Trojan.Siggen31.60503

Technical Information

Modifies file system

Creates the following files

C:\ho\cj.asp
C:\hos\h357.asp
C:\hos\hosts
C:\iifb\bd.html
C:\iifb\bd0.html
C:\iifb\dh.html
C:\iifb\gg.html
C:\iifb\mm.html
C:\iifb\pc.html
C:\iifb\tp.html
C:\kl\201903pc1212.cmd
C:\kl\3msistub2.exe
C:\kl\apache.msi
C:\kl\ccc.cmd
C:\kl\certutil.lnk
C:\kl\certutil11.exe
C:\kl\certutilgl.lnk
C:\kl\cj.lnk
C:\kl\cj2.lnk
C:\kl\ddd.cmd
C:\kl\kl318kj.lnk
C:\llq\ca15.cer
C:\llq\certutil.lnk
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
C:\llq\cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
C:\llq\cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
C:\llq\cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
C:\llq\cj\appdata\roaming\sogouexplorer\extension3.db
C:\llq\cj\appdata\roaming\sogouexplorer\extension4.db
C:\llq\cj\appdata\roaming\sogouexplorer\favorite3.dat
C:\llq\cj\favorites\links\desktop.ini
C:\llq\cj\favorites\links\天猫.url
C:\llq\cj\favorites\links\爱淘宝.url
C:\llq\cj\favorites\links\百度.url
C:\llq\cj\favorites\links\网址大全.url
C:\llq\cj\favorites\links\聚划算.url
C:\llq\cj\favorites\天猫.url
C:\llq\cj\favorites\爱淘宝.url
C:\llq\cj\favorites\百度.url
C:\llq\cj\favorites\网址大全.url
C:\llq\cj\favorites\聚划算.url
C:\llq\cs.htm
C:\llq\seyishi.crt
C:\llq\seyishi.key
C:\llq\复件 (2) ca15.cer
C:\llq\复件 (2) certutil.lnk
C:\llq\复件 (3) ca15.cer
C:\llq\复件 (3) certutil.lnk
C:\llq\复件 ca15.cer
C:\llq\复件 certutil.lnk
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
C:\llq\复件 cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
C:\llq\复件 cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
C:\llq\复件 cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
C:\llq\复件 cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
C:\llq\复件 cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
C:\llq\复件 cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension3.db
C:\llq\复件 cj\appdata\roaming\sogouexplorer\extension4.db
C:\llq\复件 cj\appdata\roaming\sogouexplorer\favorite3.dat
C:\llq\复件 cj\favorites\links\desktop.ini
C:\llq\复件 cj\favorites\links\天猫.url
C:\llq\复件 cj\favorites\links\爱淘宝.url
C:\llq\复件 cj\favorites\links\百度.url
C:\llq\复件 cj\favorites\links\网址大全.url
C:\llq\复件 cj\favorites\links\聚划算.url
C:\llq\复件 cj\favorites\天猫.url
C:\llq\复件 cj\favorites\爱淘宝.url
C:\llq\复件 cj\favorites\百度.url
C:\llq\复件 cj\favorites\网址大全.url
C:\llq\复件 cj\favorites\聚划算.url
C:\llq\复件 cs.htm
C:\llq\复件 seyishi.crt
C:\llq\复件 seyishi.key
%ProgramFiles%\bangteng\kangle\etc\config.xml
%ProgramFiles(x86)%\bangteng\kangle\etc\config.xml
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68e77825-38c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68e7782a-2c4.pma
nul
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%TEMP%\edge_bits_708_1533042931\bit262c.tmp
%TEMP%\708_1638867374\manifest.json
%TEMP%\708_1638867374\license.txt
%TEMP%\708_1638867374\filtering rules
%TEMP%\708_1638867374\_metadata\verified_contents.json
%TEMP%\708_1638867374\manifest.fingerprint
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
%LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir708_737445980\ruleset data

Sets the 'hidden' attribute to the following files

%TEMP%\edge_bits_708_1533042931\bit262c.tmp

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
from %TEMP%\edge_bits_708_1533042931\bit262c.tmp to %TEMP%\edge_bits_708_1533042931\dde93974-5cbc-4ecc-898f-436e62207c34

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%TEMP%\.ses

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

Connects to

'co####.edge.skype.com':443
'17#.66.2.5':80
'localhost':5985

TCP

Other

'co####.edge.skype.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK 42.##r35.com
DNS ASK google.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument C:\iifb\gg.html
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" "
'%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\ccc.cmd"" h",0)(window.close)
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"
'%WINDIR%\syswow64\cmd.exe' /c tasklist | findstr /i "cmd.exe" 2>nul
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\findstr.exe' /i "cmd.exe"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate "C:\iifb\gg.html"
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n "60"
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,501368586389474198,14879103165713293765,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
'%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate "C:\iifb\gg.html"' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial