hxxp://195[.]189[.]17[.]39[:]88

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://195.189.17.39:88

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
4992	msedge.exe
4992	msedge.exe
1836	msedge.exe
1836	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3756	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe
3756	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4204	4992	msedge.exe	83
PID 4992 wrote to memory of 4204	4992	msedge.exe	83
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 1256	4992	msedge.exe	84
PID 4992 wrote to memory of 2468	4992	msedge.exe	85
PID 4992 wrote to memory of 2468	4992	msedge.exe	85
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86
PID 4992 wrote to memory of 1680	4992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://195.189.17.39:88
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd21b46f8,0x7ffbd21b4708,0x7ffbd21b4718
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12231551849352523624,17926414161793335208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3756
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ИмпортДокументов.epf
  2⤵
  PID:5324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b834109e48ff0a63d3eba326b8c5b74

SHA1
eb816e061b95c7b45acbdc5ecf64ffccd7f1caf0

SHA256
f480e5c15e6f06f442bb7ff2a1f04ff4e420314d24e1e64aed33859717053f02

SHA512
fc9a60d777c44ab2d1594b0632c7539c903aa674582ed6bcfc93c1bcea954919be357b68b78c99bf2fe1f7a5b0fca22232fdaaf96f30bd754b41b6e985aadc9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b474df76358ac2a5f5f1745ac864663

SHA1
dfb01af4cb6d538cb893a71ebbf0af47e8e2dbdd

SHA256
8805eaa15de511041e759ab425c28b477267df63ead7e33df84073937b630f8d

SHA512
b10b771111b21423d09de08a58f86242b4cdcce52dd2ec50ad0c55218ee6983dfd21ff4d74ad14a981c98a9afc3944e60e8304666a658dd346e50787ed7a3e76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5f6a2eb5c9302dc380a6947c05498a3

SHA1
5341295cf6e33e64cf76f5e25848efad0a35c034

SHA256
cde99124344983d3bce4a6f1366f7dca4914ce0b7264c72241049e88c883af5c

SHA512
984b5a689a90daf52875b97130928fcbac422ac1d1c2e1ef2095445c4ad8f0db38ef21f07086044a983fab42e61d1d7dd88cb16c9c5f12cdbe7dcd94f1425e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25d7a692abae6d072b67bc399c2d95f7

SHA1
dda7906fff4b3d053d033d87327aa29cadbe594c

SHA256
4f420949e6cdbfd4b7a5a5913835127f013bc26c551f96298fc1a2017296091c

SHA512
68a6cb1cfdbc84934eef462424e917d623911972ba3641fd7f380821accc621f742c61c8eb69f9febfa668d1d244bb2a015b21db9d168b188c572c893f891508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bea545580aae4f9196f5496d97648a60

SHA1
2c169973ffb836e6ea201f524d81223bb91f8fd0

SHA256
beef2f175d3cc592e7d2719c7793aefe65deaa3524a17fd482d9d29f7dd0b3a5

SHA512
2ed92eada98646cb31520920736d61a61b819bfa78990ddb0c1a620a23fe83ac96cb03983a2394c7d50dd42acef4f5fd0ca5fdcca6577fef9aafe5c8adb7c8c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
51620f56798d7ec970d38859b928a13a

SHA1
530c4844fa2482befb3c446588afa3d9d5fc558b

SHA256
fff952ab636a3ba8b98b05318e3ed751e66aa7a034a7c8338a5d92b257582826

SHA512
fd3df1986ce0ac8a40479e314aaf05eca31359fb7eca48a864239ac963abbd5b963f111da5b34ea60a95ff47d48203a0ce9940be6397fb2cc463a9d6ef640c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ddcc5a2909a27b683dca6e1e1cc22402

SHA1
4fc691f1904fa4111fe7f9c1ccdc5bf20478ecae

SHA256
6abec9416b5d4cd0e2bca90823d2a72c48b97478fb4dd98611566d58fab176b5

SHA512
ba74ea2565777e48a5d89f3bc739cb7618b438b3dc78c9a5d74ad1cdb2396799230d861b722f82211efec7e5969bb5648e7a85490f2d5bf77fe106f4d6f2752a

Download Submit
C:\Users\Admin\Downloads\ИмпортДокументов.epf

Filesize
13KB

MD5
968e228f6d4edf7b1e0860096b82a44c

SHA1
715ed32e7e8413b4146ec3118e612f02546e69db

SHA256
faf99548e49ec1fcff5a4c19603d8741fe55d78c3b37c15a9e5ffba1a3f9b5b6

SHA512
dc807ca7a7452b86a49fb3ac26fee41bf73c6489632a5baede8c2fa9b486669c7f951231ea9f61ef1209e9fbf97e0d9b1882fc771e862fb1d516315efb1a571d

Download Submit