Technical Information
Modifies file system
Creates the following files
- %TEMP%\aut55f0.tmp
- %ProgramFiles(x86)%\tbkset\hao123.exe
- %ProgramFiles(x86)%\tbkset\haoparam.ini
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-696edab7-17c0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-696edabe-7c0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7123ac373d4a8ec7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5bf2d06080192118_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f38f842c36af354a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\83d987a2e5b2f34f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_v.qq.com_0.indexeddb.leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_v.qq.com_0.indexeddb.leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_v.qq.com_0.indexeddb.leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_v.qq.com_0.indexeddb.leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
- %TEMP%\18b83c34-0aaa-45fb-8438-917d2a760466.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000016
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000017
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000018
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000019
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000020
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000021
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000022
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000023
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000024
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000025
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000026
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000027
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000028
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000029
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000030
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000031
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000032
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000033
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000034
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000035
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000036
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000037
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000038
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000039
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00003a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00003b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00003c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00003d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00003e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00003f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000040
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000041
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000042
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000043
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000044
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000045
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000046
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000047
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000048
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000049
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000050
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000051
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000052
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000053
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000054
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000055
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000056
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000057
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000058
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000059
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00005a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00005b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00005c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00005d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00005e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00005f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000060
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000061
Deletes following files that it created itself
- %TEMP%\aut55f0.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000027
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000028
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00002e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000053
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000055
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00004f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000052
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000056
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-696edab7-17c0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-696edabe-7c0.pma
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_v.qq.com_0.indexeddb.leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\indexeddb\https_v.qq.com_0.indexeddb.leveldb\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %TEMP%\.ses
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'hi.##idu.com':80
- 'co####.edge.skype.com':443
- '12#.#ogou.com':80
- '12#.#ogou.com':443
- 'st####.res.qq.com':443
- 'ed##.###.#hiyan.tencent-cloud.net':443
- 'op####e.imtt.qq.com':443
- 'pb.##gou.com':443
- 'to####s.imtt.qq.com':443
- 'sn####ake.qq.com':443
- 'ae###.qq.com':443
- 'i.###s.qq.com':443
- 'ho####t.imtt.qq.com':443
- 'da#####.browser.qq.com':443
- 'ho#####ad.html5.qq.com':443
- 'pu#######.zhiyan.tencent-cloud.net':443
- 'pb#####s.video.qq.com':443
- 'localhost':5283
- 'in###.gtimg.com':443
- 'cd#.#fa.qq.com':443
- 'pg##.gtimg.cn':443
- 'localhost':5284
- 'ad####d.gdtimg.com':443
- 'v.##.com':443
- 'localhost':5285
- 'ip###.l.qq.com':443
- 'ga##.kde.qq.com':443
- 'localhost':5286
- 'localhost':5287
- 'localhost':5288
- 'h.###ce.qq.com':443
- 'be####.cdn.qq.com':443
- 'localhost':5289
- 'v.###.qq.com':443
TCP
HTTP GET requests
- http://hi.##idu.com/ajian55/item/838719fc8c0905c9531c26c2
- http://12#.#ogou.com/?Af#####
Other
- 'co####.edge.skype.com':443
- '12#.#ogou.com':443
- 'm4.#####cimg.browser.qq.com':443
- 'ed##.###.#hiyan.tencent-cloud.net':443
- 'op####e.imtt.qq.com':443
- 'pb.##gou.com':443
- 'sn####ake.qq.com':443
- 'to####s.imtt.qq.com':443
- 'i.###s.qq.com':443
- 'ae###.qq.com':443
- 'ho####t.imtt.qq.com':443
- 'pu#######.zhiyan.tencent-cloud.net':443
- 'ho#####ad.html5.qq.com':443
- 'pb#####s.video.qq.com':443
- 'in###.gtimg.com':443
- 'cd#.#fa.qq.com':443
- 'ad####d.gdtimg.com':443
- 'ip###.l.qq.com':443
- 'ga##.kde.qq.com':443
- 'h.###ce.qq.com':443
- 'rp#.#dt.qq.com':443
UDP
- DNS ASK hi.##idu.com
- DNS ASK in####ow.baidu.com
- DNS ASK co####.edge.skype.com
- DNS ASK 12#.#ogou.com
- DNS ASK re#.##owser.qq.com
- DNS ASK st####.res.qq.com
- DNS ASK so##u.com
- DNS ASK m4.#####cimg.browser.qq.com
- DNS ASK ed##.###.#hiyan.tencent-cloud.net
- DNS ASK op####e.imtt.qq.com
- DNS ASK pb.##gou.com
- DNS ASK to####s.imtt.qq.com
- DNS ASK sn####ake.qq.com
- DNS ASK kd#.qq.com
- DNS ASK ho####t.imtt.qq.com
- DNS ASK da#####.browser.qq.com
- DNS ASK ho#####ad.html5.qq.com
- DNS ASK pu#######.zhiyan.tencent-cloud.net
- DNS ASK ae###.qq.com
- DNS ASK i.###s.qq.com
- DNS ASK ql.##mapp.com
- DNS ASK pb#####s.video.qq.com
- DNS ASK in###.gtimg.com
- DNS ASK cd#.#fa.qq.com
- DNS ASK ad####d.gdtimg.com
- DNS ASK pg##.gtimg.cn
- DNS ASK v.##.com
- DNS ASK ip###.l.qq.com
- DNS ASK ga##.kde.qq.com
- DNS ASK h.###ce.qq.com
- DNS ASK be####.cdn.qq.com
- DNS ASK rp#.#dt.qq.com
- DNS ASK v.###.qq.com
- DNS ASK vr.##t.qq.com
- 'ho####t.imtt.qq.com':443
- 'pb#####s.video.qq.com':443
- 'ga##.kde.qq.com':443
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://123.sogou.com/?Af25415
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://123.sogou.com/?Af25415
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,12070754809642326875,18406428317175291454,131072 --lang=en-US --service-sandbox-type=none --mojo...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://123.sogou.com/?Af25415' (with hidden window)
