Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240520\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\aad40wh[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\bbo3aug[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\bb156afc[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\aac9vhk[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\aac9dpu[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\msimgsiz.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\96664fa8619f9d65bb0bfd4ff653da7c_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\e2c6cbaf0af08cf203ba74bf0d0ab6d5_cbdccbfe4f7a916411c1e69bdd97bb04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_cbdccbfe4f7a916411c1e69bdd97bb04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\8.4afc41bd922db2692762[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\conditionalbanner.56094bd1813102189372[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\bbkvxnk[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\river-feed.ae3dae95d95f7e4c6530[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\topic-data.9122c25159afd52c051b[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\iris-data-connnector.08994c0de46d3d4e8cd0[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\aazobni[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\showfeed.876d1b9a714f071957cd[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\weather-card.c6cef55d540a2f97de22[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\native-ad.1238efed9d6663e6cd5a[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\all23ff.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_f9e4dc0b9d5c777357d7db8def51118a
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_f9e4dc0b9d5c777357d7db8def51118a
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_c0427f5f77d9b3a439fc620edaab6177
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\microsoft.8aa91a5fe4f5d8517ae1[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_c0427f5f77d9b3a439fc620edaab6177
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\user-profile-display.3f2029dddf02ce5fe4e7[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\feedbacklink.5475db40602c075e0172[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\pagesettings.bb435d36341a2ef34a3a[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\breaking-news.d11fb0f65233cc7311d2[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\card-action.2ad3cec190aef8ec85f4[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\onefooter.982b320cf4a2a85e7315[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\pivots-nav.fada94a36efa9191ecc0[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\topsites.a339bbcb9841b908ff57[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\bannermanager.0a0ecda75bc311f70c4e[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\eea658139b1f4714acd794ff5e5c8408_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\fave233.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\user\default\domstore\qmj1kgp5\isols[1].xml
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240520\microsoftedgecookiesbackup.dat
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240520\protected - it is a violation of windows policy to modify\backup.dat
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240520\microsoftedgesettingsbackup.txt
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240520\schema.txt.~tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240520\edb00001.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\b2faf7692fd9ffbd64ede317e42334ba_2dbe917624e9880fe0c7c5570d56e691
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\domstore\5mf6usof\www.msn[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\b2faf7692fd9ffbd64ede317e42334ba_2dbe917624e9880fe0c7c5570d56e691
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\5080dc7a65db6a5960ecd874088f3328_862ba1770b2fee013603d2ff9abeafda
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\e82u6k45\pivot-content.b6fb2ee68a27298082a9[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\5080dc7a65db6a5960ecd874088f3328_862ba1770b2fee013603d2ff9abeafda
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\appcache\bm0aoabi\1\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\205vuwkq\config[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\appcache\bm0aoabi\1\appcache[1].man
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\vendors.c47bf4f4981f23895ddb[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\e2c6cbaf0af08cf203ba74bf0d0ab6d5_6372e0472aff76bb926c97818bc773b9
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_6372e0472aff76bb926c97818bc773b9
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3zx6s7pn\weather-data-connector.682c31544bc49f2ce3c9[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\0255cec2c51d081eff40366512890989_6ef66971c423917c6f7d650dc6c1f822
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\0255cec2c51d081eff40366512890989_6ef66971c423917c6f7d650dc6c1f822
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\o2f5v26c\common.5dd7cff85de67632bfd7[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\user\default\domstore\ashu79yu\microsoft[1].xml
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.jfm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edb.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edbtmp.log
Substitutes the following files
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Network activity
Connects to
- 'is##s.co':80
- 'ms#.com':443
- 'is##s.co':443
- '45.##.137.187':80
- 'im######n-com.akamaized.net':443
TCP
HTTP GET requests
- http://is##s.co/zXTgU
- http://is##s.co/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?ws#############
- http://is##s.co/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?ws##############
- http://is##s.co/favicon.ico
- http://45.##.137.187/40800/gbh/pinapplebeautiumagewhicheveryoneloveandfeelgreatbeacuseimagequalityisveryniceandgreatitsgtrulygoodfortosee__girlsneedpinappleforkiss.doc
Other
- 'ms#.com':443
- 'is##s.co':443
- 'as###s.msn.com':443
- 'br#####.events.data.msn.com':443
- 'ar#.msn.com':443
- 'im######n-com.akamaized.net':443
UDP
- DNS ASK is##s.co
- DNS ASK ms#.com
- DNS ASK im######n-com.akamaized.net
- DNS ASK sb.#####cardresearch.com
- DNS ASK ap#.msn.com
- DNS ASK as###s.msn.com
- DNS ASK c.##n.com
- DNS ASK br#####.events.data.msn.com
- DNS ASK ar#.msn.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\systemapps\microsoft.microsoftedge_8wekyb3d8bbwe\microsoftedge.exe' -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
- '<SYSTEM32>\microsoftedgecp.exe' -ServerName:Windows.Internal.WebRuntime.ContentProcessServer
