Trojan.Siggen32.16590

Technical Information

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7a3-a88.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7aa-93c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-13a4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-10e4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-bcc.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-11bc.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2ea71ac9f74f03ef_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2b6ca33525eb26b5_0
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4f6f34500fd9af4b_0
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2982c78ab665d5b1_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\d7e09d1925dd92f6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\65711d58c1c7e033_0
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\05bb4de1e9a7cb03_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c73616d46d2bffa6_0
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\efe60ee4ba12f44e_0
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e2fce882034467df_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
%LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index

Deletes following files that it created itself

%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7a3-a88.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7aa-93c.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-10e4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-11bc.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-13a4.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6956f7b3-bcc.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\shadercache\gpucache\index
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\default\visited links
%LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\history
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\favicons
%TEMP%\.ses
%LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log

Substitutes the following files

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Network activity

Connects to

'co####.edge.skype.com':443
'ab###.xemvn.vn':443
'x1.#.lencr.org':80
'vi.####oin-price.click':443
't.#o':443
'cl#####amptearing.com':443
'j.###lkin.com':443
'pr#####ficinspector.com':443
'cr#.####g2.amazontrust.com':80
'li##re.com':443
'st####.##oudflareinsights.com':443
'x.##2.us':80
'al#.click':443
'st.##static.net':443
'g.###cdn.com':443
'fo###.gstatic.com':443
'ae#######.aliexpress-media.com':443
'as####.#liexpress-media.com':443
'fo####r.taobao.com':443

TCP

HTTP GET requests

http://cr#.####g2.amazontrust.com/rootg2.cer
http://x.##2.us/x.cer

Other

'co####.edge.skype.com':443
'ab###.xemvn.vn':443
'vi.####oin-price.click':443
't.#o':443
'cl#####amptearing.com':443
'j.###lkin.com':443
'pr#####ficinspector.com':443
'li##re.com':443
'st####.##oudflareinsights.com':443
'ae######ons.aliexpress.ru':443
'al###press.ru':443
'fo#####.aliexpress.com':443
'st.##static.net':443
'ae##.alicdn.com':443
'fo###.gstatic.com':443
'ae#######.aliexpress-media.com':443
'as####.#liexpress-media.com':443
'fo####r.taobao.com':443
'4q####.tdum.alibaba.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK ab###.xemvn.vn
DNS ASK x1.#.lencr.org
DNS ASK vi.####oin-price.click
DNS ASK t.#o
DNS ASK cl#####amptearing.com
DNS ASK li###nclick.com
DNS ASK pr#####ficinspector.com
DNS ASK cr#.####g2.amazontrust.com
DNS ASK li##re.com
DNS ASK st####.##oudflareinsights.com
DNS ASK x.##2.us
DNS ASK jw##kin.com
DNS ASK v.###cre.com
DNS ASK j.###lkin.com
DNS ASK al#.click
DNS ASK al###press.ru
DNS ASK lo###.aliexpress.ru
DNS ASK st.###express.ru
DNS ASK st.##static.net
DNS ASK g.###cdn.com
DNS ASK fo###.gstatic.com
DNS ASK ae#######.aliexpress-media.com
DNS ASK as####.#liexpress-media.com
DNS ASK fo####r.taobao.com
DNS ASK ae#####cs.aliexpress.ru

Miscellaneous

Searches for the following windows

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-1/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-2/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://about.xemvn.vn/direct-link-1/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-3/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-4/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://about.xemvn.vn/direct-link-5/
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,17179141789371324276,5061500708385156881,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://about.xemvn.vn/direct-link-1/' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial