorder master plus\xceed.wpf.avalondock.themes.metro.dll
%ProgramFiles(x86)%\screen recorder master plus\xceed.wpf.avalondock.themes.vs2010.dll
%ProgramFiles(x86)%\screen recorder master plus\xceed.wpf.datagrid.dll
%ProgramFiles(x86)%\screen recorder master plus\xceed.wpf.toolkit.dll
%ProgramFiles(x86)%\screen recorder master plus\de\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\es\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\fr\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\hu\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\it\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\languages\ffmpeg.exe
%ProgramFiles(x86)%\screen recorder master plus\pt-br\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\ro\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\ru\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\sv\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\zh-hans\xceed.wpf.avalondock.resources.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.base.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.bass.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.core.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.ffmpeg.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.hotkeys.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.imgur.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.loc.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.mousekeyhook.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.native.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.naudio.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.sharpavi.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.viewcore.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.webcam.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.windows.dll
%ProgramFiles(x86)%\screen recorder master plus\captura.youtube.dll
%ProgramFiles(x86)%\screen recorder master plus\commandline.dll
%ProgramFiles(x86)%\screen recorder master plus\desktopduplication.dll
%ProgramFiles(x86)%\screen recorder master plus\directshowlib.dll
%ProgramFiles(x86)%\screen recorder master plus\ffmpeg.exe
%ProgramFiles(x86)%\screen recorder master plus\firstfloor.modernui.dll
%ProgramFiles(x86)%\screen recorder master plus\gma.system.mousekeyhook.dll
%ProgramFiles(x86)%\screen recorder master plus\google.apis.auth.dll
%ProgramFiles(x86)%\screen recorder master plus\google.apis.auth.platformservices.dll
%ProgramFiles(x86)%\screen recorder master plus\google.apis.core.dll
%ProgramFiles(x86)%\screen recorder master plus\google.apis.dll
%ProgramFiles(x86)%\screen recorder master plus\google.apis.platformservices.dll
%ProgramFiles(x86)%\screen recorder master plus\google.apis.youtube.v3.dll
%ProgramFiles(x86)%\screen recorder master plus\hardcodet.wpf.taskbarnotification.dll
%ProgramFiles(x86)%\screen recorder master plus\managedbass.dll
%ProgramFiles(x86)%\screen recorder master plus\managedbass.mix.dll
%ProgramFiles(x86)%\screen recorder master plus\microsoft.win32.primitives.dll
%ProgramFiles(x86)%\screen recorder master plus\modernui.xceed.toolkit.dll
%ProgramFiles(x86)%\screen recorder master plus\naudio.dll
%ProgramFiles(x86)%\screen recorder master plus\netstandard.dll
%ProgramFiles(x86)%\screen recorder master plus\newtonsoft.json.dll
%ProgramFiles(x86)%\screen recorder master plus\ninject.dll
%ProgramFiles(x86)%\screen recorder master plus\ookii.dialogs.dll
%ProgramFiles(x86)%\screen recorder master plus\reactiveproperty.dll
%ProgramFiles(x86)%\screen recorder master plus\reactiveproperty.net46.dll
%ProgramFiles(x86)%\screen recorder master plus\screen recorder master plus.exe.config
%ProgramFiles(x86)%\screen recorder master plus\keymaps\en-in.json
%ProgramFiles(x86)%\screen recorder master plus\keymaps\en.json
%ProgramFiles(x86)%\screen recorder master plus\keymaps\ml.json
%ProgramFiles(x86)%\screen recorder master plus\languages\ar.json
%ProgramFiles(x86)%\screen recorder master plus\languages\be.json
%ProgramFiles(x86)%\screen recorder master plus\languages\cs.json
%ProgramFiles(x86)%\screen recorder master plus\languages\da.json
%ProgramFiles(x86)%\screen recorder master plus\languages\de.json
%ProgramFiles(x86)%\screen recorder master plus\languages\en.json
%ProgramFiles(x86)%\screen recorder master plus\languages\es.json
%ProgramFiles(x86)%\screen recorder master plus\languages\fi.json
%ProgramFiles(x86)%\screen recorder master plus\languages\fr.json
%ProgramFiles(x86)%\screen recorder master plus\languages\he.json
%ProgramFiles(x86)%\screen recorder master plus\languages\hi.json
%ProgramFiles(x86)%\screen recorder master plus\languages\id.json
%ProgramFiles(x86)%\screen recorder master plus\languages\is.json
%ProgramFiles(x86)%\screen recorder master plus\languages\it.json
%ProgramFiles(x86)%\screen recorder master plus\languages\ja.json
%ProgramFiles(x86)%\screen recorder master plus\languages\kab.json
%ProgramFiles(x86)%\screen recorder master plus\languages\ml.json
%ProgramFiles(x86)%\screen recorder master plus\languages\nl.json
%ProgramFiles(x86)%\screen recorder master plus\languages\no.json
%ProgramFiles(x86)%\screen recorder master plus\languages\pl.json
%ProgramFiles(x86)%\screen recorder master plus\languages\pt-br.json
%ProgramFiles(x86)%\screen recorder master plus\languages\pt.json
%ProgramFiles(x86)%\screen recorder master plus\languages\ro.json
%ProgramFiles(x86)%\screen recorder master plus\languages\ru.json
%ProgramFiles(x86)%\screen recorder master plus\languages\sl.json
%ProgramFiles(x86)%\screen recorder master plus\languages\sv.json
%ProgramFiles(x86)%\screen recorder master plus\languages\th.json
%ProgramFiles(x86)%\screen recorder master plus\languages\tr.json
%ProgramFiles(x86)%\screen recorder master plus\languages\uk.json
%ProgramFiles(x86)%\screen recorder master plus\languages\vi.json
%ProgramFiles(x86)%\screen recorder master plus\languages\zh-cn.json
%ProgramFiles(x86)%\screen recorder master plus\languages\zh-tw.json
%WINDIR%\installer\{7d9ba61f-15e0-4619-b961-f2242cc63235}\kopyala.exe
C:\users\public\desktop\screen recorder master plus.lnk
%WINDIR%\temp\~df1d5d860f9cacfa05.tmp
%WINDIR%\temp\~df9738d12198430f0c.tmp
%WINDIR%\temp\~dfd1adfda9c9f4a06b.tmp
%WINDIR%\temp\~dfc27943079675847a.tmp
%WINDIR%\temp\~dfb47ef7912b1a7232.tmp
%WINDIR%\temp\~dff0a6255185979fa0.tmp
%WINDIR%\temp\~df8b134bae278f8d28.tmp
%WINDIR%\temp\~dfd7ed0996fd8c3f3a.tmp
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690b6091-1620.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690b6093-1690.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3cd4753c681d36ff_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0e71b5f6cae3e363_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ccbc36e870acb205_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6810edb58bbfec56_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\92a125a4867bbee0_0
%LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_getintoway.com_0.indexeddb.leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_getintoway.com_0.indexeddb.leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_getintoway.com_0.indexeddb.leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_getintoway.com_0.indexeddb.leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4723f10b0467942a_0
%LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%TEMP%\4593a2c5-32fb-4d72-8ca2-f81c3f6871c1.tmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal

Deletes following files that it created itself

%TEMP%\shieace.tmp
%TEMP%\msieb4c.tmp
%APPDATA%\the fyine empire llc\screen recorder master plus 1.0.0\install\screen recorder master plus.msi
%APPDATA%\the fyine empire llc\screen recorder master plus 1.0.0\install\screen recorder master plus1.cab
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690b6091-1620.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690b6093-1690.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_getintoway.com_0.indexeddb.leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_getintoway.com_0.indexeddb.leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons
%TEMP%\.ses

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

Connects to

'co####.edge.skype.com':443
'ge###toway.com':443
'23.##0.163.238':80
'go#####agmanager.com':443
'cd#.##esignal.com':443
'go#####a###ytics.com':443
'mo#####.map.fastly.net':443
'co##############e-chains.prod.autograph.services.mozaws.net':443

TCP

Other

'co####.edge.skype.com':443
'ge###toway.com':443
'go#####agmanager.com':443
'ap#.##esignal.com':443
'go#####a###ytics.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK ge###toway.com
DNS ASK go#####agmanager.com
DNS ASK cd#.##esignal.com
DNS ASK go#####a###ytics.com
DNS ASK ap#.##esignal.com
DNS ASK mo#####.map.fastly.net
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Creates and executes the following

'%TEMP%\rarsfx0\screenrecordermasterplus.exe' /qb

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%APPDATA%\The Fyine Empire LLC\Screen Recorder Master Plus 1.0.0\install\Screen Recorder Master Plus.msi" /qb AI_SETUPEXEPATH=%TEMP%\RarSFX0\ScreenRecorderMasterPlus.exe SETUPEXEDIR=%TEMP%\...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://getintoway.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://getintoway.com/
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,5136860146682879439,13859948168474878171,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://getintoway.com/' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial