hxxps://drive[.]google[.]com/uc?id=1fXKrR1x6lZNFzv599XDdm4AEAb8plA5g&export=download&authuser=0

Analysis

max time kernel
145s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22-08-2024 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1fXKrR1x6lZNFzv599XDdm4AEAb8plA5g&export=download&authuser=0

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-6179872-1886041298-1573312864-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\REQUERIMIENTO SUGERIDO DIAN COMUNICADO- DECLARACION DE IMPUESTO EN MORA RAD.REV:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe
5664	msedge.exe
5664	msedge.exe
5136	msedge.exe
5136	msedge.exe
5152	msedge.exe
5152	msedge.exe
5124	identity_helper.exe
5124	identity_helper.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe
5664	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
1172	OpenWith.exe
2284	OpenWith.exe
5512	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 5956	5664	msedge.exe	81
PID 5664 wrote to memory of 5956	5664	msedge.exe	81
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 5244	5664	msedge.exe	82
PID 5664 wrote to memory of 6136	5664	msedge.exe	83
PID 5664 wrote to memory of 6136	5664	msedge.exe	83
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84
PID 5664 wrote to memory of 1876	5664	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1fXKrR1x6lZNFzv599XDdm4AEAb8plA5g&export=download&authuser=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb74d13cb8,0x7ffb74d13cc8,0x7ffb74d13cd8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,7346960155052205776,1292287126349764002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
797B

MD5
0b956e5f2f9a9a7f2b0fb362962c4348

SHA1
195c232a9db92b5e7e94c1027d28f19c697aa56b

SHA256
d2d513f1c2f7ae1dc58f7220b340ec8d619322a6c99754f5cd418b32f36a7693

SHA512
3a9118b0fd9529f22d08ecd96df89aec7a01fe4f0986fa87dc9bb1727228b68797e8918f298330e5a144a080bb45350895c0f862c8dbebf5764a48306e8355f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
437d708b0252ed025f70a946e81f0e2a

SHA1
d3b9c0a0ba5e5e966f63a38432a657635ffcda27

SHA256
01cf9a19e46045e427a374e7d1e35364ddc8b497d037abcb7bea0937e5dca8eb

SHA512
f6d3a1670ad3fdc9b8ca2ae819c1486508fe216d2b90f11fa7b0809c6b0be90168347e675b865e2f8c0cf6f5f9525c9b4f3335f08b377d2cfcb128138780874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06b6a994c69f2f9d5c4c7974db374f6c

SHA1
1a14f37aba2293a59cdb57f53131f0711b00077e

SHA256
05ac53ceed0e9f049c6e7f0794a3ff7153ee94680e4df2e318357d65ce904371

SHA512
8256478a3fa18d87cfe4e104b7ba685364a3a56695078bbe3f3d07d544a0889bfd4d54361f6c6cc4c6f2f54912346be629d2b63799b4faec18f55fa0f4a54ab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a26a2c838506d2d680f8b7bb1703272

SHA1
2c0b6265dff0d6b76f26410883cf8cc98ae196d2

SHA256
e52ba80f6034e756bd925df75ada5821f92869183448fecaa50f828a49b9d2d9

SHA512
1b292958656e0ffc5abda884906370b8d35568ad79f7cd43d7a287008b33a5e69166a059721b4e01ad649d0f42003285e464fe62e0d3fa557e63f0e447fedd05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4d7652a-7278-4c25-86ef-26d3696fcb72.tmp

Filesize
6KB

MD5
eb0e484b6f48cd8bd8b7fdd84b2c6e43

SHA1
bd08d0b6747faac1b6ddfce21dc8f70987c2ed12

SHA256
223ca3b97ee8b0fb1b023a589b234fb9179f232fa225116a9e5a92a290a585ec

SHA512
944bae03cacad4823fff55072f594139b3190670e698476402c54a1d51f8b61a4ee19d24fed09cad4b2865189d2fb7b8ea505b14eb4c569163c35bd635e88f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0309668ae2a48dfd0c1507f7d9dedc6

SHA1
340fa30f99c447725dcfc82daf179058f14a4b57

SHA256
113ceb92994ba843b769f15c2d4e86758eb1cb706080f43529a8dd0b0d06fbf9

SHA512
1bb3120562d8bee0daae5d9b12a035dcaf9d512b9233003d84276d753fa6a419b07609130c5b09f4dffdbbcaf5c3341ae80560007433d9ef8af9583e386f35bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b380f7ff6a62bb75d6c7474e92d4db3

SHA1
86acd551d8d8d06c5928ba47bed3367ae2ccba41

SHA256
284380a669074d1d9023c9a34cc496aff91221d9ac05def0c3a09f8309a5a8ad

SHA512
55354df1f4034e91a03af41b63680416eb16e4cd7edd4d21d615bf8f5f4a19bc07b01a45ad1c4a054692f96df82ee532977d2c9c242c6ea914b4d268d169cbe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb9c2e018f2482a70a8933cec78e3c1c

SHA1
08e62909f30beb90c3fd14e80a3e0769f9b63ae6

SHA256
1dffbb1edeb1d8492047757b648135e7a2647eea1151c4c24be6f79a645c537f

SHA512
46176934cd1ccc5c493b3b74be948972d3a6f37e212262da93c7c34fdfd5b41370eeaf1a12da36fb9d051efdb9ca53228d0ec24f07f9cf3dd9addd5986982095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39f7346a6f81dabbe9b827c046566ad5

SHA1
7cf3acd826c2106a0b188e29962906464756b6f9

SHA256
ed65bf06d2c33520e3a815ff4fe678e4d94bccd5803e0f930e67327708a0ab00

SHA512
03e7386e6a250a5889e5bb168146fcb7627f0aa2b2c075fb367def272d204d84f9442a25459af2402f4ca44a6b2811ebe9362227852113623b801079715e7fac

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eed1599235b9dd933e13cbd5751d7eec

SHA1
d461f7edc8bdb31b672f97b18d34e38bb7c96c4b

SHA256
13ee96f0fd8b45de1603cea7aa86ddaa749ea580989d6cb806d944f3547fbf43

SHA512
9679690676ef1ede8030e26359381a092eaec7cb671d51e91d8cd446006301bcb98518b977fd5d475e777baa11dd28e69135c517e3b3d74475134bfed4e8da9e

Download Submit
C:\Users\Admin\Downloads\REQUERIMIENTO SUGERIDO DIAN COMUNICADO- DECLARACION DE IMPUESTO EN MORA RAD.REV:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 197768.crdownload

Filesize
1.1MB

MD5
a809788472d7e3c21f52ce615afb7d72

SHA1
904d89b34d862e68a6e53a4c3f447fb539371276

SHA256
c5bf99bcb6789904419781dbf906a65c81850cf1fe6733e35c130cd41abe6bc5

SHA512
d4bdb0273fbf0d93ca7fa2b25c98a3d9724c1431052c3b6e7e119b31332b6cd5d79612b815aac0e06b614e5c61ab254a3a46bf782d0577a175de433c1d4e5c59

Download Submit