Technical Information
- [<HKLM>\System\CurrentControlSet\Services\8n8n6ugm] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\8n8n6ugm] 'ImagePath' = '%WINDIR%\Media\8n8n6ugm.mui'
- %WINDIR%\explorer.exe
- %APPDATA%\sogouexplorer.zip
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\.usage
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\paths\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\paths\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\000\t\paths\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\000003.log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\google profile.ico
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\history
- <LS_APPDATA>\tencent\qqbrowser\user data\default\history provider cache
- <LS_APPDATA>\tencent\qqbrowser\user data\default\history2
- <LS_APPDATA>\tencent\qqbrowser\user data\default\last session
- <LS_APPDATA>\tencent\qqbrowser\user data\default\last tabs
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\000003.log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\features
- <LS_APPDATA>\tencent\qqbrowser\user data\default\file system\origins\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\favicons
- <LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\log.old
- <LS_APPDATA>\tencent\qqbrowser\user data\default\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\current session
- <LS_APPDATA>\tencent\qqbrowser\user data\default\current tabs
- <LS_APPDATA>\tencent\qqbrowser\user data\default\data.qbl
- <LS_APPDATA>\tencent\qqbrowser\user data\default\databases\databases.db
- <LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\data_reduction_proxy_leveldb\manifest-000020
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\log.old
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\000003.log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension rules\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\000003.log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\extension state\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\network persistent state
- %TEMP%\oluscmbuy\cleanup.exe
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\000003.log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\shortcuts
- <LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\log.old
- <LS_APPDATA>\tencent\qqbrowser\user data\default\top sites
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\transportsecurity
- <LS_APPDATA>\tencent\qqbrowser\user data\default\visited links
- <LS_APPDATA>\tencent\qqbrowser\user data\default\web data
- <LS_APPDATA>\tencent\qqexp.reg
- %WINDIR%\setup\state\tmpstate.7z
- %TEMP%\kehes0wx5\7za.exe
- %WINDIR%\setup\state\ssl\certum trusted network ca 2.cer
- <LS_APPDATA>\tencent\qqbrowser\user data\default\session storage\000003.log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\cookies
- <LS_APPDATA>\tencent\qqbrowser\user data\default\secure preferences
- <LS_APPDATA>\tencent\qqbrowser\user data\default\network action predictor
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\log.old
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local storage\leveldb\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\log
- <LS_APPDATA>\tencent\qqbrowser\user data\default\log.old
- <LS_APPDATA>\tencent\qqbrowser\user data\default\manifest-000006
- <LS_APPDATA>\tencent\qqbrowser\user data\default\local extension settings\mlehopoocpjmcnmdglgkbkciccefgmfk\log.old
- <LS_APPDATA>\tencent\qqbrowser\user data\default\repeal_data.json
- <LS_APPDATA>\tencent\qqbrowser\user data\default\page_load_capping_opt_out.db
- <LS_APPDATA>\tencent\qqbrowser\user data\default\preferences
- <LS_APPDATA>\tencent\qqbrowser\user data\default\preferences.bak
- <LS_APPDATA>\tencent\qqbrowser\user data\default\preferences_01
- <LS_APPDATA>\tencent\qqbrowser\user data\default\previews_opt_out.db
- <LS_APPDATA>\tencent\qqbrowser\user data\default\quick links
- <LS_APPDATA>\tencent\qqbrowser\user data\default\quotamanager
- <LS_APPDATA>\tencent\qqbrowser\user data\default\searchfav
- <LS_APPDATA>\tencent\qqbrowser\user data\default\thumbnails\manifest-000001
- <LS_APPDATA>\tencent\qqbrowser\user data\default\config bookmarks.zip
- %APPDATA%\360se6\user data\default\bookmarks
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\cookies.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\crashes\store.json.mozlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176053914.5498e1db-ec83-4398-aabb-b1d74c46f34f.event.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054084.f5a3d023-6b36-427f-bc5c-bd49e0c96f27.new-profile.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054155.2c95b9b6-7cc4-4276-9e1b-ac1f479f8290.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176054159.0b2c25df-0121-4515-a72e-939763fa69f3.first-shutdown.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074239.244ad4e5-4553-4c93-8a73-f0b58f447521.health.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074306.3d6e140b-0686-4f27-9f81-c4f16cf75495.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200848746.e426a42e-682c-4b51-9c8d-39245af55444.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057491907.974d8be3-0c22-430b-8358-1037dcc4fc17.health.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057491958.016da8e6-a809-4924-a57d-7f1d626b4b0a.health.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057492363.a896da6c-7cc7-4347-b363-ecbcd243186b.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057859077.ee4531e2-b7ad-40c1-90ba-2fa0ca72ff2a.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552057910953.ee1065d6-4494-45af-bc11-52c515b5fc5f.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200569992.47f1c95a-8f91-43fb-896e-6a290faab258.main.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-03\1552200813338.f6202e8d-499e-4a5a-928a-67794e6d5eb0.modules.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\content-prefs.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\archived\2019-02\1551176074280.5d271550-2d96-4bfa-8bb8-20a394e876cc.health.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\containers.json
- %APPDATA%\baidu\baidubrowser\user_data\default\settings\settings.db
- %APPDATA%\sogouexplorer\favorite3.dat
- <LS_APPDATA>\google.zip
- <LS_APPDATA>\google\chrome\user data\default\bookmarks
- <LS_APPDATA>\360chrome\chrome\user data\default\bookmarks
- <LS_APPDATA>\2345explorer\user data\default\bookmarksv2
- %APPDATA%\baidu\baidubrowser.zip
- %APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db
- %APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\cert9.db
- %APPDATA%\mozilla.zip
- %APPDATA%\mozilla\firefox\crash reports\installtime20190211233335
- %APPDATA%\mozilla\firefox\crash reports\installtime20190225143501
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\addons.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\addonstartup.json.lz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\blocklist.xml
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\broadcast-listeners.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\compatibility.ini
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessioncheckpoints.json
- <LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\log.old
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\extensions.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\times.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\weave\failed\tabs.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\weave\tofetch\tabs.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\webappsstore.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\xulstore.json
- %APPDATA%\mozilla\firefox\profiles\profiles.log
- <LS_APPDATA>\tencent\qqbrowser.zip
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\state.json
- <LS_APPDATA>\tencent\qqbrowser\user data\default\.beacon_analytics.db
- <LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks
- <LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks.bak
- <LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks_01
- <LS_APPDATA>\tencent\qqbrowser\user data\default\bookmarks_01.bak
- <LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\current
- <LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\log
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
- <LS_APPDATA>\tencent\qqbrowser\user data\default\budgetdatabase\manifest-000001
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\search.json.mozlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\handlers.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\key4.db
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\permissions.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\pkcs11.txt
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\places.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\pluginreg.dat
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\prefs.js
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\datareporting\session-state.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\.metadata
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\previous.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\upgrade.jsonlz4-20190211233335
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore-backups\upgrade.jsonlz4-20190225143501
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sessionstore.jsonlz4
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\shield-preference-experiments.json
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\sitesecurityservicestate.txt
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage.sqlite
- %APPDATA%\mozilla\firefox\profiles\4zytiq1u.default\storage\permanent\chrome\.metadata-v2
- %WINDIR%\media\8n8n6ugm.mui
- %APPDATA%\sogouexplorer.zip
- <LS_APPDATA>\google.zip
- %APPDATA%\baidu\baidubrowser.zip
- %APPDATA%\mozilla.zip
- <LS_APPDATA>\tencent\qqbrowser.zip
- <LS_APPDATA>\tencent\qqexp.reg
- %WINDIR%\setup\state\state.ini
- %TEMP%\kehes0wx5\7za.exe
- %WINDIR%\setup\state\tmpstate.7z
- %TEMP%\oluscmbuy\cleanup.exe
- <LS_APPDATA>\Google\Chrome\User Data\Default\Preferences
- <LS_APPDATA>\Google\Chrome\User Data\Default\Secure Preferences
- %APPDATA%\Mozilla\Firefox\profiles.ini
- '11#.#14.114.114':53
- DNS ASK ba##u.com
- ClassName: '' WindowName: 'Microsoft Windows'
- ClassName: '' WindowName: 'ϵͳÉèÖøü¸Ä'
- ClassName: '' WindowName: 'Windows ×ÊÔ´¹ÜÀГÆ÷'
- ClassName: '' WindowName: 'ÍøÖ·´óÈ« - Ëѹ·¸ßËÙä¯ÀÀÆ÷'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- '%TEMP%\kehes0wx5\7za.exe' x "%WINDIR%\Setup\State\TmpState.7z" -o"%WINDIR%\Setup\State" -aoa -t7z -pU#wnfh7us81.7ev&nv
- '%TEMP%\oluscmbuy\cleanup.exe'
- '%WINDIR%\syswow64\cmd.exe' /c regedit /s "<LS_APPDATA>\Tencent\qqexp.reg"' (with hidden window)
- '%TEMP%\kehes0wx5\7za.exe' x "%WINDIR%\Setup\State\TmpState.7z" -o"%WINDIR%\Setup\State" -aoa -t7z -pU#wnfh7us81.7ev&nv' (with hidden window)
- '%TEMP%\oluscmbuy\cleanup.exe' ' (with hidden window)
- '%WINDIR%\syswow64\explorer.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c regedit /s "<LS_APPDATA>\Tencent\qqexp.reg"
- '%WINDIR%\syswow64\regedit.exe' /s "<LS_APPDATA>\Tencent\qqexp.reg"
- '%WINDIR%\syswow64\explorer.exe'