hxxps://withdrawal[.]portal-celsius[.]network/claim/?Withdraw=x142939/BTC/ETH/XRP/USDT/USDC/stETH

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://withdrawal.portal-celsius.network/claim/?Withdraw=x142939/BTC/ETH/XRP/USDT/USDC/stETH

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

9 https://case.stretto.com/voyager/file-a-claim

flow	ioc
9	https://case.stretto.com/voyager/file-a-claim

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5064	msedge.exe
5064	msedge.exe
4600	msedge.exe
4600	msedge.exe
968	identity_helper.exe
968	identity_helper.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe
4600 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4600 wrote to memory of 2896	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 2896	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 456	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 5064	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 5064	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe
PID 4600 wrote to memory of 1620	4600	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://withdrawal.portal-celsius.network/claim/?Withdraw=x142939/BTC/ETH/XRP/USDT/USDC/stETH
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
2⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
2⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
2⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
2⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
2⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,17700158088658776518,15163666010963468703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3316 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
20edfb060a23f5c8e47d76764d2c8e12

SHA1
d20bb695a28cd44af433593f143f6313c89949a0

SHA256
e05190ce1423591a2bbd50aefecce92b9568d9ba365b0fd85f88fa4dfe70080c

SHA512
31437b7521df642be9d3403df35b9bdd6e6ef1164e05e0003d7cb23dc85fd61d8978d1f6ffa2ee942ee280d2a210982a1e1c3cac8f0f27b810b6cfdd87c4932c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4c971fa9732a9bf683c5ca2ae6d531f5

SHA1
6e2b1149e498efc9a7a80552e24ae9323a62ee3c

SHA256
134eeb0756d89591e12477fbb58ee68fae0af3154678564259c09c416f95171a

SHA512
a40bfef772219ee418fee654812768a476e88842a3380693af9c0652e7cbb73b4c8bf7398b77663056eab49faf6ac13a0c15bda36b5b59b82fe1db75c0c45371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
866965db9575fc42d08453de9dd556f1

SHA1
1611ba768b0fa157d7efc6ebc2ba1482b23f15ac

SHA256
28264206cdc3c0a580d9d2631c2be08657f1b791914644dc272bb14dedab3d02

SHA512
a2a5bce4c5a5c6e3f61c0f84c07e74b1c503a45fb24f1ffa75ffe216465a6eeafa8ed2d207ae462e3b5e3bf96b4f494bec3b2fe5b9c9537ecb2dc13415ea965d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
83b7e6021ab099afe17642248c828615

SHA1
9ab1b69aad7d667fd827c479eb56df4741ce3809

SHA256
510ed944dc2f1c7c68f386b4e126ee13ff829d01b4059aff982aa250f18655cc

SHA512
704c6e3b049bbda7b47d5d6c4b95d7c8f01a7080fd1e88c326809f2990087876f16e8962bb975a7c8d9a74f91cb1bebc181ab52ab35d6be9ff4d2fba2afe283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
689ad08dc1c2672c37cefe4dd5e4fdc3

SHA1
9b57d2236b448d87b2276904773a6fbb2099be24

SHA256
d65fbff2da076c52e286c6cd830b4ffcf901787baaa84ee4dff3bb55135af391

SHA512
65ac812a53e6bb62f2b5dc4cb66829d82fa4a015fc12a9728ff3be38c340ca6acc821134c6ede02dd358e198782577dd554fee002b619d64a7249bc0e4bec241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9c21b535999bb06c3060e90962561f67

SHA1
8b7552339a514ef78bd98ae246d445f8dbfe26a5

SHA256
dcf8158ab1ee08e190e01429911685948b6b5b62e248fa4f919d1f3b6cbac1aa

SHA512
70c569599d6a49757923d872539a428de615858e4d008f49a1be5fc8220c2bc462319c6ebbc389dc9ebc1f1b77bf3ff0aa5e6ce6b3dcf9ef79e1e1e51f684093

Download Submit
\??\pipe\LOCAL\crashpad_4600_OSJTDYKKHQOIXGKN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit