Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb0e-a84.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb0f-7e4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb0f-508.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb10-8a4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb12-488.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb14-518.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb16-3d4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb1e-cc4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb1e-ec4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f2bb1e-c10.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f237fe-138c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f23802-a74.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f23802-11c0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f23802-13f8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f23802-1308.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f23803-65c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68f23803-120c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3cfbeb6a5c2ec626_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a9b7a3e2f0f20e98_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\28a48891b2957019_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0dff7b0f9327754f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\23d875217cf4693b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\39e34a39ae6371dc_0
- %TEMP%\fd85f6e2-26ae-4d2d-9cb8-b23ac9ffdf10.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\db7adf00858d3a4c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9cdb4b4ff9074881_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ed5c687e1b764b1e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\be265a5af05b16c2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5a19b0261b47b5e1_0
- %TEMP%\fa86b503-5579-4bc1-bc55-e71952c4c7d3.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f0701477a9c9e0d0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6837d1e575b6f996_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3a440cb389826768_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0d401c586f5f7442_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\grshadercache\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %TEMP%\.ses
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'co####.edge.skype.com':443
- 'sp######012.blog.163.com':80
- 'os.##og.163.com':80
- 'sh####.ydstatic.com':80
- 'ur#####j.nosdn.127.net':80
- 'b1.##t.126.net':80
- 'q.###g.163.com':80
- 'ur#####j.nosdn.127.net':443
- 'ca####s.digicert.cn':80
- 't.##3.com':80
- 'ap#.##og.163.com':80
- 'ph###.163.com':80
- 'go####.youdao.com':80
- 't.##3.com':443
- 'ji####jy.lofter.com':80
- 'ph###.163.com':443
- 'b.###.126.net':80
- 'go#####a###ytics.com':80
- 'xh#####r.blog.163.com':80
- 'im####.lf127.net':443
- 'go#####a###ytics.com':443
- 'pk#.goog':80
- 'yt####.ws.126.net':443
TCP
HTTP GET requests
- http://sh####.ydstatic.com/js/yadk/1.1.1.js
- http://ur#####j.nosdn.127.net/webzj_cdn101/message.js
- http://ca####s.digicert.cn/DigiCertGlobalRootCA.crt
- http://www.go#####a###ytics.com/a###ytics.js
- http://pk#.goog/gsr1/gsr1.crt
- http://b.###.126.net/newpage/style/mbox/6/img/background.gif
HTTP POST requests
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/MusicBeanNew.setCopyrightMusicSessionToken.dwr
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/SetupBeanNew.getResourceModulesData.dwr
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/HomeBeanNew.getAccessStatistics.dwr
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/UserBeanNew.getVisitor.dwr
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/BlogBeanNew.getRecentCommentsByOffset.dwr
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/MusicBeanNew.getPlayList.dwr
- http://ap#.##og.163.com/sphrbeu2012/dwr/call/plaincall/BlogBeanNew.getBlogClasses.dwr
- http://ap#.##og.163.com/bgs/dwr/call/plaincall/BgsBean.getBgsUserByUserId.dwr
Other
- 'co####.edge.skype.com':443
- 'ur#####j.nosdn.127.net':443
- 't.##3.com':443
- 'ph###.163.com':443
- 'ca####s.digicert.cn':443
- 'go#####a###ytics.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK sp######012.blog.163.com
- DNS ASK os.##og.163.com
- DNS ASK b2.##t.126.net
- DNS ASK sh####.ydstatic.com
- DNS ASK ma##.163.com
- DNS ASK ji####jy.lofter.com
- DNS ASK bl##.163.com
- DNS ASK mu###.163.com
- DNS ASK q.###g.163.com
- DNS ASK ur#####j.nosdn.127.net
- DNS ASK b1.##t.126.net
- DNS ASK lo##er.com
- DNS ASK yx#.163.com
- DNS ASK zc.##g.163.com
- DNS ASK ca####s.digicert.cn
- DNS ASK ap#.##og.163.com
- DNS ASK ph###.163.com
- DNS ASK t.##3.com
- DNS ASK go####.youdao.com
- DNS ASK b.###.126.net
- DNS ASK cy#####xiyue.lofter.com
- DNS ASK im####.lofter.com
- DNS ASK qi#######gyue84037.lofter.com
- DNS ASK go#####a###ytics.com
- DNS ASK be######iao.blog.163.com
- DNS ASK ch#####wyc.blog.163.com
- DNS ASK ha#.#.blog.163.com
- DNS ASK hm#####.blog.163.com
- DNS ASK hy#####.blog.163.com
- DNS ASK qt##.#log.163.com
- DNS ASK in#####.blog.163.com
- DNS ASK re#####25.blog.163.com
- DNS ASK sn######line1.blog.163.com
- DNS ASK wa#####812.blog.163.com
- DNS ASK wh#####.blog.163.com
- DNS ASK x3#####g.blog.163.com
- DNS ASK xh#####r.blog.163.com
- DNS ASK ax##ei.com
- DNS ASK he##.com
- DNS ASK yo######09582752.lofter.com
- DNS ASK yu######uan16720.lofter.com
- DNS ASK xi######iaomao.lofter.com
- DNS ASK im####.lf127.net
- DNS ASK wi###itong.cn
- DNS ASK g.##3.com
- DNS ASK pk#.goog
- DNS ASK yt####.ws.126.net
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://sphrbeu2012.blog.163.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://sphrbeu2012.blog.163.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://sphrbeu2012.blog.163.com/' (with hidden window)
