hxxps://tenzvalr[.]com/

Analysis

max time kernel
99s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tenzvalr.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3820	msedge.exe
3820	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4440	3820	msedge.exe	84
PID 3820 wrote to memory of 4440	3820	msedge.exe	84
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3928	3820	msedge.exe	85
PID 3820 wrote to memory of 3944	3820	msedge.exe	86
PID 3820 wrote to memory of 3944	3820	msedge.exe	86
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87
PID 3820 wrote to memory of 264	3820	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tenzvalr.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee2c146f8,0x7ffee2c14708,0x7ffee2c14718
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8011380321218003348,16730430126424546655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
  2⤵
  PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d5630f855f552b37d12b264cd35f1034

SHA1
9a077da31e7069a174ac2b6eae6b5680604d81de

SHA256
d86a8c4cbf2a91ce476fbbbb23f410dc89166669268888881c420af46e8daf6c

SHA512
5792a07b2253e754a611d46709792d4699cbb480967b1b455fb26ac5c643a274e9b5e54986e7982034408c56be613c287a1218ebce9b353fa9be0e0714b1d041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
ff623483dd0e0c457cb12fab8e63dd0a

SHA1
81d3df86fe55c0c62ce03fcac567623fb63cb342

SHA256
09d5a05587c614fd5b3f1877773ab9dea42b696ba174c868574e03a0c958e03e

SHA512
c99c8a6b1dff8a9f65794f5aff3d68fa046be4bcaa215b5b4105958dd8dfb0206ad73965e829dfdc75ec6ef4476a8a2dfc2e0e6726c6141748a9f37276123f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
6a8dadd61dc194a2b262e576fa6e844a

SHA1
67a1a4f510bf84216530bd2f757e4160ed7be0ce

SHA256
dde43fc8480faeb8940d63e1812c6c14dedd337553e322ceeb595df024c35c1d

SHA512
bc1e7d0eea95303dafb33e82a8da19a6b04ff38c9c6b170a932d098f9729e9a3808a9dbc43de804e2e5740e8185cf22fa78ac91fd7d4501b6c663623ef321830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0852bc081584f40ab114144683b66bbd

SHA1
bca49118c7132315de6803d6003926c5f0077e03

SHA256
01eb62a6d242f64388cae08f058af3bf463c419f63673576a97b554495fc3167

SHA512
421d6283d5e8484a0c1c92ec7f3e4135c133357c71c84b9d1d856e25581985255d55aac10650a7fb189bec37b5eca9a7cb832b809e7d8bbb4a01758c32c42571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43642ddaa52c82b9799a697776716f9f

SHA1
d39d8971a982c4ff632c0cbc07469c7e902f444f

SHA256
3e62e9159e8e46e0f1e4d919356427949c33b0ea8cade92aa2f92fa0b163dd8d

SHA512
9fcc3ecdc972deb2b3947ac4a2f5abc9514ecde4050aa659f9688c33622879d97614d0612359b8b0a86b108a7e673335a868b8c7b91153039920964fb3c4b495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
018561e8700caf86247a1eb5e20b6b0a

SHA1
699e7a1cfd964cfe9e9b0333408f419578c808f0

SHA256
d5202f5f8a40bda36598ea90fa3c0911b2e5934bd8268867ee57022011af71c6

SHA512
408bf118bcfdd5ec2b41a0f3ce40a9e6157716819924b41f58f08dbdf854cc7847355cbc77382c562668f6c7cd45749cf3723c87e91375b856d83494014a24cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1d014222b57bea1b0c950bf48ce7aed4

SHA1
033c844a5e63e136b09da164a6bd368059914559

SHA256
fc7df4c59c272f63143cf931ca1ec2c3cd544bf0c1c4495d963b8d1cee40aba9

SHA512
90bff3073b42d90e5084ccc6b2399a7b777699e5b926f8bda9d34a033de19dc3af3147251f2117560b40ae6347674e80cef4dd4406e92ec569bc6410411e1211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f396191e6f0edc6578333a56adc1462c

SHA1
f1c431a0dcab6a9f8690c5bf1a93f14d0623832d

SHA256
60049c58b0e889a439f98a7b419e5272c2cde2937ba32f8e215ed5de41676267

SHA512
50be8c70026d7443a90313c08755f09e4f058936a638efb4e7a667ac20a52c9021c7ff3fedf8cc6961335f55e864768c5ab31bd2c645a57ad5ebcae3a4a468ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
c9b74023447e373899aa87d37334b423

SHA1
8cd017e51d2aa75f27b97e52fa2be4ddd8fa79b8

SHA256
5baae80ad0252da1c614db5717cbbcf3c008886633dd2ae338303c9834069d4a

SHA512
5078f777761cc617da351f80e38570afbc7392a8bb15cca388534760a1d4868898ad00629517928d8fcf274d7c44fde8a56795e3c90266bffbca53b08567570c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
f70180b48f61f79b72cb804097cceeeb

SHA1
2561d5b28e06dbe4444f8e49c2df4afd44360dfb

SHA256
37c7a66165e879435912b90fc329a5706f91ce11c7e9a34b12b6c3b4200ebb0a

SHA512
3001a86d2dda8d80729347ebc9be0c4d31032b72af98561f62c7cce6ab913539fb60a79200dce9d22691d867b2c01e04d85d0a638118c457cf8048f927ab7650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
20da55b6bb51f13e83f9813882784447

SHA1
4ceb7bf186432de59f2a28e9fb86c4a9ae7ad223

SHA256
b6fab80fc1e3cdcd1bacca3eb356a4becc88d5ce9a1af5acd388979de575cfbc

SHA512
77eeca2861e32ad56e31c494f415fb18c2718808946c8deb04be8e88b8cd3abbb2f4f7e6b387e464b351a016e8a3cb50a8a47e6b208d2565627425c9dc79bbfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58505d.TMP

Filesize
202B

MD5
c5caa673e87e1a1ebbac2f4e35c08eb5

SHA1
f9c2bcdd508a00c8c12d6e6be5b123596b039ebf

SHA256
a5c63f01abbc70a50f77aa71e959f0804a4f22dec4941c466bd19f09e7b9129b

SHA512
bef50e2d1fcc5994e8a2143304fad6be698ec000bf4a383a28fd0dda33204d6146a9b5459f1ed1ba0de8dc5ac18dfa26849ebb4d8ce5da834be71011e52a2377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f2eddb70c8a744e721c9d5ea6912aabc

SHA1
196359619e35dc3cf651bdde59626d01e4a4f6fd

SHA256
1a8fe715baed3e566403e81aa9df0fffd084b03537d148bd5c6b271fd198b036

SHA512
a47aa65f2105ae2532a9abbc7c464463307689e1bb877ae0d2eb53b09c4fd3c074d81610e8ee1f72b83d9cbcc9cd044d19ecfa2256ed57726a568aec9a52dab0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit