Trylle

Finds spyware addresses hidden in encoded links (for example u=https%3A%2F%2F...), which ad-click URLs and browser storage often use.

IPv6 addresses match however they are written.

Linux: a known implant path run by a systemd service or cron job is now reported as configured to start, not just mentioned.

OneDrive files kept on this PC, and OneDrive folders, are now checked instead of being skipped.

Names that may have changed owner since their report (shared cloud hostnames, and old lookalike domains re-registered since) are reported as leads, not serious findings.

Specially crafted files can no longer stall a scan.

Temporary copies left by a scan that crashed are cleaned up at the next start, and the scanner warns before saving a report into OneDrive or iCloud.

--update now downloads the indicator files checked for this release; --update --latest gets the newest versions.

Assets