hxxps://soda-wiki[.]my[.]canva[.]site/get-gta5-free

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://soda-wiki.my.canva.site/get-gta5-free

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
216	msedge.exe
216	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1520	216	msedge.exe	83
PID 216 wrote to memory of 1520	216	msedge.exe	83
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 4544	216	msedge.exe	84
PID 216 wrote to memory of 1560	216	msedge.exe	85
PID 216 wrote to memory of 1560	216	msedge.exe	85
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86
PID 216 wrote to memory of 648	216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://soda-wiki.my.canva.site/get-gta5-free
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dd1246f8,0x7ff8dd124708,0x7ff8dd124718
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15163598285908031017,14868909258236442752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x240 0x500
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
236KB

MD5
cd0843f0ef5217d75c421e9f99912ed7

SHA1
1fbdd38ec556ab21c950c31d96b4a81c3dc59140

SHA256
d04d4c4380bf109cb9984e90a18e96d68fe49dad3a13d4df24231791659fb132

SHA512
c444938ab8ce89615167532c76267a8a9d0bbdfa5fa8f5da1347d05a09fd2eebac3ddeba40150a29ae7d46de55905a7fa985f8711a68eb45e0420db3e8333dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e292cf4540ae52b68f203f74ce8fde5a

SHA1
badd6a8173544aa969e9444329b738771e1ca57b

SHA256
99d0874287d3dbe1821bbfdf6c093d8b7453224b505554d4bba20003546697d3

SHA512
01184da36440282465f6b72b9c7a33c43fcac6391583d52d13f6f6cd8db6e666b4f50ca868a431d83f5ecc5eae16b427be26a32060209586e9604eec3964d8e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
697B

MD5
a840f805ac180cfb5108691906b09742

SHA1
e515b7d260cacb99cfab72a8e92fdc435662a3f0

SHA256
e96b39817de387539088b0e299f0a59bdb15adc20d112da1430148d797238a81

SHA512
9f12174ee6eac6e3b8f2d4eccc274e09a1880f404cfb856befd923e46480c8428c7c4e81d8e99f8de04597d2520d9c316f9cd28f810164edc1af367dbc8fbafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
739a8dc8a0d260d38eda09f4ea103c40

SHA1
8bd3e573183857e8382076010b8c0237853e6f23

SHA256
62d3011dd5d90a9b5e0365a7d45e0b0dffdd0bb2f02bbfb6e64fca21231fab4f

SHA512
cb0eafac3a94009a85d6ccd7325a6bbe892e6d92166891f2d253e8e308f0ea30ec1e13633f4549c9874ae6dc33cc89810ecbf1a3d44dd42214ae3dee0c54a0f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f11b3e0b77afde5c08947e12643fa2e

SHA1
8983e549274981e18c75ce7eca5b810714cf6b2f

SHA256
4ca8a10fb89a6971b99b99a298d5ca929be7e7e0d54ff13d8a0a483d8e01265e

SHA512
a17e26111b9cc4ca8283481632cecf3664fc8cfc32128569bf25a5952e48f9153b665698639b4bfc028252b40fedae9326a43959624d46be03256f225a08b802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5271d344020ad17b60d891f65bbf1ddd

SHA1
58958c878729777dd61033df748a59c8edd70ebb

SHA256
f66ca7d50a7e9b6de0e1a56f64833caa75ae477f4c8ac9bc352aae60d6ce0781

SHA512
51b30995f94a024cf7420be0e2b6e8f4cd4cf750e68fac7bea4d75f01fd1430fa3172f22adfc2275cbab49f85b29abbe6db64fe1636ddd69acd92fc79d9a5a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
832fddf10ee27e2a071df79015cf4da5

SHA1
571c174438b778a55fc8fd5ee9cd05bf5e3a3bb2

SHA256
a6b94579b5c31723799b1da0da068b17e5788a6c6ad8c47f9341305c999adc3b

SHA512
6668de3b879c5bb60331ad6d8f81c41799670234388f2e02d2ffd28421e53ef0f3326b6203255a494b97784eb33e5f678dae64b45a0c248157c1102bb6f94b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
5e4f709da16c05502635e92e3c7cc903

SHA1
ee237e159dd2a79b5834bb7f24c60146614d14d5

SHA256
e08b0a1b9cfa1d40e8ab0b72edc442fb061aad9f31004df7d0450140be84434c

SHA512
0e9cbb93d4683100adbd214e8c4d4eef08cb34b40b471eb95c2381bd9b1acd9e5738d0193792a946bf33864e48dc61de12b12fc2a6a7d3b5cc66d0097cb17612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
fd16076b12f4e2c7059fa1d6ec0dc3ba

SHA1
73a67a0860804d185d5a8984b487384fde9ae430

SHA256
0ba31725d5dcbec768d0915f40f2bf330de4c35a0233f9bbdd046faa4ee74de9

SHA512
d19c2c705855d3f023bdac02953a61d128f7d6d5f9b311123f40eff83c6b6e40d2cf4b2d70aa518c6f639b8632c7eb8909b7a21f4678aadf27ce686eed96f394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f2bc.TMP

Filesize
538B

MD5
d18b03d5e53184be9cb815edcac5492f

SHA1
50e420e2c6a8210c85f57d68ff1071aa3e68282a

SHA256
4a11f08c6aa748fa4e3a4fdea5974d73ae4dd8d43efd36d0e6b4420467ecd8c0

SHA512
d309579cff96903d32899d179d95c5f789d2857a691cc1be2cfc13338459ed9d8366d997b28cc091a3f3aa28f0a220e9075b4b763d0846396d1fd1d4fdab4712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ee754b5486ec3cb7132fa723d17a780

SHA1
9e69dfd8e3b3b8b2d645ce1ad061d758ce63a804

SHA256
9d8c3aac5c0025c33707157d3f2e25b33f8c9e678512c76e86b22b7b236b6639

SHA512
215df8ccfb4946e8cda9fa724bf6652e15cc04b393f5d8c37f4edd7e7789cfe3d1eee38b0e4b3e0eeae8879e785ba0122a702e2adf7a91eb7ea4b6ffffee2156

Download Submit