hxxps://hopp[.]bio/bloxfruitserver

Analysis

max time kernel
145s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-09-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://hopp.bio/bloxfruitserver

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
1868	msedge.exe
1868	msedge.exe
1468	msedge.exe
1468	msedge.exe
128	identity_helper.exe
128	identity_helper.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2476	1868	msedge.exe	78
PID 1868 wrote to memory of 2476	1868	msedge.exe	78
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 4604	1868	msedge.exe	79
PID 1868 wrote to memory of 2484	1868	msedge.exe	80
PID 1868 wrote to memory of 2484	1868	msedge.exe	80
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81
PID 1868 wrote to memory of 5244	1868	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hopp.bio/bloxfruitserver
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb74d13cb8,0x7ffb74d13cc8,0x7ffb74d13cd8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,15922456534077817513,15078356529856070553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d72f1d4-d23c-4575-b3de-dda317f2c115.tmp

Filesize
1KB

MD5
4249343ac3061172f727dbe5c440bec1

SHA1
fa85dac870c00ed3d8fc20e960e1d76df3924d7e

SHA256
2755de010992786e2b4e5b835554585062a72020c82663df6fc6cf96a1653ee6

SHA512
e2f16e0bd5575470976b9df4f8bc5634a536631d03719d0ae57c8431c0fb41a24f11b3119b19705ef53388c907fabbc5feebbf148ed94441abdb7a9cb99dfbf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
81da3f46f49435c74de097e946bb1c39

SHA1
0ce29531ff17e5db16e6300ac0e0a63d4ecbf779

SHA256
fa5f02e487cb5dc501d2439b9bd9bd57f3c3f0313c36fa0fb4e82e67052c323b

SHA512
5b6a2482e82aa836b54fed91a82d87cdf2f0652cc1761425315a9358aa911bf0e607d7eba3e533fbec674c0855a2234c9ec7e332f053ea1955ecb52d50c28b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2a02da2a10b5e0ac4928b38dc128e9f6

SHA1
b20727734a03799680828edb9695332d3b617d98

SHA256
813e6ce2297526f8cf82a22cefa3452d2661e44570dd6652538f905e04506799

SHA512
7063a66c87df82ceafe6c97be78b91bd07ca664bce42b046f88b62ff3e092e1499f8c445ec8cb72bde358552d3a90b2aa03f8f19cd02e2f8c3434d30d32224f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6141e273f0bc03ff4764ce6d618c188f

SHA1
c0bead2f3ad9e272e485a339bf5654fa35cf7429

SHA256
5ae71045dc5754709d89179381a084dbe852958bc7eb8dc7da31666458507904

SHA512
d73ee2c4b56587cf6acd49b39543d6d064fd699783796d3ed5fb3c29c2841a09cf4b12031f3041a37052e49115f212d030721fea9b981b437b4f15effe23efe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b83ea065d132332f5349043a0b0268b9

SHA1
2bb2fe4e9ac2bcdad28955b6d067a3dccd009f00

SHA256
b365d8964d4b2dd6f391b2251dbcc05731645fb716b4b9b1e3873c294a946e32

SHA512
f2106c2f5b02188060d7124296d54be96888f1557d2d3d57ef3c36390a69255ee3ff4a6cb55c2dc3eef7af5a7d00555a9945e00ce6ccfac761d0fbd651daec8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f6b72851dc749fed1cdeeca13a6b25e

SHA1
4a0fd39a73b57d6fad89753e5a3d11b85f1987c3

SHA256
53172fa01068705b6214dc1a9db717df8b65ac672c8eabfc28a62931e4bfe84f

SHA512
e7ba157777015e3519ee797c1e9fa53138209ea1a77e8eb65451e8c038835482c9f37a426f76b3a8a0081f0fd1e3adc2b7eb99705c9156c8de64413070004fc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e464cf0cf16b53ff999651bc7ed36e52

SHA1
ec62baf5d3d563ba3d180092e947e4bd7c7b21fc

SHA256
ae2b0f1aafe46e7c17644eab7b9c7a1319ea73c8ea4b5d2b6d85bf8c2e56c711

SHA512
e83af34ab5281cc4d837f226303c80e6b1977550b87623c971dc2616a65d2f2f50d7400709f481c3a0d2d5517eb26263b4e26f5c6acb74ace00f9dc36ffd4170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815e4.TMP

Filesize
1KB

MD5
ff287b65e2b569b4362b50a1dbf3bcfc

SHA1
55d41fe9b7851e6d796ea7b64ac5a0053aebf1bf

SHA256
41ef7307f7b8b644e6c49ed2b552a552c4ab1f4de50b0395276860759906f149

SHA512
a4a16946ef2c4407fdd9fe005bbf177b2441a1b9a6cae8a9d238ec4283f61e24259b0f2e808007baba9e0ca446ff7bdbc117d2617c203056ecef47adc26ceb96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
99dde6da5af17733dd254d9826c72a6e

SHA1
30c0260a60ed40dfefff7710ebeb48b343c55e2c

SHA256
ab449b58c8df91ebe4852306ec0fdce8487582a0b86e59563bef45d84bc3b81b

SHA512
812a665e5b309bc83789e2e28ecffa45f2dd5b324d3bbaccb3535768376319afc0df3f3e1fbb5ae202805530964fb102f461b172696791f0d0f5af2b5ca19edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2ba530328dbbb2cb2d9060d487033ab9

SHA1
c69cbb280cb6f97b028e9e12439f49acd9612a73

SHA256
8e4eebc752460c894e2da83a770e847a24848fd49af4b7d72c2f9ef4d0314003

SHA512
344449d940e9ad2415f0281270fc0c003ef243fef41fe6e17cb3ccef69685fa73b673c755b3001b4f444748409b51895119126db6de5c1b8fabcb92f94a70277

Download Submit