hxxp://bsif64[.]farmboyusa[.]com/bforslund@montrose-env[.]com

Analysis

max time kernel
840s
max time network
844s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
06/01/2025, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bsif64.farmboyusa.com/[email protected]

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4828	msedge.exe
4828	msedge.exe
2724	identity_helper.exe
2724	identity_helper.exe
1088	msedge.exe
1088	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 5040	4828	msedge.exe	77
PID 4828 wrote to memory of 5040	4828	msedge.exe	77
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 3868	4828	msedge.exe	78
PID 4828 wrote to memory of 4824	4828	msedge.exe	79
PID 4828 wrote to memory of 4824	4828	msedge.exe	79
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80
PID 4828 wrote to memory of 3400	4828	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://bsif64.farmboyusa.com/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff989cf3cb8,0x7ff989cf3cc8,0x7ff989cf3cd8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4588074323012323315,10211310713387504669,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5532 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
55ca9063999ed0d775b42aec79efacf5

SHA1
815fe0e403db7e39b9ccd37c2e04bbcfe2520b22

SHA256
cb814ae4fee6e80156cf184a6e2c3f49baff6b67af947eda850c2e1d96d2cdb7

SHA512
47914a65b948021c83108af2506ecf19ac76b5aeb51f4b4996a25f73b03d0301b4ed9e10875e2b9bf45287f39569edcee4625fb299a92d14f6450c21bd6d457b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f2b847eb4025c14d16ef8d191b5ea680

SHA1
02d5b9627fdb2a2d8500dcbd80cd517e9ea51147

SHA256
75c6e6900d144957834ab77421b42de2f7c115ac3c4d5a7384394182a0d3cb4b

SHA512
1c7e70021a97e991563ecdfbf3644ed6438244efeff659c8ef94328031e2eecfe12f1e7ca255c15b09b0fa006682c15fdaef10743cabbfe7f4f3844a71cd826c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
83615f690ec39e89e8b16c5347a07db1

SHA1
54ee331837f232c8f25bf12364c3ac60b1876aaf

SHA256
e6740a0e541aca196b4e0b70829de95e8d8178b7820acd9df14ab5c591e8e5d8

SHA512
79661440cdb66d5aae5ead6eb840780cdb9f853098e5c857228eb6ef6e52c47439d04b631088eeeb9ee4a6b8b25acec91ec208c1e2dcb68c1261928701fe8033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cff6ed39823b05e3de09b0d539748ef7

SHA1
cd63e58d84c0328de34be47bc90870fbd62d8afa

SHA256
8c0cf4b648049cf1561bb064a58f3b18f7e20571316a020033dd7226ddf49659

SHA512
1b150f723ebc4f536dfe7e2e81acedd0d5ba9e011beb8f2601bb049dba35c29cdf1de3c37935b45f126c67997b55daf2fcef91c54c4205f6b7c5b314db006117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1be4d6432b798bc2f5e301fb2b8a1b17

SHA1
82e75c75f0581501864d5aa74241ce8dde39d63d

SHA256
b9c837dd0319ac5638c37f18946bd2911e5304d004770b6f6fd5f2a81c4ad227

SHA512
9c19a69082524c75ea990893d9748d681e536b3216bc1833a4c07ef614c5076fe2ee4e2a7974d733c6ca0f536fb307970e12cbce0acdf3e96b3ff7b0ddfc7a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bfb5eb6128dd33d5a38d028353a637e

SHA1
66d22d578dc4df2f75e6ca077fbd46f76dbe3136

SHA256
92e83630546140831a4e74475707235f887e4fae6615470dee1d1c1589b3bf7f

SHA512
319aa19ed84ed570fb2e51a30e7af395c1f175c8ce8f8bb733c59e1416dd0ac90b61d754fcfd00610bf485d6d3214af82a0d41f9001aa7aa1fd798d9ce99eeb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e49beacc7201266ff3ffc59226e0a5a4

SHA1
ad69a995692bb40d4864e319dc3bdd1850306868

SHA256
0826da7e13c21e06037a81ab3dc03276881fbf3bd34c44657042f7c738bea0ea

SHA512
70f24cbce29da9b8df96d90695efabd2c9b65ad8daec29cd82cbaa9226658484800f2ae89b3221f2f37f74362c47a1274f329016ac1a46d7e2e6425a56b6206e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4fa3bb6ec5bb392d55debcb0a6580706

SHA1
5cb753b1d6e82eb119ca21165d153ffb7d085eab

SHA256
7e53de1e60fa38eeb4505b6d3f3d7506be10fa4a0ff2b0b34c71ef36574c54bc

SHA512
112e44bff9b038179cb68af998f6d30c7e11277c9e336cf26a11de4dca95c1000e8a7b54352850929dfce17ae212f7cdc8eee8304fb6c32db67b4629851d2cde

Download Submit