Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9dd37a-1234.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9dd381-904.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5a8cd0f4052b91c9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\73aa93a59fc7830d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51d21549d0aaa247_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cb27cf1e9ba3a2cf_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\df3e66e5e32aa29f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\80d49de99bd2fe27_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f39f845facae9227_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\58c92ef7de8db1bd_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f1c6f2c88c1aecce_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\64b9f5ffbdd504d0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0931ff42103ef011_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b93f3dbbebad1670_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0ddbca0ca825c6a9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\524a74818809b3a8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b7559f65fad566a9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ab6ed589952e0ff7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f579d9cdcae2f8a7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8ba7d81017fce911_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\89636e836799aa55_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1d61d301b35bbf55_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2f60244b9657c71d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f3fec7a706236398_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4040dc2044f7d8f4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\dfda31bdea96b79b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8deab3875b8992ed_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\097082077a2640c4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6d3c74c2efd55b03_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f4a99f890ec3e0a1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c7a5e31cb84b9261_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f26545837fa1e4a4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\461c121079d4d11b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\06e133fd2339edc8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3d1af35e759e337f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8220b9ae95617d48_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8033758e822ebe61_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b06be0923a0c0f37_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\215bd5436a41861a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\306efb270087ce11_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\72b3755f350c1f8f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3957edbed8cde509_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\23ae8a391789639d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3b0644a6d1b88ab6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\407e963d230d8683_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fa5f06fd4f573531_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\8231778c85c119a1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\edd2774520a5809c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4b0191e424264dac_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ac5ff93566df0ecc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b232d6ac72d0d501_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\16bcb876df6988aa_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5793e57a1e9bcb2a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\21c5dd9fd210f141_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\40efd525f6508f3e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\50e895758c3729b7_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bad6ec315a0963a2_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a23802297e716b0e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e934e0f818d8242f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1ae97b214dd32508_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\947cf713a681e31a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\32e4d659a93fff8b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea2dbe85ab20f3af_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\2fd4bd6996584a7f_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\96c78fa538f2b4b4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\63e9a88d72796794_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5369a7ec55dc707d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e87fc3f03981ab35_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e70c387f09a46f97_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\cd9a462e8dd43a9c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1a3bc60c26bbbd33_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e99635b9e5b23c53_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51c3a8454ccca4bc_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\310f795435386dbe_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\1042c2a67be17071_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b5bbd59b06aa60b5_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ca7f4a6d953ed9e8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c6286606a0db4222_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\88ba95f34d05f60e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\435c0e5ac6b4730d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c0a894ce64dd1368_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a3d876eb6fb31bc6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a19d709c5c1aab7d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\be323793f1ea6497_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ea52212c471eca33_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\340ea526b842b47c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a52bc8444bf29cb4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a0edf1bcf883c6e4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %TEMP%\6a544212-b080-4427-8f08-ae64b3946651.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %TEMP%\2308_959431928\manifest.json
- %TEMP%\2308_959431928\license.txt
- %TEMP%\2308_959431928\filtering rules
- %TEMP%\2308_959431928\_metadata\verified_contents.json
- %TEMP%\2308_959431928\manifest.fingerprint
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\scoped_dir2308_1847926150\ruleset data
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9dd37a-1234.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a9dd381-904.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %TEMP%\edge_bits_2308_93153280\dde93974-5cbc-4ecc-898f-436e62207c34
- %LOCALAPPDATA%\microsoft\edge\user data\subresource filter\indexed rules\27\9.33.0\indexing in progress
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %TEMP%\.ses
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'di##ord.com':443
- 'co####.edge.skype.com':443
- '18#.#3.75.75':80
- 'im######xt-1.discordapp.net':443
- 'cd#.##scordapp.com':443
TCP
Other
- 'di##ord.com':443
- 'co####.edge.skype.com':443
- 'im######xt-1.discordapp.net':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK di##ord.com
- DNS ASK cd#.##scordapp.com
- DNS ASK im######xt-1.discordapp.net
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://discord.com/oauth2/authorize?client_id=1487474867912839439&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A9587%2Fcallback&scope=identify
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.com/oauth2/authorize?client_id=1487474867912839439&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A9587%2F...
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1788,16627041546837555438,10440855892361380516,131072 --lang=en-US --service-sandbox-type=none --mojo...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://discord.com/oauth2/authorize?client_id=1487474867912839439&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A9587%2F...' (with hidden window)