Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240507\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\topic-data.9122c25159afd52c051b[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\pivots-nav.fada94a36efa9191ecc0[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\iris-data-connnector.08994c0de46d3d4e8cd0[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\breaking-news.d11fb0f65233cc7311d2[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\topsites.a339bbcb9841b908ff57[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\user-profile-display.3f2029dddf02ce5fe4e7[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\bannermanager.0a0ecda75bc311f70c4e[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\card-action.2ad3cec190aef8ec85f4[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\bbkvxnk[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\feedbacklink.5475db40602c075e0172[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\showfeed.876d1b9a714f071957cd[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\pagesettings.bb435d36341a2ef34a3a[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\pivot-content.b6fb2ee68a27298082a9[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\appcache\r1f6681f\1\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_c0427f5f77d9b3a439fc620edaab6177
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\onefooter.982b320cf4a2a85e7315[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\conditionalbanner.56094bd1813102189372[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\river-feed.ae3dae95d95f7e4c6530[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_f9e4dc0b9d5c777357d7db8def51118a
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\native-ad.1238efed9d6663e6cd5a[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\imagestore\kvww8rw\imagestore.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\fav5fff.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\8.4afc41bd922db2692762[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\aazobni[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\bbo3aug[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\aac9dpu[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\aad40wh[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\aac9vhk[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\bb156afc[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\b398b80134f72209547439db21ab308d_a4cf52cca82d7458083f7280801a3a04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\msimgsiz.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\e2c6cbaf0af08cf203ba74bf0d0ab6d5_cbdccbfe4f7a916411c1e69bdd97bb04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_cbdccbfe4f7a916411c1e69bdd97bb04
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\temp\all5d4e.tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\1b1495dd322a24490e2bf2faabae1c61
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\1b1495dd322a24490e2bf2faabae1c61
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_f9e4dc0b9d5c777357d7db8def51118a
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_c0427f5f77d9b3a439fc620edaab6177
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\weather-card.c6cef55d540a2f97de22[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\appcache\r1f6681f\1\appcache[1].man
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\z40e9j8u\main[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\eea658139b1f4714acd794ff5e5c8408_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\80237ee4964fc9c409aaf55bf996a292_d46d6fa25b74360e1349f9015b5cce53
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\ntp[1].htm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\1b1495dd322a24490e2bf2faabae1c61
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240507\microsoftedgecookiesbackup.dat
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240507\protected - it is a violation of windows policy to modify\backup.dat
- %HOMEPATH%\microsoftedgebackups\backups\microsoftedgebackup20240507\microsoftedgesettingsbackup.txt
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240507\schema.txt.~tmp
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\datastorebackup20240507\edb00001.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoft\cryptneturlcache\content\1b1495dd322a24490e2bf2faabae1c61
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\user\default\domstore\lxneagyo\www.msn[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\8gc1yg2k\style.min[1].css
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\8gc1yg2k\logo[1].png
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\097bp2j8\fa-solid-900[1].ttf
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\config[1].json
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\m47mv7c1\common.5dd7cff85de67632bfd7[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\hruhshxi\fa-solid-900[1].woff2
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\so5u0og2\microsoft.8aa91a5fe4f5d8517ae1[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\vendors.c47bf4f4981f23895ddb[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\tempstate\downloads\dayisagooddaytoheargoodnewfromthegodwholovegodtrulyfromthehearttheyhearinggoodnews__godisgreatforentier.doc.q1e...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\8gc1yg2k\nunito-sans-v12-latin-regular[1].woff2
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\097bp2j8\nunito-sans-v12-latin-800[1].woff2
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\content\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoft\cryptneturlcache\metadata\eaf8aa29a62ab29e614331747385d816_5c1009244d39fce23af8f277537f2613
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\hruhshxi\nunito-sans-v12-latin-700[1].woff2
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\msimgsiz.dat
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\z40e9j8u\variables[1].css
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\z40e9j8u\dayisagooddaytoheargoodnewfromthegodwholovegodtrulyfromthehearttheyhearinggoodnews__godisgrea...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\03xzfyhx\web-worker.440858f9fe4973b6d967[1].js
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\user\default\domstore\nqv3we11\sorty[1].xml
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\097bp2j8\bootstrap.min[1].css
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!001\microsoftedge\cache\hruhshxi\all.min[1].css
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\racshare\microsoft\crypto\tokenbindingkeys\keys\96664fa8619f9d65bb0bfd4ff653da7c_2db030ff-16d4-42cb-b...
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\#!002\microsoftedge\cache\sbm2rzwq\weather-data-connector.682c31544bc49f2ce3c9[1].js
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.jfm
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\spartan.edb
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edb.log
- %LOCALAPPDATA%\packages\microsoft.microsoftedge_8wekyb3d8bbwe\ac\microsoftedge\user\default\datastore\data\nouser1\120712-0049\dbstore\logfiles\edbtmp.log
Substitutes the following files
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
- %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edbtmp.log
Network activity
Connects to
- 'so##y.cc':80
- 'so##y.cc':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'ms#.com':443
- '19#.#.179.142':80
- 'im######n-com.akamaized.net':443
TCP
HTTP GET requests
- http://so##y.cc/XttBz
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
- http://19#.#.179.142/xampp/htmls/htm/dayisagooddaytoheargoodnewfromthegodwholovegodtrulyfromthehearttheyhearinggoodnews__godisgreatforentier.doc
Other
- 'so##y.cc':443
- 'ms#.com':443
- 'as###s.msn.com':443
- 'ar#.msn.com':443
- 'im######n-com.akamaized.net':443
UDP
- DNS ASK so##y.cc
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK ms#.com
- DNS ASK im######n-com.akamaized.net
- DNS ASK sb.#####cardresearch.com
- DNS ASK ap#.msn.com
- DNS ASK as###s.msn.com
- DNS ASK c.##n.com
- DNS ASK ar#.msn.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\systemapps\microsoft.microsoftedge_8wekyb3d8bbwe\microsoftedge.exe' -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
- '<SYSTEM32>\microsoftedgecp.exe' -ServerName:Windows.Internal.WebRuntime.ContentProcessServer
