hxxps://arena-battle[.]com

Resubmissions

16-12-2024 16:22

241216-tt9zssvmfw 8

16-12-2024 15:04

241216-sfqtbstqgn 5

16-12-2024 14:59

241216-scshratqcm 3

16-12-2024 14:56

241216-sa7vnasrhx 3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://arena-battle.com

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
3352	msedge.exe
3352	msedge.exe
2928	identity_helper.exe
2928	identity_helper.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 1836	3352	msedge.exe	83
PID 3352 wrote to memory of 1836	3352	msedge.exe	83
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 3448	3352	msedge.exe	84
PID 3352 wrote to memory of 4832	3352	msedge.exe	85
PID 3352 wrote to memory of 4832	3352	msedge.exe	85
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86
PID 3352 wrote to memory of 3412	3352	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://arena-battle.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce88c46f8,0x7ffce88c4708,0x7ffce88c4718
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4883913351649667692,13550062748029726793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
895dd3e506601f0908d405b309a667a4

SHA1
04e39638848ac70c3acc6cdabe518661912a1c30

SHA256
9308a04c1193a1aa40d61fee10ec6036b5d9e79c2b972d7884564a3bfeae523f

SHA512
d9eace2019cd3da76d822b4d29c20fc4fc61bd8fd2b2e75c465d369ba470f0e833262267b97c7da9bfdcee257133a9cfc3a2224f27286eb0556b76b51ae1b7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
fc460e49c70f544145e5e33397eed644

SHA1
9de2832192c2d6f083657072d692e9ce8cc29aa0

SHA256
a5b9153370beffa477a283cf092e5d3a07fcc2ec7e62ae162e2555de6105ce00

SHA512
5a03e8f8e1b941a8e893bf1dcda9d4b77060289bbcf1023bbc65c0688150a0602ce39773554f81312ad8210a008e537a0ca05eb784d7302eab76123d4ccc4cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
39ddbaa3acad3566656d0e2564e49493

SHA1
e04718a920bf9b7f7833980a67991ef719a79b25

SHA256
71cd26f89c61b6c17397436cb17e5ba8c331b46ca2369c9d6ea59ccf01a3f2da

SHA512
553a205792f9c41a1020220b82f68103825f38ce691b9756a1a1418bc5db03c687ee8734bee9658f5c8945eddc7515868e4cdfad1c81f881bca280b9d4e57ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
735B

MD5
49c7be6094daaf8b715854bc9784373f

SHA1
c9245c919c41837246063bc98deb5c5e7f4beb3a

SHA256
bf11ef3e1dfd9ec1e4cfc8d01e7cd643df791a61ea705e13fc958a042c254978

SHA512
9fcdc01e2e77e95ea2dfaf79663eaf4e42b2459cf817b112a12ceb4c2667d1fd6e06ea1242c9b86cab0c4f53904853f17d7abb660a549c89c57cea3b26488556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
875801720d18e5e508389bdf2051fb90

SHA1
407c0c646356e25716e4fadd6be55f84f039f6e9

SHA256
6ad3a43d7ca885fb40f99c4f28d9cd8197e8c576323e01c15c415e75d51fd988

SHA512
5db52db5365a6657a6d56fc48844b5955a6ab606684f2becf314445a7a4224806b844745f93715e232521f79e77178d6554222fbe3e22a1f7d2bf04b7310e025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e487183fa6b621c208821aec699fdf5c

SHA1
1495f4890dd942f995d3086f0173b6916b42015a

SHA256
9bcae1c6d6b4612b7cd0e66b03c0b26b165928a242fd2c7d297f21f96caf91f9

SHA512
a62ccff714bb82a3ce6802122d4bd64e751800861d1cc31a2f81405921a48d5e5b1f471d3eecfd0530c17427a5f167dd74f5ef181becf932db1269d82647e5c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a51cc6626eec36bc8afa27b3730a7b6b

SHA1
9c610fbd83f0b693e41a98a375355d505c275521

SHA256
23764f708093bd06215adba05e998e9d4ce5f8b3996b830f016714d2fac50265

SHA512
e15e300c5c4d46c59429d38657e2f5f14130257c9ad74cd87251730e4a19c0e6ea96790aa0bcc64587a19d162e78c0b8fbad557662025cdfc82ae275e051d9f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c6f12f0d947f77dafc65f07daca6f9fd

SHA1
8934f92e58b6915747ef24cff521e438f7ec084b

SHA256
3bfbc251280aeba13818067afcc1ee61df4dbedd76a7a1727ce9bf85828ee1d5

SHA512
1e332e49fd52bda4d92014bc2f5cc75d3df6fc1ee7d7c04aa1f3ee20487c831728c892af29f0b4f15d2629fe6700fedbb9dadc5594d1bff659ec0de6298049e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a49a16173420e9fbac340df39c276b00

SHA1
be1a161e57de28996f0084d5906a0eddf0e5bd53

SHA256
b65e52fe3294bb26fe6fe517e1a907382481fbc6e8dff0e099679f25b148a82c

SHA512
f2255e17fd4130fd05dfdd61f02bfe287b30f8d7111aba74374e7928bd622352b3a1f6d4ef86777a0ae06bfb375b115be4d4316958f0a19d395429fd1d90ea7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e848.TMP

Filesize
202B

MD5
5b90d6d88529754924831fe8f4ab9b57

SHA1
6c0110a15fd3ff3ebcfe3753405e2cff168d49bf

SHA256
e22a5affe66a06b764251b6e130f2b272c565071d77cfaf443f6de07d68ef62b

SHA512
6debb4306cd28568d6e59a3fca6f20e1b273421b76590584ee265efbf5cbce1880b57a9cdbca4fbb26795a08b1df54e66a8690d2429a5884b72f8a10bac05a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2d88b1c-f68a-4575-98d8-790f04e5d955.tmp

Filesize
6KB

MD5
8109debbaf49e7f97b162e83812371e2

SHA1
75989866b1179318cf29f053f34eb2a7000a5740

SHA256
d1786c31ace64a79a1ac858dd2f47b89310d5b6eb22cdb0045975c95251447fb

SHA512
6187467a55e20371038a3f55e9c34471bbfe70aedd6f7182469df6ae5e69a375cc23296f724b812153738ae002cc9b190c32d7e99725d6cc694e4712c3f0c193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e3f0b51338e3591c08ab20e3029bf30

SHA1
4e5d8699214471b8102860ec6ba1395c63234bb6

SHA256
51be86bb7d19f5a4c4cf84a5a101dfb47754bf45c6098ee9119efd646686edbb

SHA512
40b6e6b17616dc0bb841a69b752fcb85d988a0a7c7415c175021277889e6dd8cf4c1dbb686750221614268e9336d9ed420d7ea65e804677b7330ac560e21d237

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit