Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\svc_keys.bin
- %TEMP%\svc_rdp.log
- %TEMP%\ax_edge_921750\crashpadmetrics-active.pma
- %TEMP%\ax_edge_921750\functional data
- %TEMP%\ax_edge_921750\functional san data
- %TEMP%\ax_edge_921750\last browser
- %TEMP%\ax_edge_921750\last version
- %TEMP%\ax_edge_921750\local state
- %TEMP%\ax_edge_921750\browsermetrics\browsermetrics-6aab4a7a-115c.pma
- %TEMP%\ax_edge_921750\crashpad\settings.dat
- %TEMP%\ax_edge_921750\crashpad\throttle_store.dat
- %TEMP%\ax_edge_921750\default\edge profile.ico
- %TEMP%\ax_edge_921750\default\favicons
- %TEMP%\ax_edge_921750\default\heavy_ad_intervention_opt_out.db
- %TEMP%\ax_edge_921750\default\history
- %TEMP%\ax_edge_921750\default\login data
- %TEMP%\ax_edge_921750\default\media history
- %TEMP%\ax_edge_921750\default\network persistent state
- %TEMP%\ax_edge_921750\default\preferences
- %TEMP%\ax_edge_921750\default\preferredapps
- %TEMP%\ax_edge_921750\default\previews_opt_out.db
- %TEMP%\ax_edge_921750\default\readme
- %TEMP%\ax_edge_921750\default\secure preferences
- %TEMP%\ax_edge_921750\default\top sites
- %TEMP%\ax_edge_921750\default\visited links
- %TEMP%\ax_edge_921750\default\web data
- %TEMP%\ax_edge_921750\default\budgetdatabase\current
- %TEMP%\ax_edge_921750\default\budgetdatabase\log
- %TEMP%\ax_edge_921750\default\budgetdatabase\manifest-000001
- %TEMP%\svc_ssobec_user_d7081c77\system\info.txt
- %TEMP%\ax_edge_921750\default\data_reduction_proxy_leveldb\current
- %TEMP%\ax_edge_921750\default\data_reduction_proxy_leveldb\log
- %TEMP%\ax_edge_921750\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\ax_edge_921750\default\local storage\leveldb\current
- %TEMP%\ax_edge_921750\default\local storage\leveldb\log
- %TEMP%\ax_edge_921750\default\local storage\leveldb\manifest-000001
- %TEMP%\ax_edge_921750\default\platform notifications\current
- %TEMP%\ax_edge_921750\default\platform notifications\log
- %TEMP%\ax_edge_921750\default\platform notifications\manifest-000001
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\000003.log
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\current
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\log
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\ax_edge_921750\default\site characteristics database\000003.log
- %TEMP%\ax_edge_921750\default\site characteristics database\current
- %TEMP%\ax_edge_921750\default\site characteristics database\log
- %TEMP%\ax_edge_921750\default\site characteristics database\log.old
- %TEMP%\ax_edge_921750\default\site characteristics database\manifest-000001
- %TEMP%\ax_edge_921750\default\sync data\leveldb\000003.log
- %TEMP%\ax_edge_921750\default\sync data\leveldb\current
- %TEMP%\ax_edge_921750\default\sync data\leveldb\log
- %TEMP%\ax_edge_921750\default\sync data\leveldb\log.old
- %TEMP%\ax_edge_921750\default\sync data\leveldb\manifest-000001
- %TEMP%\ax_edge_921750\smartscreen\local\cache
- %TEMP%\ax_edge_921750\smartscreen\local\download_cache
- %TEMP%\ax_edge_921750\smartscreen\local\warnstatecache
- %TEMP%\ax_edge_921750\devtoolsactiveport
- %TEMP%\ax_edge_921750\default\chrome_debug.log
- %TEMP%\ax_edge_921750\default\code cache\wasm\index
- %TEMP%\ax_edge_921750\default\code cache\js\index
- %TEMP%\ax_edge_921750\default\gpucache\index
- %TEMP%\ax_edge_921750\default\gpucache\data_0
- %TEMP%\ax_edge_921750\default\gpucache\data_1
- %TEMP%\ax_edge_921750\default\gpucache\data_2
- %TEMP%\ax_edge_921750\default\gpucache\data_3
- %TEMP%\ax_edge_921750\default\code cache\wasm\index-dir\temp-index
- %TEMP%\ax_edge_921750\default\code cache\js\index-dir\temp-index
- %TEMP%\ax_edge_921750\default\cookies-journal
- %TEMP%\ax_edge_921750\default\cookies
- %TEMP%\ax_login_edge.db
- %TEMP%\ax_6bdbdad4.dll
- %TEMP%\svc_dll.log
- %TEMP%\ax_941812_login data
- %TEMP%\ax_941875_web data
- %TEMP%\ax_941921_cookies
- %TEMP%\ax_941953_login data
- %TEMP%\ax_942000_cookies
- %TEMP%\ax_942000_web data
- %TEMP%\ax_942046_web data
- %TEMP%\svc_out\keys\v10.txt
- %TEMP%\ax_942078_login data
- %TEMP%\ax_942093_web data
- %TEMP%\ax_942140_login data
- %TEMP%\ax_942140_web data
- %TEMP%\ax_942187_web data
- %TEMP%\svc_out\summary.txt
- %TEMP%\svc_ssobec_user_d7081c77\keys\v10.txt
- %TEMP%\svc_ssobec_user_d7081c77\summary.txt
- %TEMP%\svc_5356c4ee98b003c4.zip
Deletes following files that it created itself
- %TEMP%\ax_edge_921750\browsermetrics\browsermetrics-6aab4a7a-115c.pma
- %TEMP%\ax_edge_921750\crashpad\settings.dat
- %TEMP%\ax_edge_921750\crashpad\throttle_store.dat
- %TEMP%\ax_edge_921750\crashpadmetrics.pma
- %TEMP%\ax_edge_921750\default\budgetdatabase\current
- %TEMP%\ax_edge_921750\default\budgetdatabase\log
- %TEMP%\ax_edge_921750\default\budgetdatabase\manifest-000001
- %TEMP%\ax_edge_921750\default\chrome_debug.log
- %TEMP%\ax_edge_921750\default\code cache\js\index
- %TEMP%\ax_edge_921750\default\code cache\js\index-dir\the-real-index
- %TEMP%\ax_edge_921750\default\code cache\wasm\index
- %TEMP%\ax_edge_921750\default\code cache\wasm\index-dir\the-real-index
- %TEMP%\ax_edge_921750\default\cookies
- %TEMP%\ax_edge_921750\default\cookies-journal
- %TEMP%\ax_edge_921750\default\data_reduction_proxy_leveldb\current
- %TEMP%\ax_edge_921750\default\data_reduction_proxy_leveldb\log
- %TEMP%\ax_edge_921750\default\data_reduction_proxy_leveldb\manifest-000002
- %TEMP%\ax_edge_921750\default\edge profile.ico
- %TEMP%\ax_edge_921750\default\favicons
- %TEMP%\ax_edge_921750\default\gpucache\data_0
- %TEMP%\ax_edge_921750\default\gpucache\data_1
- %TEMP%\ax_edge_921750\default\gpucache\data_2
- %TEMP%\ax_edge_921750\default\gpucache\data_3
- %TEMP%\ax_edge_921750\default\gpucache\index
- %TEMP%\ax_edge_921750\default\heavy_ad_intervention_opt_out.db
- %TEMP%\ax_edge_921750\default\history
- %TEMP%\ax_edge_921750\default\local storage\leveldb\current
- %TEMP%\ax_edge_921750\default\local storage\leveldb\log
- %TEMP%\ax_edge_921750\default\local storage\leveldb\manifest-000001
- %TEMP%\ax_edge_921750\default\login data
- %TEMP%\ax_edge_921750\default\media history
- %TEMP%\ax_edge_921750\default\network persistent state
- %TEMP%\ax_edge_921750\default\platform notifications\current
- %TEMP%\ax_edge_921750\default\platform notifications\log
- %TEMP%\ax_edge_921750\default\platform notifications\manifest-000001
- %TEMP%\ax_edge_921750\default\preferences
- %TEMP%\ax_edge_921750\default\preferredapps
- %TEMP%\ax_edge_921750\default\previews_opt_out.db
- %TEMP%\ax_edge_921750\default\readme
- %TEMP%\ax_edge_921750\default\secure preferences
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\000003.log
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\current
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\log
- %TEMP%\ax_edge_921750\default\shared_proto_db\metadata\manifest-000001
- %TEMP%\ax_edge_921750\default\site characteristics database\000003.log
- %TEMP%\ax_edge_921750\default\site characteristics database\current
- %TEMP%\ax_edge_921750\default\site characteristics database\log
- %TEMP%\ax_edge_921750\default\site characteristics database\log.old
- %TEMP%\ax_edge_921750\default\site characteristics database\manifest-000001
- %TEMP%\ax_edge_921750\default\sync data\leveldb\000003.log
- %TEMP%\ax_edge_921750\default\sync data\leveldb\current
- %TEMP%\ax_edge_921750\default\sync data\leveldb\log
- %TEMP%\ax_edge_921750\default\sync data\leveldb\log.old
- %TEMP%\ax_edge_921750\default\sync data\leveldb\manifest-000001
- %TEMP%\ax_edge_921750\default\top sites
- %TEMP%\ax_edge_921750\default\visited links
- %TEMP%\ax_edge_921750\default\web data
- %TEMP%\ax_edge_921750\devtoolsactiveport
- %TEMP%\ax_edge_921750\functional data
- %TEMP%\ax_edge_921750\functional san data
- %TEMP%\ax_edge_921750\last browser
- %TEMP%\ax_edge_921750\last version
- %TEMP%\ax_edge_921750\local state
- %TEMP%\ax_edge_921750\smartscreen\local\cache
- %TEMP%\ax_edge_921750\smartscreen\local\download_cache
- %TEMP%\ax_edge_921750\smartscreen\local\warnstatecache
- %TEMP%\ax_941812_login data
- %TEMP%\ax_941875_web data
- %TEMP%\ax_941921_cookies
- %TEMP%\ax_941953_login data
- %TEMP%\ax_942000_cookies
- %TEMP%\ax_942000_web data
- %TEMP%\ax_942046_web data
- %TEMP%\ax_942078_login data
- %TEMP%\ax_942093_web data
- %TEMP%\ax_942140_login data
- %TEMP%\ax_942140_web data
- %TEMP%\ax_942187_web data
- %TEMP%\svc_out\keys\v10.txt
- %TEMP%\svc_out\summary.txt
- %TEMP%\ax_6bdbdad4.dll
- %TEMP%\svc_5356c4ee98b003c4.zip
- %TEMP%\svc_ssobec_user_d7081c77\keys\v10.txt
- %TEMP%\svc_ssobec_user_d7081c77\summary.txt
- %TEMP%\svc_ssobec_user_d7081c77\system\info.txt
Moves the following files
- from %TEMP%\ax_edge_921750\crashpadmetrics-active.pma to %TEMP%\ax_edge_921750\crashpadmetrics.pma
- from %TEMP%\ax_edge_921750\default\code cache\wasm\index-dir\temp-index to %TEMP%\ax_edge_921750\default\code cache\wasm\index-dir\the-real-index
- from %TEMP%\ax_edge_921750\default\code cache\js\index-dir\temp-index to %TEMP%\ax_edge_921750\default\code cache\js\index-dir\the-real-index
Substitutes the following files
- %TEMP%\ax_edge_921750\crashpadmetrics-active.pma
Network activity
Connects to
- 'ap#.#pify.org':80
- 'localhost':9750
- 'localhost':8089
TCP
HTTP GET requests
- http://ap#.#pify.org/
Other
- 'localhost':49697
- 'localhost':49698
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Executes the following
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c robocopy "%LOCALAPPDATA%\Microsoft\Edge\User Data" "%TEMP%\ax_Edge_921750" /E /R:1 /W:1 /XF "*.lock" /XD "Cache" "Code Cache" "Service Worker" "GPUCache" "ShaderCache" 2>&1
- '<SYSTEM32>\robocopy.exe' "%LOCALAPPDATA%\Microsoft\Edge\User Data" "%TEMP%\ax_Edge_921750" /E /R:1 /W:1 /XF "*.lock" /XD "Cache" "Code Cache" "Service Worker" "GPUCache" "ShaderCache"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --remote-debugging-port=9750 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-features=IsolateOrigins,site-per-process --disable-features=EncryptionEnabled --disable...
- '<SYSTEM32>\netsh.exe' wlan show profiles' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c robocopy "%LOCALAPPDATA%\Microsoft\Edge\User Data" "%TEMP%\ax_Edge_921750" /E /R:1 /W:1 /XF "*.lock" /XD "Cache" "Code Cache" "Service Worker" "GPUCache" "ShaderCache" 2>&1' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --remote-debugging-port=9750 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-features=IsolateOrigins,site-per-process --disable-features=EncryptionEnabled --disable...' (with hidden window)
