Technical Information
Modifies file system
Creates the following files
- %TEMP%\7za.dll
- %LOCALAPPDATA%\theworld6\user data\default\secure preferences
- %LOCALAPPDATA%\theworld6\user data\default\quotamanager
- %LOCALAPPDATA%\theworld6\user data\default\preferences
- %LOCALAPPDATA%\theworld6\user data\default\history provider cache
- %LOCALAPPDATA%\theworld6\user data\default\history
- %LOCALAPPDATA%\theworld6\user data\default\bookmarks
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\web data
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\top sites
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\shortcuts
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\secure preferences
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\preferences
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\config bookmarks
- %LOCALAPPDATA%\tencent\qqbrowser\user data\default\bookmarks
- %LOCALAPPDATA%\google\chrome\user data\default\bookmarks
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\manifest-000001
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\log.old
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\log
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\current
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000012.ldb
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000011.log
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000009.ldb
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000007.ldb
- %LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000005.ldb
- %LOCALAPPDATA%\theworld6\user data\default\shortcuts
- %LOCALAPPDATA%\theworld6\user data\default\top sites
- %LOCALAPPDATA%\theworld6\user data\default\web data
- %LOCALAPPDATA%\ucbrowser\user data\local state
- %HOMEPATH%\favorites\links\°ù¶èëñë÷.url
- %HOMEPATH%\favorites\links\µçäôµê¹ùГГё.url
- %HOMEPATH%\favorites\links\èèµãðâîå.url
- %HOMEPATH%\favorites\links\óîï·óéà ö.url
- %HOMEPATH%\favorites\links\ìô±¦ГГё.url
- %HOMEPATH%\favorites\links\ìì㨹ºîï.url
- %HOMEPATH%\favorites\links\¾©¶«¹ºîï.url
- %TEMP%\nse57de.tmp\system.dll
- %LOCALAPPDATA%\liebao\user data\default\usertyped
- %LOCALAPPDATA%\liebao\user data\default\web data
- %LOCALAPPDATA%\liebao\user data\default\top sites
- %LOCALAPPDATA%\liebao\user data\default\preferences
- %LOCALAPPDATA%\liebao\user data\default\quotamanager
- %LOCALAPPDATA%\liebao\user data\default\login data
- %LOCALAPPDATA%\liebao\user data\default\bookmarks
- %LOCALAPPDATA%\ucbrowser\user data\default\web data.67
- %LOCALAPPDATA%\ucbrowser\user data\default\web data.65
- %LOCALAPPDATA%\ucbrowser\user data\default\top sites.3
- %LOCALAPPDATA%\ucbrowser\user data\default\secure preferences
- %LOCALAPPDATA%\ucbrowser\user data\default\retailer
- %LOCALAPPDATA%\ucbrowser\user data\default\quotamanager.5
- %LOCALAPPDATA%\ucbrowser\user data\default\preferences
- %LOCALAPPDATA%\ucbrowser\user data\default\omnibox
- %LOCALAPPDATA%\ucbrowser\user data\default\bookmarks
- %HOMEPATH%\favorites\links\Гøö·µ¼º½.url
- %LOCALAPPDATA%\360chrome\chrome\user data\default\web data
- %LOCALAPPDATA%\360chrome\chrome\user data\default\top sites
- %LOCALAPPDATA%\360chrome\chrome\user data\default\secure preferences
- %APPDATA%\baidu\baidubrowser\user_data\default\data_misc\data_misc.db
- %APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db.bak
- %APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db
- %APPDATA%\baidu\baidubrowser\user_data\default\blank_tab\new_tab.db
- %APPDATA%\baidu\baidubrowser\user_data\default\ad_block\ad_block.db
- %APPDATA%\baidu\baidubrowser\rpt.dat
- %APPDATA%\360se6\user data\default\local storage\chrome_newtab_0.localstorage
- %APPDATA%\360se6\user data\default\local storage\chrome-extension_eemcgdkfndhakfknompkggombfjjjeno_0.localstorage
- %APPDATA%\360se6\user data\default\web data
- %APPDATA%\360se6\user data\default\top sites
- %APPDATA%\360se6\user data\default\quotamanager
- %APPDATA%\360se6\user data\default\preferences
- %APPDATA%\360se6\user data\default\history provider cache
- %APPDATA%\360se6\user data\default\history
- %APPDATA%\360se6\user data\default\bookmarks
- %TEMP%\nsm50c9.tmp
- %TEMP%\4eb4.tmp
- %ProgramFiles(x86)%\360\360safe\safemon\360uacu.dat
- %ProgramFiles(x86)%\360\360safe\safemon\360u.dat
- %ProgramFiles(x86)%\360\360safe\netmon\360netmon.ini
- %ProgramFiles(x86)%\360\360safe\leakrepair.dat
- %ProgramFiles(x86)%\360\360safe\deepscan\speedmem2.hg
- %TEMP%\360safe.dll
- %APPDATA%\baidu\baidubrowser\user_data\default\plugin_setting\plugin_setting.db
- %APPDATA%\baidu\baidubrowser\user_data\default\render_info\coreswitch.db
- %APPDATA%\baidu\baidubrowser\user_data\default\render_info\web_compatability2.db
- %APPDATA%\baidu\baidubrowser\user_data\default\settings\settings.db
- %LOCALAPPDATA%\360chrome\chrome\user data\default\preferences
- %LOCALAPPDATA%\360chrome\chrome\user data\default\history provider cache
- %LOCALAPPDATA%\360chrome\chrome\user data\default\history
- %LOCALAPPDATA%\360chrome\chrome\user data\default\bookmarks
- %LOCALAPPDATA%\2345explorer\user data\default\page_file.dat
- %LOCALAPPDATA%\2345explorer\user data\default\web datav3
- %LOCALAPPDATA%\2345explorer\user data\default\top sites
- %LOCALAPPDATA%\2345explorer\user data\default\secure preferences
- %LOCALAPPDATA%\2345explorer\user data\default\preferencesv2
- %LOCALAPPDATA%\2345explorer\user data\default\bookmarks
- %APPDATA%\sogouexplorer\favicon\odefaulticon.ico
- %APPDATA%\sogouexplorer\favicon\favoricon.db
- %APPDATA%\sogouexplorer\favicon\o0u.diannaodian.com.ico
- %APPDATA%\sogouexplorer\favorite3mob.dat
- %APPDATA%\sogouexplorer\favorite3.dat
- %APPDATA%\sogouexplorer\config.xml
- %APPDATA%\sogouexplorer\commcfg.xml
- %APPDATA%\sogouexplorer\misc.db
- %APPDATA%\sogouexplorer\historyurl3.db
- %APPDATA%\mozilla\firefox\profiles\default\xulstore.json
- %APPDATA%\mozilla\firefox\profiles\default\prefs.js
- %APPDATA%\mozilla\firefox\profiles\default\places.sqlite
- %APPDATA%\baidu\baidubrowser\user_data\default\suggestion\suggestion.db
- %APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
- %LOCALAPPDATA%\360chrome\chrome\user data\default\quotamanager
- %HOMEPATH%\favorites\links\»æà úГГё.url
Deletes the following files
- %TEMP%\7za.dll
- %TEMP%\360safe.dll
- %TEMP%\nse57de.tmp\system.dll
- %TEMP%\4eb4.tmp
Moves the following files
- from <Full path to file> to %TEMP%\6635.tmp
Deletes itself.
Miscellaneous
Creates and executes the following
- '%TEMP%\7za.dll' x "%TEMP%\360Safe.dll" -o"%ProgramFiles(x86)%\360" -r -y
- '%TEMP%\4eb4.tmp'
- '<Full path to file>' ' (with hidden window)
- '%TEMP%\7za.dll' x "%TEMP%\360Safe.dll" -o"%ProgramFiles(x86)%\360" -r -y' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C WMIC BIOS get Manufacturer' (with hidden window)
- '%TEMP%\4eb4.tmp' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C WMIC BIOS get Manufacturer
- '%WINDIR%\syswow64\wbem\wmic.exe' BIOS get Manufacturer
