Trojan.Siggen32.28889

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'ManTray' = '%APPDATA%\OT\ManTray.exe'
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_News_20260316152549' = '"%ProgramFiles(x86)%\wjplay2\20260316152549\WJSpeed.exe" -mini'
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_20260316152549' = '"%ProgramFiles(x86)%\wjplay2\20260316152549\wjplay.exe" -mini'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] '广告神盾' = '%ProgramFiles(x86)%\广告神盾\AdShield.exe tray'

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /im mvhd.exe

Patches code

in dll

-8670_2508_mm.exe process, Windows.Storage.dll module
-8670_2508_mm.exe process, SHELL32.dll module
setup_194a_p.exe process, SHELL32.dll module
adshield.exe process, SHELL32.dll module

Intercepts control using hardware breakpoints

in dll

wjspeed.exe process, unknown module

Modifies file system

Creates the following files

%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irimg1.jpg
%TEMP%\_ir_sf_temp_0\irimg2.jpg
%TEMP%\your product setup log.txt
%ProgramFiles(x86)%\your product\uninstall\uni3d05.tmp
%ProgramFiles(x86)%\your product\uninstall\uninstall.dat
%ProgramFiles(x86)%\your product\uninstall.exe
%ProgramFiles(x86)%\your product\lua5.1.dll
%ProgramFiles(x86)%\your product\uninstall\uninstall.xml
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \ВѕВІГ¤В¬В°Гј\В¶ВјВІВҐ\pczh_107_2508.exe
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \qqГ—ВЁВ°Г¦v1.exe
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \ВѕВІГ¤В¬В°Гј\В¶ВјВІВҐ\-8670_2508_mm.exe
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \ВѕВІГ¤В¬В°Гј\В¶ВјВІВҐ\setup_open_4705-2508.exe
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \ВѕВІГ¤В¬В°Гј\В¶ВјВІВҐ\sonlinetime_1308.exe
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \ВѕВІГ¤В¬В°Гј\В¶ВјВІВҐ\xnbugkb_30450.exe
%ProgramFiles(x86)%\your product\Г¬Г№В°Г©Г Г \ВѕВІГ¤В¬В°Гј\В¶ВјВІВҐ\setup_194a_p.exe
%APPDATA%\microsoft\windows\start menu\programs\your product\pczh_107_2508.lnk
%APPDATA%\microsoft\windows\start menu\programs\your product\qqГ—ВЁВ°Г¦.lnk
%APPDATA%\microsoft\windows\start menu\programs\your product\-8670_2508_mm.lnk
%APPDATA%\microsoft\windows\start menu\programs\your product\Г®ГѕВјВ«ГіВ°ГІГґВ°ВІГ—В°ВіГ¬Г°ГІ.lnk
%APPDATA%\microsoft\windows\start menu\programs\your product\sonlinetime_1308.lnk
%APPDATA%\microsoft\windows\start menu\programs\your product\xnbugkb_30450.lnk
%APPDATA%\microsoft\windows\start menu\programs\your product\В№ГЈВёГ¦Г©Г±В¶ГјВ°ВІГ—В°ВіГ¬Г°ГІ.lnk
%ProgramFiles(x86)%\your product\uninstall\irimg1.jpg
%ProgramFiles(x86)%\your product\uninstall\irimg2.jpg
%TEMP%\tmpskzxcomm.zip
%APPDATA%\ot\mtup.exe
%APPDATA%\ot\mtad.exe
%APPDATA%\ot\uninstall.exe
%APPDATA%\ot\mtset.exe
%APPDATA%\ot\resources\errorpage.html
%APPDATA%\ot\popwinparam.xml
%APPDATA%\ot\setup.ini
%APPDATA%\ot\xcguid.dll
%TEMP%\nsu60e9.tmp
%TEMP%\nsp6118.tmp\system.dll
%APPDATA%\ot\license.txt
%TEMP%\nsk60fa.tmp\base64.dll
%TEMP%\nsp6118.tmp\meinvying.exe
%APPDATA%\ot\resources\citylist.xml
%TEMP%\nsf6260.tmp
%TEMP%\nsv6271.tmp\res\onlinewnd.zip
%APPDATA%\ot\mantraysetdlg\images\button.png
%APPDATA%\ot\mantraysetdlg\images\close.png
%TEMP%\nsk60fa.tmp\system.dll
%APPDATA%\ot\mantraysetdlg\images\question.png
%APPDATA%\ot\mantraysetdlg\images\set_bk.png
%TEMP%\nsv6271.tmp\bdmskin.dll
%APPDATA%\ot\mantraysetdlg\images\set_common.png
%APPDATA%\ot\mantraysetdlg\images\set_line.png
%APPDATA%\fwnetwork\广告神盾\data.zip
%TEMP%\nsv6271.tmp\bdmdownload.dll
%APPDATA%\fwnetwork\广告神盾\setup.ini
%APPDATA%\ot\mantraysetdlg\images\set_right.png
%APPDATA%\fwnetwork\广告神盾\uninstall.exe
%APPDATA%\ot\mantraysetdlg\mainframe.xml
%APPDATA%\ot\mantraysetdlg\mantraysetdlg.xcproj
%APPDATA%\ot\mantraysetdlg\resource.res
%APPDATA%\ot\mantraysetdlg\style.css
%TEMP%\nsv6271.tmp\dl.dll
%APPDATA%\ot\mantraysetdlg\tabgeneralsettings.xml
%APPDATA%\ot\mantraysetdlg\tabothersettings.xml
%TEMP%\nsk60fa.tmp\nsisdl.dll
%TEMP%\nsv6271.tmp\hu.dll
%APPDATA%\ot\mantraysetdlg\tabsoundsettings.xml
%APPDATA%\ot\mantraysetdlg\tabtimesettings.xml
%TEMP%\nsv6271.tmp\bdlogicutils.dll
%APPDATA%\ot\mantraysetdlg\tabweathersettings.xml
%TEMP%\tmpskzxsteup.zip
%TEMP%\nsv6271.tmp\bdmnetgetinfo.dll
%APPDATA%\ot\mantray.exe
%APPDATA%\ot\mantraydll.dll
%APPDATA%\microsoft\windows\templates\1620263152544236\yym_955wd30.gif
%TEMP%\nsv6271.tmp\tmpwzwjkf.dll
%ProgramFiles(x86)%\广告神盾\adclear.bat
%ProgramFiles(x86)%\广告神盾\adhkdll.dll
%ProgramFiles(x86)%\广告神盾\adshield.exe
%ProgramFiles(x86)%\广告神盾\bugreport.dll
%ProgramFiles(x86)%\广告神盾\cfg.ini
%ProgramFiles(x86)%\广告神盾\res\backgroundtip.html
%ProgramFiles(x86)%\azh2.3\zhihui2.3.exe
%ProgramFiles(x86)%\azh2.3\uninstall.exe
%ProgramFiles(x86)%\azh2.3\zhtray.exe
%ProgramFiles(x86)%\azh2.3\toolzhsrv.exe
%ProgramFiles(x86)%\广告神盾\res\css\backgroundtip.css
%ProgramFiles(x86)%\广告神盾\res\css\common.css
%HOMEPATH%\desktop\ГЄВ±ВїГ¬ГґГєГЇГџ.lnk
%ProgramFiles(x86)%\广告神盾\res\css\index.css
%ProgramFiles(x86)%\广告神盾\res\css\interceptedtip.css
%ProgramFiles(x86)%\广告神盾\res\css\trunonruntip.css
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\dnserrordiagoff[1]
%APPDATA%\microsoft\windows\start menu\programs\ГЄВ±ВїГ¬ГґГєГЇГџ\ГЄВ±ВїГ¬ГґГєГЇГџ.lnk
%ProgramFiles(x86)%\广告神盾\res\css\window.css
%APPDATA%\microsoft\windows\start menu\programs\В°В®Г§Г©.Г¶Г§В»Г»2.3\Г°В¶ГґГё.lnk
%ProgramFiles(x86)%\广告神盾\res\img\0006.gif
%APPDATA%\microsoft\windows\start menu\programs\ГЄВ±ВїГ¬ГґГєГЇГџ\Г°В¶ГґГёГЄВ±ВїГ¬ГґГєГЇГџ.lnk
%APPDATA%\microsoft\windows\start menu\programs\В°В®Г§Г©.Г¶Г§В»Г»2.3\В°В®Г§Г©.Г¶Г§В»Г»2.3.lnk
%ProgramFiles(x86)%\广告神盾\res\img\0007.gif
%HOMEPATH%\desktop\В°В®Г§Г©.Г¶Г§В»Г»2.3.lnk
%ProgramFiles(x86)%\广告神盾\res\img\1.png
%ProgramFiles(x86)%\广告神盾\res\img\2.png
%ProgramFiles(x86)%\广告神盾\res\img\con1.png
%ProgramFiles(x86)%\广告神盾\res\img\con2.png
%ProgramFiles(x86)%\广告神盾\res\img\con3.png
%ProgramFiles(x86)%\广告神盾\res\img\foot.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5mnh50zs\newerrorpagetemplate[1]
%ProgramFiles(x86)%\广告神盾\res\img\guan.png
%TEMP%\nsk60fa.tmp\math.dll
%ProgramFiles(x86)%\广告神盾\res\img\icon2.gif
%ProgramFiles(x86)%\广告神盾\res\img\kai.png
%ProgramFiles(x86)%\广告神盾\res\img\logo.png
%ProgramFiles(x86)%\广告神盾\res\img\logo36.png
%ProgramFiles(x86)%\广告神盾\res\img\t.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\errorpagestrings[1]
%ProgramFiles(x86)%\广告神盾\res\img\t1.png
%ProgramFiles(x86)%\广告神盾\res\img\t1_1.png
%ProgramFiles(x86)%\广告神盾\res\img\t1_1_1.png
%ProgramFiles(x86)%\广告神盾\res\img\t2.png
%ProgramFiles(x86)%\广告神盾\res\img\t2_1.png
%ProgramFiles(x86)%\广告神盾\res\img\t2_1_1.png
%ProgramFiles(x86)%\广告神盾\res\img\t3.png
%ProgramFiles(x86)%\广告神盾\res\img\t3_1.png
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\httperrorpagesscripts[1]
%ProgramFiles(x86)%\广告神盾\res\img\t3_1_1.png
%ProgramFiles(x86)%\广告神盾\res\img\top1.png
%ProgramFiles(x86)%\广告神盾\res\img\top2.png
%ProgramFiles(x86)%\广告神盾\res\img\x.png
%ProgramFiles(x86)%\广告神盾\res\img\yguan.png
%ProgramFiles(x86)%\广告神盾\res\img\ykai.png
%ProgramFiles(x86)%\广告神盾\res\img\yun.png
%ProgramFiles(x86)%\广告神盾\res\img\_0020_�ѿ��.png
%ProgramFiles(x86)%\广告神盾\res\img\_0024_��ȫ��.png
%ProgramFiles(x86)%\广告神盾\res\img\_0025_��.png
%ProgramFiles(x86)%\广告神盾\res\img\_0028_�׵�.png
%ProgramFiles(x86)%\广告神盾\res\img\��.jpg
%ProgramFiles(x86)%\广告神盾\res\index.html
%APPDATA%\zhihui1620263\min.ini
%APPDATA%\zhihui1620263\set.ini
%ProgramFiles(x86)%\meinvying\meinvying.exe
%ProgramFiles(x86)%\广告神盾\res\interceptedtip.html
%ProgramFiles(x86)%\广告神盾\res\js\common.js
%ProgramFiles(x86)%\广告神盾\res\js\index.js
%ProgramFiles(x86)%\meinvying\mvyy.exe
%ProgramFiles(x86)%\广告神盾\res\js\jquery-1.10.2.min.js
%ProgramFiles(x86)%\meinvying\uninst.exe
%ProgramFiles(x86)%\广告神盾\res\js\json2.js
%ProgramFiles(x86)%\广告神盾\res\js\progress.js
%ProgramFiles(x86)%\广告神盾\res\js\settings.js
%ProgramFiles(x86)%\广告神盾\res\msgbox.html
%ProgramFiles(x86)%\广告神盾\res\settings.html
%ProgramFiles(x86)%\广告神盾\res\sound\tip.wav
%ProgramFiles(x86)%\meinvying\ГЈГ ГҐВ®ГіВЄ.lnk
%ProgramFiles(x86)%\广告神盾\res\tip.htm
%ProgramFiles(x86)%\广告神盾\res\tip.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ГЈГ ГҐВ®ГіВЄ\ГЈГ ГҐВ®ГіВЄ.lnk
%ProgramFiles(x86)%\广告神盾\res\trunonruntip.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ГЈГ ГҐВ®ГіВЄ\Г°В¶ГґГёГЈГ ГҐВ®ГіВЄ.lnk
%ProgramFiles(x86)%\广告神盾\res\window.html
C:\users\public\desktop\ГЈГ ГҐВ®ГіВЄ.lnk
%ProgramFiles(x86)%\广告神盾\server\adshieldserver.exe
%TEMP%\nsk60fa.tmp\md5dll.dll
%TEMP%\nsk60fa.tmp\inetc.dll
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\colors.js
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\example.html
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\example.js
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\mit-license.txt
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\package.json
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\readme.md
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\test.js
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\themes\winston-dark.js
%ProgramFiles(x86)%\广告神盾\server\node_modules\colors\themes\winston-light.js
%ProgramFiles(x86)%\广告神盾\server\proxy.js
%ProgramFiles(x86)%\wjplay2\20260316152549\bottom.xml
%ProgramFiles(x86)%\wjplay2\20260316152549\client.ini
%ProgramFiles(x86)%\广告神盾\server\res\blank.gif
%ProgramFiles(x86)%\wjplay2\20260316152549\data\def.html
%ProgramFiles(x86)%\wjplay2\20260316152549\data\def.jpg
%ProgramFiles(x86)%\wjplay2\20260316152549\data\ekanr.dat
%ProgramFiles(x86)%\wjplay2\20260316152549\data\err.html
%ProgramFiles(x86)%\wjplay2\20260316152549\data\err.jpg
%ProgramFiles(x86)%\wjplay2\20260316152549\data\loading.gif
%ProgramFiles(x86)%\wjplay2\20260316152549\data\poptime_bg.png
%ProgramFiles(x86)%\wjplay2\20260316152549\data\tab_more.png
%ProgramFiles(x86)%\wjplay2\20260316152549\data\user2.ini
%ProgramFiles(x86)%\wjplay2\20260316152549\data\wj.ico
%ProgramFiles(x86)%\wjplay2\20260316152549\duilib.dll
%ProgramFiles(x86)%\广告神盾\server\res\rule.pac
%ProgramFiles(x86)%\wjplay2\20260316152549\locallist.xml
%ProgramFiles(x86)%\wjplay2\20260316152549\playerupdate.exe
%ProgramFiles(x86)%\wjplay2\20260316152549\playlist.xml
%ProgramFiles(x86)%\广告神盾\server\res\v.js
%ProgramFiles(x86)%\wjplay2\20260316152549\server.ini
%ProgramFiles(x86)%\wjplay2\20260316152549\stat.ini
%ProgramFiles(x86)%\wjplay2\20260316152549\sysconfig.ini
%ProgramFiles(x86)%\wjplay2\20260316152549\unins.exe
%ProgramFiles(x86)%\wjplay2\20260316152549\wjplay.exe
%ProgramFiles(x86)%\广告神盾\server\rules\1.txt
%ProgramFiles(x86)%\wjplay2\20260316152549\wjspeed.exe
%ProgramFiles(x86)%\广告神盾\server\rules\ad.rul
%ProgramFiles(x86)%\广告神盾\server\rules\adblock.txt
%ProgramFiles(x86)%\广告神盾\server\rules\custom.rul
%ProgramFiles(x86)%\广告神盾\server\rules\free.txt
%ProgramFiles(x86)%\广告神盾\server\rules\vid.rul
%ProgramFiles(x86)%\广告神盾\server\start.bat
%ProgramFiles(x86)%\广告神盾\uninstall.exe
%ProgramFiles(x86)%\广告神盾\uninstall.ico
%ProgramFiles(x86)%\广告神盾\update.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\navcancl[1]
C:\users\public\desktop\wjplay2.lnk
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5mnh50zs\errorpagetemplate[1]
%APPDATA%\microsoft\windows\start menu\programs\wjplay2\wjplay2.lnk
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\errorpagestrings[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\info_48[1]
%LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\background_gradient[1]
%APPDATA%\microsoft\windows\start menu\programs\wjplay2\В№Г№В·ВЅГ¶Г·ГІВі.lnk
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\bullet[1]
%APPDATA%\microsoft\windows\start menu\programs\wjplay2\ГҐГ¤Г¶ГЈВ№В¤ВѕГџ\Г°В¶ГґГёwjplay2.lnk
%HOMEPATH%\favorites\ГЈГўВ·Г±Г©ГЇГГёВµВјВєВЅ.url
%HOMEPATH%\favorites\Г¬Г¬ГІГВѕГјГЄГўГГё.url
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\dnserrordiagoff[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\newerrorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5mnh50zs\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\httperrorpagesscripts[2]
%APPDATA%\microsoft\windows\start menu\广告神盾\广告神盾.lnk
%LOCALAPPDATA%low\meinvying\fav9.dat
%APPDATA%\microsoft\windows\start menu\广告神盾\卸载广告神盾.lnk
C:\users\public\desktop\广告神盾.lnk
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69b8838b-374.pma
%LOCALAPPDATA%\microsoft\windows\history\desktop.ini
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69b8839a-c40.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%TEMP%\{40bf64b9-a2ab-433b-bf85-7282a3ae7e99}.png
%LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{8b55689e-be7f-a422-6767-8c1a97388540}.png
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000004
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000004.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log

Deletes following files that it created itself

%TEMP%\_ir_sf_temp_0\irsetup.dat
%ProgramFiles(x86)%\your product\uninstall\uni3d05.tmp
%TEMP%\tmpskzxcomm.zip
%TEMP%\tmpskzxsteup.zip
%APPDATA%\microsoft\windows\templates\1620263152544236\yym_955wd30.gif
%TEMP%\nsk60fa.tmp\base64.dll
%TEMP%\nsk60fa.tmp\inetc.dll
%TEMP%\nsk60fa.tmp\math.dll
%TEMP%\nsk60fa.tmp\md5dll.dll
%TEMP%\nsk60fa.tmp\nsisdl.dll
%TEMP%\nsk60fa.tmp\system.dll
%TEMP%\nsp6118.tmp\meinvying.exe
%TEMP%\nsp6118.tmp\system.dll
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\dnserrordiagoff[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5mnh50zs\newerrorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\errorpagestrings[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\httperrorpagesscripts[1]
%APPDATA%\fwnetwork\广告神盾\setup.ini
%APPDATA%\fwnetwork\广告神盾\data.zip
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%TEMP%\{40bf64b9-a2ab-433b-bf85-7282a3ae7e99}.png
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69b8838b-374.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69b8839a-c40.pma
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\navcancl[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5mnh50zs\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\5mnh50zs\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\zga47ebn\httperrorpagesscripts[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\nqno8qin\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\4pn3wjse\bullet[1]

Moves the following files

from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Modifies the following files

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%LOCALAPPDATA%\microsoft\edge\user data\last browser

Substitutes the following files

%APPDATA%\microsoft\windows\templates\1620263152544236\yym_955wd30.gif
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\BudgetDatabase\LOG

Network activity

Connects to

'go#####a###ytics.com':80
'm1.##0308.com':80
'sh###.baidu.com':80
'cl####.180308.com':80
'localhost':8585
'co####.edge.skype.com':443
'bi###sh8.com':80
'up####.180308.com':80

TCP

HTTP GET requests

http://www.go#####a###ytics.com/collect?v=#######################################################################################################################################################...
http://sh###.baidu.com/api/openapi/json_get_full_down_url_v4/30450

Other

'co####.edge.skype.com':443
'localhost':49710
'localhost':49711

UDP

DNS ASK up####.aiqingzhihui.com
DNS ASK xu#.###ogin2.tenpay.com
DNS ASK go#####a###ytics.com
DNS ASK rp.#v.cc
DNS ASK m1.##5668.com
DNS ASK m1.##0308.com
DNS ASK tj.###ingzhihui.com
DNS ASK p.#.#aidu.com
DNS ASK sh###.baidu.com
DNS ASK rc.#####oad.iyuntian.com
DNS ASK cf#.####load.iyuntian.com
DNS ASK ut#.####load.iyuntian.com
DNS ASK dt##.###nload.iyuntian.com
DNS ASK tk.#####oad.iyuntian.com
DNS ASK jp.#####oad.iyuntian.com
DNS ASK sn.#####oad.iyuntian.com
DNS ASK re#.####load.iyuntian.com
DNS ASK re##.###nload.iyuntian.com
DNS ASK tj.#uji.com
DNS ASK tj#.##invying.net
DNS ASK tv.###ingzhihui.com
DNS ASK we#.##invying.net
DNS ASK wj.#uji.com
DNS ASK up###e.wuji.com
DNS ASK cl####.035668.com
DNS ASK cl####.180308.com
DNS ASK ad###ndun.com
DNS ASK co####.edge.skype.com
DNS ASK bi###sh8.com
DNS ASK up####.035668.com
DNS ASK up####.180308.com
DNS ASK tj###.meinvying.net

Miscellaneous

Searches for the following windows

ClassName: 'OnLineWnd' WindowName: ''
ClassName: '#32770' WindowName: '广告神盾'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'TMeiNvYMainForm' WindowName: ''
ClassName: 'THtmFormShow' WindowName: ''
ClassName: 'TFormMini' WindowName: ''
ClassName: 'TFormTips' WindowName: ''
ClassName: 'TFormLoginTips' WindowName: ''
ClassName: 'TFormHuodongMini' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: '' WindowName: ''
ClassName: '' WindowName: 'Microsoft Internet Explorer'
ClassName: 'WujiPlayer' WindowName: 'ГЋГћВјВ«Г“В°Г’Гґ'
ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
ClassName: 'MS_WINHELP' WindowName: ''

Creates and executes the following

'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1716082 "__IRAFN:<Full path to file>" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-4226853953-3309226944-3078887307-1000"
'%TEMP%\nsp6118.tmp\meinvying.exe' /fix
'%ProgramFiles(x86)%\azh2.3\zhihui2.3.exe'
'%ProgramFiles(x86)%\azh2.3\zhtray.exe' /s
'%APPDATA%\ot\mantray.exe'
'%ProgramFiles(x86)%\meinvying\meinvying.exe' /A
'%ProgramFiles(x86)%\meinvying\meinvying.exe'
'%ProgramFiles(x86)%\wjplay2\20260316152549\wjplay.exe' -mini
'%ProgramFiles(x86)%\广告神盾\adshield.exe' tray
'%ProgramFiles(x86)%\wjplay2\20260316152549\wjspeed.exe'
'%APPDATA%\ot\mtup.exe' -uploaddata
'%APPDATA%\ot\mtad.exe'
'%ProgramFiles(x86)%\广告神盾\server\adshieldserver.exe' proxy.js -a
'%APPDATA%\ot\mtup.exe' -update

Executes the following

'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.bitfish8.com/
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.bitfish8.com/
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\广告神盾\adclear.bat" "
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\广告神盾\server\...
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,16748686044753253877,14466744085928576885,131072 --lang=en-US --service-sandbox-type=none --mojo...
'%APPDATA%\ot\mantray.exe' ' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /F /im mvhd.exe' (with hidden window)
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.bitfish8.com/' (with hidden window)
'%APPDATA%\ot\mtup.exe' -uploaddata' (with hidden window)
'%APPDATA%\ot\mtad.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles(x86)%\广告神盾\adclear.bat" "' (with hidden window)
'%ProgramFiles(x86)%\广告神盾\server\adshieldserver.exe' proxy.js -a' (with hidden window)
'%APPDATA%\ot\mtup.exe' -update' (with hidden window)

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial