Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- C:\audax_debug.log
- conout$
- %TEMP%\svc_keys.bin
- %TEMP%\svc_rdp.log
- %TEMP%\ax_edge_1113796\crashpadmetrics-active.pma
- %TEMP%\ax_edge_1113796\crashpadmetrics.pma
- %TEMP%\ax_edge_1113796\functional data
- %TEMP%\ax_edge_1113796\functional san data
- %TEMP%\ax_edge_1113796\last version
- %TEMP%\ax_edge_1113796\local state
- %TEMP%\ax_edge_1113796\browsermetrics\browsermetrics-66b96068-2f8.pma
- %TEMP%\ax_edge_1113796\browsermetrics\browsermetrics-6aabb320-db4.pma
- %TEMP%\ax_edge_1113796\crashpad\settings.dat
- %TEMP%\ax_edge_1113796\crashpad\throttle_store.dat
- %TEMP%\ax_edge_1113796\default\edge profile.ico
- %TEMP%\ax_edge_1113796\default\favicons
- %TEMP%\ax_edge_1113796\default\history
- %TEMP%\ax_edge_1113796\default\login data
- %TEMP%\ax_edge_1113796\default\media history
- %TEMP%\ax_edge_1113796\default\network persistent state
- %TEMP%\svc_okkxhp_user_7ae68385\system\info.txt
- %TEMP%\ax_edge_1113796\default\preferences
- %TEMP%\ax_edge_1113796\default\readme
- %TEMP%\ax_edge_1113796\default\secure preferences
- %TEMP%\ax_edge_1113796\default\top sites
- %TEMP%\ax_edge_1113796\default\visited links
- %TEMP%\ax_edge_1113796\default\web data
- %TEMP%\ax_edge_1113796\default\local storage\leveldb\current
- %TEMP%\ax_edge_1113796\default\local storage\leveldb\log
- %TEMP%\ax_edge_1113796\default\local storage\leveldb\manifest-000001
- %TEMP%\ax_edge_1113796\default\platform notifications\current
- %TEMP%\ax_edge_1113796\default\platform notifications\log
- %TEMP%\ax_edge_1113796\default\platform notifications\manifest-000001
- %TEMP%\ax_edge_1113796\default\site characteristics database\000003.log
- %TEMP%\ax_edge_1113796\default\site characteristics database\current
- %TEMP%\ax_edge_1113796\default\site characteristics database\log
- %TEMP%\ax_edge_1113796\default\site characteristics database\log.old
- %TEMP%\ax_edge_1113796\default\site characteristics database\manifest-000001
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\000003.log
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\current
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\log
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\log.old
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\manifest-000001
- %TEMP%\ax_edge_1113796\smartscreen\local\cache
- %TEMP%\ax_edge_1113796\smartscreen\local\download_cache
- %TEMP%\ax_edge_1113796\smartscreen\local\warnstatecache
- %TEMP%\ax_edge_1113796\devtoolsactiveport
- %TEMP%\ax_edge_1113796\default\chrome_debug.log
- %TEMP%\ax_edge_1113796\default\code cache\js\index
- %TEMP%\ax_edge_1113796\default\code cache\wasm\index
- %TEMP%\ax_edge_1113796\default\gpucache\index
- %TEMP%\ax_edge_1113796\default\gpucache\data_0
- %TEMP%\ax_edge_1113796\default\gpucache\data_1
- %TEMP%\ax_edge_1113796\default\gpucache\data_2
- %TEMP%\ax_edge_1113796\default\gpucache\data_3
- %TEMP%\ax_edge_1113796\default\code cache\js\index-dir\temp-index
- %TEMP%\ax_edge_1113796\default\code cache\wasm\index-dir\temp-index
- %TEMP%\ax_edge_1113796\default\cookies-journal
- %TEMP%\ax_edge_1113796\default\cookies
- %TEMP%\ax_login_edge.db
- %TEMP%\ax_756e39ba.dll
- %TEMP%\svc_dll.log
- %TEMP%\ax_1132968_login data
- %TEMP%\ax_1133000_web data
- %TEMP%\ax_1133031_cookies
- %TEMP%\ax_1133031_login data
- %TEMP%\ax_1133062_cookies
- %TEMP%\ax_1133078_web data
- %TEMP%\ax_1133093_web data
- %TEMP%\svc_out\keys\v10.txt
- %TEMP%\ax_1133125_login data
- %TEMP%\ax_1133140_web data
- %TEMP%\ax_1133156_login data
- %TEMP%\ax_1133171_web data
- %TEMP%\ax_1133187_web data
- %TEMP%\svc_out\summary.txt
- %TEMP%\svc_okkxhp_user_7ae68385\keys\v10.txt
- %TEMP%\svc_okkxhp_user_7ae68385\summary.txt
- %TEMP%\svc_e705cbb9b0b3b07b.zip
Deletes following files that it created itself
- %TEMP%\ax_edge_1113796\browsermetrics\browsermetrics-66b96068-2f8.pma
- %TEMP%\ax_edge_1113796\browsermetrics\browsermetrics-6aabb320-db4.pma
- %TEMP%\ax_edge_1113796\crashpad\settings.dat
- %TEMP%\ax_edge_1113796\crashpad\throttle_store.dat
- %TEMP%\ax_edge_1113796\crashpadmetrics-active.pma
- %TEMP%\ax_edge_1113796\crashpadmetrics.pma
- %TEMP%\ax_edge_1113796\default\chrome_debug.log
- %TEMP%\ax_edge_1113796\default\code cache\js\index
- %TEMP%\ax_edge_1113796\default\code cache\js\index-dir\the-real-index
- %TEMP%\ax_edge_1113796\default\code cache\wasm\index
- %TEMP%\ax_edge_1113796\default\code cache\wasm\index-dir\the-real-index
- %TEMP%\ax_edge_1113796\default\cookies
- %TEMP%\ax_edge_1113796\default\cookies-journal
- %TEMP%\ax_edge_1113796\default\edge profile.ico
- %TEMP%\ax_edge_1113796\default\favicons
- %TEMP%\ax_edge_1113796\default\gpucache\data_0
- %TEMP%\ax_edge_1113796\default\gpucache\data_1
- %TEMP%\ax_edge_1113796\default\gpucache\data_2
- %TEMP%\ax_edge_1113796\default\gpucache\data_3
- %TEMP%\ax_edge_1113796\default\gpucache\index
- %TEMP%\ax_edge_1113796\default\history
- %TEMP%\ax_edge_1113796\default\local storage\leveldb\current
- %TEMP%\ax_edge_1113796\default\local storage\leveldb\log
- %TEMP%\ax_edge_1113796\default\local storage\leveldb\manifest-000001
- %TEMP%\ax_edge_1113796\default\login data
- %TEMP%\ax_edge_1113796\default\media history
- %TEMP%\ax_edge_1113796\default\network persistent state
- %TEMP%\ax_edge_1113796\default\platform notifications\current
- %TEMP%\ax_edge_1113796\default\platform notifications\log
- %TEMP%\ax_edge_1113796\default\platform notifications\manifest-000001
- %TEMP%\ax_edge_1113796\default\preferences
- %TEMP%\ax_edge_1113796\default\readme
- %TEMP%\ax_edge_1113796\default\secure preferences
- %TEMP%\ax_edge_1113796\default\site characteristics database\000003.log
- %TEMP%\ax_edge_1113796\default\site characteristics database\current
- %TEMP%\ax_edge_1113796\default\site characteristics database\log
- %TEMP%\ax_edge_1113796\default\site characteristics database\log.old
- %TEMP%\ax_edge_1113796\default\site characteristics database\manifest-000001
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\000003.log
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\current
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\log
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\log.old
- %TEMP%\ax_edge_1113796\default\sync data\leveldb\manifest-000001
- %TEMP%\ax_edge_1113796\default\top sites
- %TEMP%\ax_edge_1113796\default\visited links
- %TEMP%\ax_edge_1113796\default\web data
- %TEMP%\ax_edge_1113796\devtoolsactiveport
- %TEMP%\ax_edge_1113796\functional data
- %TEMP%\ax_edge_1113796\functional san data
- %TEMP%\ax_edge_1113796\last version
- %TEMP%\ax_edge_1113796\local state
- %TEMP%\ax_edge_1113796\smartscreen\local\cache
- %TEMP%\ax_edge_1113796\smartscreen\local\download_cache
- %TEMP%\ax_edge_1113796\smartscreen\local\warnstatecache
- %TEMP%\ax_1132968_login data
- %TEMP%\ax_1133000_web data
- %TEMP%\ax_1133031_cookies
- %TEMP%\ax_1133031_login data
- %TEMP%\ax_1133062_cookies
- %TEMP%\ax_1133078_web data
- %TEMP%\ax_1133093_web data
- %TEMP%\ax_1133125_login data
- %TEMP%\ax_1133140_web data
- %TEMP%\ax_1133156_login data
- %TEMP%\ax_1133171_web data
- %TEMP%\ax_1133187_web data
- %TEMP%\svc_out\keys\v10.txt
- %TEMP%\svc_out\summary.txt
- %TEMP%\ax_756e39ba.dll
- %TEMP%\svc_e705cbb9b0b3b07b.zip
- %TEMP%\svc_okkxhp_user_7ae68385\keys\v10.txt
- %TEMP%\svc_okkxhp_user_7ae68385\summary.txt
- %TEMP%\svc_okkxhp_user_7ae68385\system\info.txt
Moves the following files
- from %TEMP%\ax_edge_1113796\default\code cache\js\index-dir\temp-index to %TEMP%\ax_edge_1113796\default\code cache\js\index-dir\the-real-index
- from %TEMP%\ax_edge_1113796\default\code cache\wasm\index-dir\temp-index to %TEMP%\ax_edge_1113796\default\code cache\wasm\index-dir\the-real-index
Network activity
Connects to
- 'ap#.#pify.org':80
- 'localhost':9796
- 'localhost':8089
TCP
HTTP GET requests
- http://ap#.#pify.org/
Other
- 'localhost':49698
- 'localhost':49699
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Executes the following
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c robocopy "%LOCALAPPDATA%\Microsoft\Edge\User Data" "%TEMP%\ax_Edge_1113796" /E /R:1 /W:1 /XF "*.lock" /XD "Cache" "Code Cache" "Service Worker" "GPUCache" "ShaderCache" 2>&1
- '<SYSTEM32>\robocopy.exe' "%LOCALAPPDATA%\Microsoft\Edge\User Data" "%TEMP%\ax_Edge_1113796" /E /R:1 /W:1 /XF "*.lock" /XD "Cache" "Code Cache" "Service Worker" "GPUCache" "ShaderCache"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --remote-debugging-port=9796 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-features=IsolateOrigins,site-per-process --disable-features=EncryptionEnabled --disable...
- '<SYSTEM32>\netsh.exe' wlan show profiles' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c robocopy "%LOCALAPPDATA%\Microsoft\Edge\User Data" "%TEMP%\ax_Edge_1113796" /E /R:1 /W:1 /XF "*.lock" /XD "Cache" "Code Cache" "Service Worker" "GPUCache" "ShaderCache" 2>&1' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --remote-debugging-port=9796 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-features=IsolateOrigins,site-per-process --disable-features=EncryptionEnabled --disable...' (with hidden window)
