Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_44b7cec7d7846ba12d21890d7af2d759
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\fav29bb.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\imagestore\xo3byb0\imagestore.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\9p1k5c4j\common.5dd7cff85de67632bfd7[1].js
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20230810\protected - it is a violation of windows policy to modify\backup.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\9p1k5c4j\microsoft.8aa91a5fe4f5d8517ae1[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\domstore\hni5lrkh\www.msn[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\xtse1v9a\web-worker.440858f9fe4973b6d967[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\soksp1gt\config[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\96664fa8619f9d65bb0bfd4ff653da7c_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_711ed44619924ba6dc33e69f97e7ff63
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_711ed44619924ba6dc33e69f97e7ff63
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\3d58tcbn\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\eea658139b1f4714acd794ff5e5c8408_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\dcd0d75871dde826855f6ae0ffc4ca06_646f4a6ae428a6e79b39265ed6577b84
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\dcd0d75871dde826855f6ae0ffc4ca06_646f4a6ae428a6e79b39265ed6577b84
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20230810\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20230810\edb00001.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20230810\schema.txt.~tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\all5e1a.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\9p1k5c4j\vendors.c47bf4f4981f23895ddb[1].js
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20230810\microsoftedgesettingsbackup.txt
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20230810\microsoftedgecookiesbackup.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\kea97o9a\ynec3jvy[1].txt
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_711ed44619924ba6dc33e69f97e7ff63
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\6bada8974a10c4bd62cc921d13e43b18_711ed44619924ba6dc33e69f97e7ff63
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\user\default\domstore\ehs9y3ud\pastebin[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_44b7cec7d7846ba12d21890d7af2d759
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\6bada8974a10c4bd62cc921d13e43b18_28dea62a0ae77228dd387e155ad0ba27
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\msimgsiz.dat
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.jfm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edb.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edbtmp.log
Substitutes the following files
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
Network activity
Connects to
- 'bi#.ly':80
- 'dp##te.com':443
- 'bi#.ly':443
- 'pa###bin.com':443
- 'ms#.com':443
- 'bing.com':443
TCP
HTTP GET requests
- http://bi#.ly/35fQRvl
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB039D4329A5E8.crt?28##############
Other
- 'dp##te.com':443
- 'bi#.ly':443
- 'pa###bin.com':443
- 'ms#.com':443
- 'as###s.msn.com':443
- 'c.bing.com':443
- 'bing.com':443
UDP
- DNS ASK bi#.ly
- DNS ASK dp##te.com
- DNS ASK ms#.com
- DNS ASK nav.smartscreen.microsoft.com
- DNS ASK iecvlist.microsoft.com
- DNS ASK smartscreen.microsoft.com
- DNS ASK pa###bin.com
- DNS ASK im######n-com.akamaized.net
- DNS ASK sb.#####cardresearch.com
- DNS ASK th.bing.com
- DNS ASK ap#.msn.com
- DNS ASK as###s.msn.com
- DNS ASK c.bing.com
- DNS ASK c.##n.com
- DNS ASK bing.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Executes the following
- '%WINDIR%\systemapps\microsoft.microsoftedge_8wekyb3d8bbwe\microsoftedge.exe' -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
- '<SYSTEM32>\microsoftedgecp.exe' -ServerName:Windows.Internal.WebRuntime.ContentProcessServer
- '<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2377844457-1847597103-2569463324-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2377844457-1847597103-2569463324-10003 1 -2147483646 "Software\Micr...
- '<SYSTEM32>\searchfilterhost.exe' 0 768 772 780 8192 776
