{"id":41614,"date":"2020-02-13T20:48:26","date_gmt":"2020-02-13T17:48:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov"},"modified":"2020-02-13T20:48:26","modified_gmt":"2020-02-13T17:48:26","slug":"ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","title":{"rendered":"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/96e4b61d527ce7cb904f663b763ac9aa.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4lgimisfailid ehk Prefetch-failid on Windowsis olemas olnud juba Windows XP ajast. Sellest ajast alates on need aidanud digitaalse kriminalistika ja arvutik\u00fcberturbe spetsialistidel leida j\u00e4lgi programmide k\u00e4ivitamisest, sealhulgas pahavara. Group-IB juhtiv arvutikriminalistika spetsialist <b>Oleg Skulkin<\/b> selgitab, mida saab Prefetch-failide abil leida ja kuidas seda teha.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Prefetch-failid salvestatakse katalooge <b>%SystemRoot%Prefetch<\/b> ja neid kasutatakse programmide k\u00e4ivitamise kiirendamiseks. Kui vaatame m\u00f5nda neist failidest, n\u00e4eme, et faili nimi koosneb kahest osast: k\u00e4ivitatava faili nimest ja kontrollsummast selle teepikkuse kohta, mis koosneb kaheksast m\u00e4rgist.<\/p>\n<p>Prefetch-failid sisaldavad palju kriminaaltehnika seisukohalt v\u00e4\u00e4rtuslikku teavet: t\u00e4itmisfaili nimi, selle k\u00e4ivitamiste arv, failide ja kataloogide loendid, millega t\u00e4itmisfail suheline, ja loomulikult ajatempli. Kriminaalagentuurid kasutavad tavaliselt Prefetch-faili loomise kuup\u00e4eva, et m\u00e4\u00e4rata programmi esmak\u00e4ivitamise kuup\u00e4ev. Lisaks salvestavad need failid viimase k\u00e4ivitamise kuup\u00e4eva ning alates versioonist 26 (Windows 8.1) ka seitsme viimase k\u00e4ivitamise ajatempleid.<\/p>\n<p>V\u00f5tame \u00fche Prefetch-faili, ekstraheerime sealt andmed Erik Zimmermani PECmd abil ja vaatame iga osa. N\u00e4itan andmete ekstraheerimist failist <b>CCLEANER64.EXE-DE05DBE1.pf<\/b>.<\/p>\n<p>Nii et alustame \u00fclevalt. Meil on loomulikult faili loomise, muutmise ja juurdep\u00e4\u00e4su ajatempli:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/5308f36909b8e0c2fb2280f8e4505334.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nNende j\u00e4rel tulevad t\u00e4itmisfaili nimi, tee kontrollsumma, t\u00e4itmisfaili suurus ja ka Prefetch-faili versioon:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/b08151447a967d5770205b1870669e44.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nKuna tegeleme Windows 10-ga, n\u00e4eme edasi k\u00e4ivitamiste arvu, viimase k\u00e4ivitamise kuup\u00e4eva ja aega ning veel seitset ajatemplit, mis n\u00e4itavad eelnevaid k\u00e4ivitamise kuup\u00e4evi:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/ba2eee3c6514fe595553452a20294893.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nNende k\u00f5rval on teave mahust, sealhulgas selle seerianumber ja loomiskuup\u00e4ev:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/190dcad09d2839e22a679fb3aa8cfe3c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nJa viimane, kuid mitte v\u00e4hem oluline \u2014 kataloogide ja failide nimekiri, millega t\u00e4idetud fail suhtles: <\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/9a238c90b4ab21d2a536f980d897d81d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nSeega on kataloogid ja failid, millega t\u00e4idetud fail suhtles, just need andmed, millel soovin t\u00e4na keskenduda. Need andmed v\u00f5imaldavad digitaalse kriminaalanal\u00fc\u00fcsi, arvutik\u00fcsimiste ja proaktiivsete ohtude j\u00e4lgimise spetsialistidel kindlaks teha mitte ainult aeg-ajalt, vaid ka m\u00f5nel juhul uuesti \u00fcles ehitada r\u00fcnnakute konkreetsed taktikad ja tehnikad. T\u00e4na kasutavad pahatahtlikud isikud sageli andmete p\u00fcsivat kustutamist, kasutades n\u00e4iteks SDelete'i, seega on igasugune v\u00f5imalus taastada j\u00e4lgi nende taktikate ja tehnikate kasutamisest kaasaegsete kaitsja jaoks \u2014 arvuti kriminaalanal\u00fc\u00fctiku, juhtumite reageerimise spetsialisti ja ThreatHunter'i eksperdi jaoks h\u00e4davajalik.<\/p>\n<p>Alustame taktika Initial Access (TA0001) ja k\u00f5ige populaarsema tehnikaga \u2014 Spearphishing Attachment (T1193). M\u00f5ned k\u00fcberkurjategijate r\u00fchmad valivad selliseid lisandeid \u00fcsna loominguliselt. N\u00e4iteks kasutas grupp Silence selleks CHM (Microsoft Compiled HTML Help) formaadi faile. Seega on meil veel \u00fcks tehnika \u2014 Compiled HTML File (T1223). Sellised failid k\u00e4ivitatakse kasutades <b>hh.exe<\/b>, seega, kui me ekstraktime andmeid tema Prefetch-failist, saame teada, millist faili ohver avas:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/d7b807fd1b90847996455306cea2cb8f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nJ\u00e4tkame n\u00e4idetega reaalsest elust ja liigume j\u00e4rgmise taktika Execution (TA0002) ja tehnika CSMTP (T1191) juurde. Microsoft Connection Manager Profile Installer (CMSTP.exe) v\u00f5ib r\u00fcndajate poolt olla kasutatud pahatahtlike skriptide k\u00e4ivitamiseks. Hea n\u00e4ide on grupp Cobalt. Kui me ekstraktime andmeid Prefetch-failist <b>cmstp.exe<\/b>, saame taas teada, mis t\u00e4pselt k\u00e4ivitati:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/328c193e00af4c31566b19826f75c0a2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nVeel \u00fcks populaarne tehnika on Regsvr32 (T1117). <b>Regsvr32.exe<\/b> on samuti tihti kasutatud r\u00fcndajate poolt k\u00e4itamiseks. Siin on veel \u00fcks n\u00e4ide grupilt Cobalt: kui me ekstraktime andmeid Prefetch-failist <b>regsvr32.exe<\/b>, n\u00e4eme taas, mis k\u00e4ivitati:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/7626266c1215902d03ded817d7342a30.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nJ\u00e4rgmised taktikad on Persistence (TA0003) ja Privilege Escalation (TA0004) ning tehnikana Application Shimming (T1138). Seda tehnika kasutati Carbanak\/FIN7 s\u00fcsteemis p\u00fcsimiseks. Andmebaasidega, mis sisaldavad programmide \u00fchilduvusteavet (.sdb), t\u00f6\u00f6tamiseks kasutatakse tavaliselt <b>sdbinst.exe<\/b>. Seega v\u00f5ib antud j\u00e4rjefail meie arusaamisele, kus need andmebaasid asuvad ja mis on nende nimed, abiks olla:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/22d1599bbe9fe1d2f48ced0548b07e68.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nNagu illustratsioonilt n\u00e4ha, on meil mitte ainult failinimi, mida installeerimise jaoks kasutati, vaid ka installeeritud andmebaasi nimi.<\/p>\n<p>Vaatame \u00fchte k\u00f5ige t\u00fc\u00fcpilisemat n\u00e4idet v\u00f5rgus edasiviimisest (TA0008) \u2014 PsExec, mis kasutab haldus\u00fcleseid ressursse (T1077). Teenus nimega PSEXECSVC (loomulikult v\u00f5ib kasutada ka m\u00f5nda muud nime, kui r\u00fcndajad on kasutanud parameetrit <b>-r<\/b>) luuakse sihts\u00fcsteemis, seega, kui me ekstraheerime andmed j\u00e4rjefailist, n\u00e4eme, mis oli k\u00e4ivitunud:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/a416b17ae7e9d2c155e0d47062ebdda8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nL\u00f5petan oma jutu kindlasti sellega, millega alustasin \u2013 failide kustutamine (T1107). Nagu ma juba mainisin, kasutavad paljud r\u00fcndajad SDelete'i, et p\u00fcsivalt eemaldada faile erinevatel r\u00fcnnakuts\u00fckli etappidel. Kui vaatame Prefetch-failide andmeid, <b>sdelete.exe<\/b>, n\u00e4eme, mis t\u00e4pselt eemaldati:<\/p>\n<p><img decoding=\"async\" alt=\"Jahtime r\u00fcnnakutehnikaid ja taktikate katsetajaid, kasutades Prefetch-faile\" src=\"\/wp-content\/uploads\/2020\/02\/8a1ab986ed0274fea2d9a95d1f8fd186.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Muidugi, see ei ole ammendav nimekiri tehnikatest, mida saab leida Prefetch-failide anal\u00fc\u00fcsi k\u00e4igus, kuid seda peaks piisama, et m\u00f5ista, et sellised failid v\u00f5ivad aidata leida mitte ainult k\u00e4ivitusj\u00e4lgi, vaid ka rekonstrueerida r\u00fcndajate konkreetseid taktikaid ja tehnikaid.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/group-ib\/blog\/487516\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0424\u0430\u0439\u043b\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0438\u043b\u0438 Prefetch-\u0444\u0430\u0439\u043b\u044b, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 Windows \u0435\u0449\u0435 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d XP. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445. \u0412\u0435\u0434\u0443\u0449\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 Group-IB \u041e\u043b\u0435\u0433 \u0421\u043a\u0443\u043b\u043a\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. Prefetch-\u0444\u0430\u0439\u043b\u044b \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41615,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41614","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0424\u0430\u0439\u043b\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0438\u043b\u0438 Prefetch-\u0444\u0430\u0439\u043b\u044b, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 Windows \u0435\u0449\u0435 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d XP. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445. \u0412\u0435\u0434\u0443\u0449\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 Group-IB \u041e\u043b\u0435\u0433 \u0421\u043a\u0443\u043b\u043a\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. Prefetch-\u0444\u0430\u0439\u043b\u044b \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0445\u043e\u0442\u0438\u043c\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0424\u0430\u0439\u043b\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0438\u043b\u0438 Prefetch-\u0444\u0430\u0439\u043b\u044b, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 Windows \u0435\u0449\u0435 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d XP. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445. \u0412\u0435\u0434\u0443\u0449\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 Group-IB \u041e\u043b\u0435\u0433 \u0421\u043a\u0443\u043b\u043a\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. Prefetch-\u0444\u0430\u0439\u043b\u044b \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-13T17:48:26+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-13T17:48:26+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jahtime r\u00fcndajate tehnikaid ja taktikaid Prefetch-failide abil | ProHoster","description":"J\u00e4lgimisfailid v\u00f5i Prefetch-failid on Windowsis olemas olnud juba XP ajast. Sellest ajast alates on need aidanud digitaalse kriminaalmenetluse ja IT-intsidentide uurimise spetsialiste leida programme, sealhulgas pahavara (malware), k\u00e4ivitamise j\u00e4lgi. Group-IB esindav digitaalsete t\u00f5endite eksperti Oleg Skulkin selgitab, mida Prefetch-failide abil leida ja kuidas seda teha. Prefetch-failid salvestatakse","canonical_url":"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0445\u043e\u0442\u0438\u043c\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster","og:description":"\u0424\u0430\u0439\u043b\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0438\u043b\u0438 Prefetch-\u0444\u0430\u0439\u043b\u044b, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 Windows \u0435\u0449\u0435 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d XP. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445. \u0412\u0435\u0434\u0443\u0449\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 Group-IB \u041e\u043b\u0435\u0433 \u0421\u043a\u0443\u043b\u043a\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. Prefetch-\u0444\u0430\u0439\u043b\u044b \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-13T17:48:26+00:00","article:modified_time":"2020-02-13T17:48:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41614","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:13:40","updated":"2022-09-28 14:43:35"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41614"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41614\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/41615"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}