Trojan.Siggen14.36015

Technical Information

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\html\images\bkg.gif
%TEMP%\7zipsfx.000\tsservice.exe
%TEMP%\7zipsfx.000\assistant.dll
%TEMP%\7zipsfx.000\dialogs.dll
%TEMP%\7zipsfx.000\downloader.dll
%TEMP%\7zipsfx.000\dr.dll
%TEMP%\7zipsfx.000\eventtracing.dll
%TEMP%\7zipsfx.000\mousegesture.dll
%TEMP%\7zipsfx.000\microsoft.vc90.crt\msvcm90.dll
%TEMP%\7zipsfx.000\microsoft.vc90.crt\msvcp90.dll
%TEMP%\7zipsfx.000\microsoft.vc90.crt\msvcr90.dll
%TEMP%\7zipsfx.000\network.dll
%TEMP%\7zipsfx.000\qqbrowsersecuritycenter.exe
%TEMP%\7zipsfx.000\qq浏览器.exe
%TEMP%\7zipsfx.000\prscrn.dll
%TEMP%\7zipsfx.000\qbutils.dll
%TEMP%\7zipsfx.000\qmscan.dll
%TEMP%\7zipsfx.000\qqbrowserframe.dll
%TEMP%\7zipsfx.000\qrcode.dll
%TEMP%\7zipsfx.000\resource.dll
%TEMP%\7zipsfx.000\tridentcore.dll
%TEMP%\7zipsfx.000\tsqbdrvdll.dll
%TEMP%\7zipsfx.000\webpdecodefilter.dll
%APPDATA%\tencent\qqbrowser\skin\lightstripes.gt
%APPDATA%\tencent\qqbrowser\skin\001-cool air.gt
%APPDATA%\tencent\qqbrowser\db\favorite.db-journal
%TEMP%\7zipsfx.000\qbextensionframework.dll
%TEMP%\7zipsfx.000\qbsafe.dll
%TEMP%\7zipsfx.000\qqbrowserliveup.exe
%TEMP%\7zipsfx.000\html\manifest.json
%APPDATA%\tencent\qqbrowser\scope\824\history\desktop.ini
%TEMP%\7zipsfx.000\html\quickaccess\css\style.css
%TEMP%\7zipsfx.000\html\manage\css\ycalendar.css
%TEMP%\7zipsfx.000\html\manage\js\api.js
%TEMP%\7zipsfx.000\html\quickaccess\js\api.js
%TEMP%\7zipsfx.000\html\manage\app\app.js
%TEMP%\7zipsfx.000\infobar\js\base.js
%TEMP%\7zipsfx.000\html\manage\js\business.js
%TEMP%\7zipsfx.000\html\quickaccess\js\business.js
%TEMP%\7zipsfx.000\html\manage\js\global.js
%TEMP%\7zipsfx.000\html\quickaccess\js\global.js
%TEMP%\7zipsfx.000\html\manage\history\history2.js
%TEMP%\7zipsfx.000\html\manage\js\init.js
%TEMP%\7zipsfx.000\html\quickaccess\js\init.js
%TEMP%\7zipsfx.000\html\lib\jquery.easing.js
%TEMP%\7zipsfx.000\html\lib\jquery.mcustomscrollbar.concat.min.js
%TEMP%\7zipsfx.000\html\lib\jquery.min.js
%TEMP%\7zipsfx.000\html\quickaccess\js\search.js
%TEMP%\7zipsfx.000\html\manage\app\sliderman.1.3.7.js
%TEMP%\7zipsfx.000\html\lib\template.js
%TEMP%\7zipsfx.000\html\manage\js\tool.js
%TEMP%\7zipsfx.000\html\lib\ycalendar.js
%TEMP%\7zipsfx.000\qqbrowserconfig.dat
%TEMP%\7zipsfx.000\tssafeedit.dat
%TEMP%\7zipsfx.000\skin\lightstripes.gt
%TEMP%\7zipsfx.000\nsis_skin.gt
%APPDATA%\tencent\qqbrowser\db\favorite.db
%TEMP%\7zipsfx.000\html\lib\jquery.mcustomscrollbar.css
%TEMP%\7zipsfx.000\resources.pri
%TEMP%\7zipsfx.000\html\manage\img\skin\text_light.png
%APPDATA%\tencent\qqbrowser\scope\824\history\history.ie5\desktop.ini
%ProgramFiles(x86)%\tencent\qqmail\txgymailcamera_2.dll
%ProgramFiles(x86)%\tencent\qqmail\txgymailactivex_2.dll
%ProgramFiles(x86)%\tencent\qqmail\txftnactivex_2.dll
%APPDATA%\tencent\qqbrowser\clientupdate\cli9abe.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\update.ini
%APPDATA%\tencent\qqbrowser\extensions8\{66ac5389-365d-4b55-bf5c-5a2a4bc21ccd}\qrxb55a.tmp.qbl
%APPDATA%\tencent\qqbrowser\extensions8\{0508df1f-2ab6-4fac-a99e-45bbbf24e1e6}\qrxb56a.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clib206.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\cliba7f.tmp.qbl
%APPDATA%\tencent\qqbrowser\extensions8\{0508df1f-2ab6-4fac-a99e-45bbbf24e1e6}\8.0.0.6\qbsafe.dll
%APPDATA%\tencent\qqbrowser\extensions8\{6c1ae4fb-cabb-4509-9394-6cf047da5b1a}\qrxb57b.tmp.qbl
%APPDATA%\tencent\qqbrowser\extensions8\{66ac5389-365d-4b55-bf5c-5a2a4bc21ccd}\8.0.0.44\netservice.dll
%APPDATA%\tencent\qqbrowser\extensions8\{6c1ae4fb-cabb-4509-9394-6cf047da5b1a}\8.0.0.4\loadfixqb.dll
%APPDATA%\tencent\qqbrowser\clientupdate\clic144.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clica78.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clice12.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clicfb8.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clid0a3.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clid9d8.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clidac3.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clidbbd.tmp.qbl
%APPDATA%\tencent\qqbrowser\clientupdate\clidcc7.tmp.qbl
%APPDATA%\tencent\qqbrowser\liveup\temp\microsoft.vc90.crt\msvcp90.dll
%APPDATA%\tencent\qqbrowser\liveup\temp\microsoft.vc90.crt\msvcr90.dll
%APPDATA%\tencent\qqbrowser\liveup\temp\microsoft.vc90.crt\microsoft.vc90.crt.manifest
%APPDATA%\tencent\qqbrowser\liveup\temp\qbutils.dll
%APPDATA%\tencent\qqbrowser\liveup\temp\qqbrowserliveup.exe
%TEMP%\nsh9df5.tmp\system.dll
%TEMP%\7zipsfx.000\html\manage\history\css\history.css
%TEMP%\7zipsfx.000\html\manage\css\style.css
%TEMP%\nsh9df5.tmp\installhelper.dll
%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\ini65d4.tmp.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\sso\ini6f37.tmp.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\ini79a4.tmp.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\ini79a6.tmp.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqmail.zip.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\qzonephoto\ini79a5.tmp.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserfix.zip.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\sso\sso.zip.qbl
%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\msdbg.zip.qbl
%TEMP%\{9ebb53d8-d252-4af3-9e97-7c12428469d2}
%APPDATA%\tencent\qqbrowser\onlinesetup\sso\qqbrowserota.exe
%TEMP%\nsx8bbc.tmp
%TEMP%\nsh8bfb.tmp\installhelper.dll
%APPDATA%\tencent\qqbrowser\problemfix\fixitems.xml
%APPDATA%\tencent\qqbrowser\problemfix\qqbrowserfix.exe
%APPDATA%\tencent\qqbrowser\problemfix\qqbrowserfix.wsf
%TEMP%\nsh8bfb.tmp\system.dll
%TEMP%\nss9251.tmp
%TEMP%\nsh9261.tmp\installhelper.dll
%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\sso\ssocommon.dll
%TEMP%\{bb0da04f-cebe-4e3d-baef-ef6712ed54d9}
%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\sso\ssoplatform.dll
%TEMP%\nsh9261.tmp\system.dll
%TEMP%\nsh9df4.tmp
%APPDATA%\tencent\qqbrowser\dbgeng.dll
%APPDATA%\tencent\qqbrowser\scope\824\history\history.ie5\index.dat
%TEMP%\7zipsfx.000\infobar\css\base.css
%TEMP%\7zipsfx.000\html\manage\app\css\app.css
%TEMP%\7zipsfx.000\html\small.html
%TEMP%\7zipsfx.000\html\manage\img\history_hover.png
%TEMP%\7zipsfx.000\html\images\hse.png
%TEMP%\7zipsfx.000\infobar\image\icon.png
%TEMP%\7zipsfx.000\html\images\icon_not_recommended.png
%TEMP%\7zipsfx.000\html\images\icon_suggested_action.png
%TEMP%\7zipsfx.000\infobar\image\infobar_close_active.png
%TEMP%\7zipsfx.000\infobar\image\infobar_close_hover.png
%TEMP%\7zipsfx.000\infobar\image\infobar_close_normal.png
%TEMP%\7zipsfx.000\infobar\image\infobar_fav.png
%TEMP%\7zipsfx.000\infobar\image\infobar_login.png
%TEMP%\7zipsfx.000\infobar\image\infobar_offlineurl.png
%TEMP%\7zipsfx.000\html\manage\app\images\installed_arrow.png
%TEMP%\7zipsfx.000\html\manage\app\images\large_installed_arrow.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\lock.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\lock_active.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\lock_active_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\lock_hover.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\lock_hover_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\lock_ie.png
%TEMP%\7zipsfx.000\html\manage\img\skin\picker_ceil.png
%TEMP%\7zipsfx.000\html\manage\img\skin\picker_ceil_hover.png
%TEMP%\7zipsfx.000\html\manage\img\skin\picker_floor.png
%TEMP%\7zipsfx.000\html\manage\img\skin\picker_floor_hover.png
%TEMP%\7zipsfx.000\html\manage\app\images\plugin1.png
%TEMP%\7zipsfx.000\html\manage\app\images\plugin2.png
%TEMP%\7zipsfx.000\html\manage\img\account\down.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\delete_ie.png
%TEMP%\7zipsfx.000\html\manage\img\history_active.png
%APPDATA%\tencent\qqbrowser\clientupdate\cliedc9.tmp.qbl
%TEMP%\7zipsfx.000\html\manage\app\images\plugin3.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\delete_hover_ie.png
%TEMP%\7zipsfx.000\html\images\pixel.gif
%TEMP%\7zipsfx.000\html\manage\img\account.png
%TEMP%\7zipsfx.000\html\manage\img\account_active.png
%TEMP%\7zipsfx.000\html\manage\img\account_hover.png
%TEMP%\7zipsfx.000\html\manage\img\skin\addressbar_blank.png
%TEMP%\7zipsfx.000\html\manage\img\skin\addressbar_white.png
%TEMP%\7zipsfx.000\html\manage\img\app.png
%TEMP%\7zipsfx.000\html\manage\img\app_active.png
%TEMP%\7zipsfx.000\html\manage\img\app_hover.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\arrowdown.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\arrowdown_hover.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\arrowdown_hover_ie.png
%TEMP%\7zipsfx.000\html\manage\app\images\loading.gif
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\arrowdown_ie.png
%TEMP%\7zipsfx.000\html\manage\history\img\atbk2.png
%TEMP%\7zipsfx.000\html\quickaccess\img\event\bg.png
%TEMP%\7zipsfx.000\html\manage\history\img\checkbox.png
%TEMP%\7zipsfx.000\html\manage\img\close.png
%TEMP%\7zipsfx.000\html\manage\history\img\closebtnsearchbar.png
%TEMP%\7zipsfx.000\html\manage\app\images\default-icon.png
%TEMP%\7zipsfx.000\html\manage\history\img\del.png
%TEMP%\7zipsfx.000\html\manage\history\img\del2.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\delete.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\delete_active.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\delete_active_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\delete_hover.png
%TEMP%\7zipsfx.000\html\manage\history\img\atbk1.png
%TEMP%\7zipsfx.000\html\manage\history\img\down.png
%APPDATA%\tencent\qqbrowser\dbghelp.dll
%TEMP%\7zipsfx.000\html\images\private-icon.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\quicklink_newcelltag_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\unlock.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\unlock_active.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\unlock_active_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\unlock_hover.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\unlock_hover_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\unlock_ie.png
%TEMP%\7zipsfx.000\html\manage\history\img\up-down.png
%TEMP%\7zipsfx.000\html\manage\img\account\up.png
%TEMP%\7zipsfx.000\html\manage\app\images\warn-dialog-close.png
%TEMP%\7zipsfx.000\html\manage\app\images\wifi_dialog_cancel_btn.png
%TEMP%\7zipsfx.000\html\manage\app\images\wifi_dialog_close_btn.png
%TEMP%\7zipsfx.000\html\manage\app\images\wifi_dialog_continue_btn.png
%TEMP%\7zipsfx.000\app.ico
%TEMP%\7zipsfx.000\html\manage\img\default.ico
%TEMP%\7zipsfx.000\html\manage\favicon\index.html#account.ico
%TEMP%\7zipsfx.000\html\manage\favicon\index.html#app.ico
%TEMP%\7zipsfx.000\html\manage\favicon\index.html#history.ico
%TEMP%\7zipsfx.000\html\manage\favicon\index.html#skin.ico
%TEMP%\7zipsfx.000\navi.ico
%TEMP%\7zipsfx.000\microsoft.vc90.crt\microsoft.vc90.crt.manifest
%TEMP%\7zipsfx.000\html\certerror.html
%TEMP%\7zipsfx.000\html\error.html
%TEMP%\7zipsfx.000\html\manage\index.html
%TEMP%\7zipsfx.000\html\quickaccess\index.html
%TEMP%\7zipsfx.000\infobar\inforbar.html
%TEMP%\7zipsfx.000\html\private.html
%TEMP%\7zipsfx.000\html\manage\app\images\qblogo.png
%TEMP%\7zipsfx.000\html\manage\app\images\uninstallbtn.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\quicklink_newcelltag.png
%TEMP%\7zipsfx.000\html\manage\img\skin\theme_ie.png
%TEMP%\7zipsfx.000\html\manage\img\history.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\quicklink_recommendcelltag.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\quicklink_recommendcelltag_ie.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\quicklink_toast_locked.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\quicklink_toast_unlocked.png
%TEMP%\7zipsfx.000\html\manage\history\img\search.png
%TEMP%\7zipsfx.000\html\quickaccess\img\grid\searchbar_searchengine_arrow.png
%TEMP%\7zipsfx.000\html\images\searchlogo_24_baidu.png
%TEMP%\7zipsfx.000\html\images\searchlogo_24_bing.png
%TEMP%\7zipsfx.000\html\images\searchlogo_24_google.png
%TEMP%\7zipsfx.000\html\images\searchlogo_24_sogou.png
%TEMP%\7zipsfx.000\html\images\searchlogo_24_soso.png
%TEMP%\7zipsfx.000\html\images\search_btn.png
%TEMP%\7zipsfx.000\infobar\image\security.png
%TEMP%\7zipsfx.000\html\images\shadow-bottom.png
%TEMP%\7zipsfx.000\html\manage\app\images\site_text.png
%TEMP%\7zipsfx.000\html\manage\img\skin.png
%TEMP%\7zipsfx.000\html\manage\img\skin_active.png
%TEMP%\7zipsfx.000\html\manage\img\skin_hover.png
%TEMP%\7zipsfx.000\html\manage\img\skin\skin_mask.png
%TEMP%\7zipsfx.000\html\manage\img\skin\skin_selected_blank.png
%TEMP%\7zipsfx.000\html\manage\img\skin\skin_selected_blank_ie.png
%TEMP%\7zipsfx.000\html\manage\img\skin\skin_selected_white.png
%TEMP%\7zipsfx.000\html\manage\img\skin\skin_selected_white_ie.png
%TEMP%\7zipsfx.000\html\images\small.png
%TEMP%\7zipsfx.000\html\manage\app\images\small_installed_arrow.png
%TEMP%\7zipsfx.000\html\manage\img\skin\tab_bg_blank.png
%TEMP%\7zipsfx.000\html\manage\img\skin\tab_bg_white.png
%TEMP%\7zipsfx.000\html\manage\img\skin\theme.png
%APPDATA%\tencent\qqbrowser\clientupdate\clif069.tmp.qbl

Sets the 'hidden' attribute to the following files

%APPDATA%\tencent\qqbrowser\scope\824\history\history.ie5\desktop.ini
%APPDATA%\tencent\qqbrowser\scope\824\history\desktop.ini

Deletes the following files

%APPDATA%\tencent\qqbrowser\db\favorite.db-journal
%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\ini79a6.tmp
%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\msdbg.zip
%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\ini79a4.tmp
%TEMP%\nsh9df5.tmp\system.dll
%TEMP%\nsh9df5.tmp\installhelper.dll
%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserfix.zip
%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\ini65d4.tmp
%APPDATA%\tencent\qqbrowser\onlinesetup\sso\sso.zip
%APPDATA%\tencent\qqbrowser\onlinesetup\sso\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\onlinesetup\sso\ini6f37.tmp
%TEMP%\nsh9261.tmp\system.dll
%TEMP%\nsh9261.tmp\installhelper.dll
%TEMP%\nsh8bfb.tmp\system.dll
%TEMP%\nsh8bfb.tmp\installhelper.dll
%APPDATA%\tencent\qqbrowser\onlinesetup\qzonephoto\ini79a5.tmp
%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqbrowserota.exe
%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqmail.zip

Moves the following files

from %APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\ini65d4.tmp.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\ini65d4.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clidcc7.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clidcc7.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clidbbd.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clidbbd.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clidac3.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clidac3.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clid9d8.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clid9d8.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clid0a3.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clid0a3.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clicfb8.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clicfb8.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clice12.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clice12.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clica78.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clica78.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clic144.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clic144.tmp
from %APPDATA%\tencent\qqbrowser\extensions8\{6c1ae4fb-cabb-4509-9394-6cf047da5b1a}\qrxb57b.tmp.qbl to %APPDATA%\tencent\qqbrowser\extensions8\{6c1ae4fb-cabb-4509-9394-6cf047da5b1a}\qrxb57b.tmp
from %APPDATA%\tencent\qqbrowser\extensions8\{66ac5389-365d-4b55-bf5c-5a2a4bc21ccd}\qrxb55a.tmp.qbl to %APPDATA%\tencent\qqbrowser\extensions8\{66ac5389-365d-4b55-bf5c-5a2a4bc21ccd}\qrxb55a.tmp
from %APPDATA%\tencent\qqbrowser\extensions8\{0508df1f-2ab6-4fac-a99e-45bbbf24e1e6}\qrxb56a.tmp.qbl to %APPDATA%\tencent\qqbrowser\extensions8\{0508df1f-2ab6-4fac-a99e-45bbbf24e1e6}\qrxb56a.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\cliba7f.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\cliba7f.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clib206.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clib206.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\cli9abe.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\cli9abe.tmp
from %APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\msdbg.zip.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\msdbg.zip
from %APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqmail.zip.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqmail.zip
from %APPDATA%\tencent\qqbrowser\onlinesetup\sso\sso.zip.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\sso\sso.zip
from %APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserfix.zip.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserfix.zip
from %APPDATA%\tencent\qqbrowser\onlinesetup\qzonephoto\ini79a5.tmp.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\qzonephoto\ini79a5.tmp
from %APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\ini79a6.tmp.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\ini79a6.tmp
from %APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\ini79a4.tmp.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\ini79a4.tmp
from %APPDATA%\tencent\qqbrowser\onlinesetup\sso\ini6f37.tmp.qbl to %APPDATA%\tencent\qqbrowser\onlinesetup\sso\ini6f37.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\cliedc9.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\cliedc9.tmp
from %APPDATA%\tencent\qqbrowser\clientupdate\clif069.tmp.qbl to %APPDATA%\tencent\qqbrowser\clientupdate\clif069.tmp

Substitutes the following files

%APPDATA%\tencent\qqbrowser\db\favorite.db-journal

Network activity

Connects to

'dl###r.qq.com':80
'wa#.#ogou.com':80
'wu#.#mtt.qq.com':8080
'ps.###wser.qq.com':80
'ps.###wser.qq.com':443
'dl###1.qq.com':80
'st##.qq.com':80
'pl####.browser.qq.com':80
'pl####.browser.qq.com':443
'pc#.#timg.com':80
're#.#mtt.qq.com':80
'so##.#mtt.qq.com':80
'microsoft.com':80

TCP

HTTP GET requests

http://dl###r.qq.com/invc/tt/ps/res.ini
http://pc#.#timg.com/btr/qqbrowser/ps/2112/69_16_2013-04-28.ini?&g########################################
http://st##.qq.com/stdl/qbfilepush/qqbrowser/cloudctrl/production/1434619918_9586.zip?&g########################################
http://so##.#mtt.qq.com/browser/btr/qqbrowser/ps/production/126_1_2014-01-20.zip?&g########################################
http://so##.#mtt.qq.com/browser/btr/qqbrowser/ps/production/119_4_2014-01-15.qqzip?&g########################################
http://st##.qq.com/stdl/qbfilepush/qqbrowser/cloudctrl/production/1431325272_1735.txt?&g########################################
http://pc#.#timg.com/btr/qqbrowser/ps/3001/97_1_2013-06-20.{91977E3A-F255-4036-8B72-B07EA129C89A}?&g########################################
http://pc#.#timg.com/btr/qqbrowser/ps/3002/95_6_2013-05-22.qzip?&g########################################
http://so##.#mtt.qq.com/browser/qqbrowser/cloudctrl/production/1411441978_1508.{B3D2254B-BB47-4d2f-B015-CDDE79BAD110}?&g########################################
http://pc#.#timg.com/btr/qqbrowser/ps/2109/64_19_2013-01-15.txt?&g########################################
http://st##.qq.com/stdl/qbExtension/qqbrowser/Extensions/production/{6C1AE4FB-CABB-4509-9394-6CF047DA5B1A}_8.0.0.4_{6C1AE4FB-CABB-4509-9394-6CF047DA5B1A}.qrx
http://st##.qq.com/stdl/qbExtension/qqbrowser/Extensions/production/{0508DF1F-2AB6-4fac-A99E-45BBBF24E1E6}_8.0.0.6_{0508DF1F-2AB6-4fac-A99E-45BBBF24E1E6}.qrx
http://dl###1.qq.com/invc/tt/ps/QQBrowserDBGOTA.qbzip
http://dl###1.qq.com/invc/tt/ps/SSO_A2AAE88A707B517C1427E4D0DB9DF892.qbzip
http://dl###r.qq.com/invc/tt/ps/QQMail_302067711CCDA1C8C70E4558F288E861.qbzip
http://so##.#mtt.qq.com/browser/btr/qqbrowser/ps/production/65_13_2013-11-28.CompatList?&g########################################
http://re#.#mtt.qq.com/qbfilepush/qqbrowser/cloudctrl/production/1413258416_430.txt?&g########################################

HTTP POST requests

http://ps.###wser.qq.com/plugin
http://pl####.browser.qq.com/plugin

Other

'ps.###wser.qq.com':443

UDP

DNS ASK qq.com
DNS ASK ct#.#zs.qq.com
DNS ASK cn#.#zs.qq.com
DNS ASK ed#.#zs.qq.com
DNS ASK cm.##s.qq.com
DNS ASK cn.##s.qq.com
DNS ASK os.##s.qq.com
DNS ASK qz#.#engyou.com
DNS ASK qz#.##one.qq.com
DNS ASK cn.###cache.qq.com
DNS ASK ct#.###.qzone.qq.com
DNS ASK ed#.###.qzone.qq.com
DNS ASK cm.###.qzone.qq.com
DNS ASK cn.###.qzone.qq.com
DNS ASK os.###.qzone.qq.com
DNS ASK qz####tyle.gtimg.cn
DNS ASK ct#.###nestyle.gtimg.cn
DNS ASK cn#.###nestyle.gtimg.cn
DNS ASK microsoft.com
DNS ASK qz#.qq.com
DNS ASK so##.#mtt.qq.com
DNS ASK os.####ache.gtimg.cn
DNS ASK cn.####ache.gtimg.cn
DNS ASK re#.#mtt.qq.com
DNS ASK ps.###wser.qq.com
DNS ASK im###che.qq.com
DNS ASK wa#.#ogou.com
DNS ASK wu#.#mtt.qq.com
DNS ASK ct#.##gcache.qq.com
DNS ASK dl###1.qq.com
DNS ASK cn#.##gcache.qq.com
DNS ASK ed#.##gcache.qq.com
DNS ASK ed#.###nestyle.gtimg.cn
DNS ASK cn#.###.qzone.qq.com
DNS ASK cm.###cache.qq.com
DNS ASK pl####.browser.qq.com
DNS ASK os.###cache.qq.com
DNS ASK im####he.gtimg.cn
DNS ASK ct#.###cache.gtimg.cn
DNS ASK cn#.###cache.gtimg.cn
DNS ASK pc#.#timg.com
DNS ASK ed#.###cache.gtimg.cn
DNS ASK cm.####ache.gtimg.cn
DNS ASK dl###r.qq.com
DNS ASK st##.qq.com
DNS ASK cm.####estyle.gtimg.cn

Miscellaneous

Searches for the following windows

ClassName: 'BubbleBorderWindow' WindowName: ''
ClassName: 'QQBrowserMainFrame' WindowName: ''
ClassName: 'QQBrowserNetProcessCommWnd' WindowName: ''
ClassName: 'QQBrowserNetProcessProxyCommWnd' WindowName: ''
ClassName: 'Window-C3B5614F-FC04-4344-A5EE-EA343DBCC9A3' WindowName: ''
ClassName: 'Window-0EC3C28F-CAF6-4a35-B0B2-F4DFB395E56A' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\qq浏览器.exe'
'%TEMP%\7zipsfx.000\qq浏览器.exe' "-host=tab" -scope=824 -Cred=524 -group=0 /prefetch:2
'%TEMP%\7zipsfx.000\qq浏览器.exe' -host= -Cred=0 -scope=824 /prefetch:1
'%TEMP%\7zipsfx.000\qq浏览器.exe' "-host=tab" -scope=824 -Cred=524 -group=0 -tid=1 /prefetch:2
'%TEMP%\7zipsfx.000\qq浏览器.exe' -host=extension -scope=824 /prefetch:5
'%TEMP%\7zipsfx.000\qq浏览器.exe' -host=net /prefetch:4
'%APPDATA%\tencent\qqbrowser\onlinesetup\qqbrowserfix\qqbrowserota.exe' /handle=66126 /moduleid=8
'%APPDATA%\tencent\qqbrowser\onlinesetup\sso\qqbrowserota.exe' /handle=66164 /moduleid=1
'%APPDATA%\tencent\qqbrowser\onlinesetup\qqmail\qqbrowserota.exe' /handle=66174 /moduleid=9
'%APPDATA%\tencent\qqbrowser\onlinesetup\msdbg\qqbrowserota.exe' /handle=66170 /moduleid=4
'%APPDATA%\tencent\qqbrowser\liveup\temp\qqbrowserliveup.exe'
'%APPDATA%\tencent\qqbrowser\liveup\temp\qqbrowserliveup.exe' ' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial