hxxps://drive[.]google[.]com/uc?id=1UJlpm6BrqxbNRabncHtydNGlNYi1ouHg&export=download&authuser=0

Analysis

max time kernel
154s
max time network
229s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
17-09-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1UJlpm6BrqxbNRabncHtydNGlNYi1ouHg&export=download&authuser=0

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
1	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\COPIA_ANEXA_PROCESO_00020240902_PARA_REVISION_CASO_SALDOS_VENCIDOS_O_PENDIENTES_DE_PAGO_POR_CONCEPTO_DE_IMPUESTO_PROXIMOS_A_EJECUTORIAR_ACCIONES_DE_EMBARGOpdf.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
3896	msedge.exe
3896	msedge.exe
4212	identity_helper.exe
4212	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
1680	msedge.exe
1680	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	672	7zG.exe
Token: 35	672	7zG.exe
Token: SeSecurityPrivilege	672	7zG.exe
Token: SeSecurityPrivilege	672	7zG.exe
Token: SeRestorePrivilege	2968	7zG.exe
Token: 35	2968	7zG.exe
Token: SeSecurityPrivilege	2968	7zG.exe
Token: SeSecurityPrivilege	2968	7zG.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
672	7zG.exe
2968	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe
3896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1080	3896	msedge.exe	79
PID 3896 wrote to memory of 1080	3896	msedge.exe	79
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 2536	3896	msedge.exe	80
PID 3896 wrote to memory of 1940	3896	msedge.exe	81
PID 3896 wrote to memory of 1940	3896	msedge.exe	81
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82
PID 3896 wrote to memory of 2928	3896	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1UJlpm6BrqxbNRabncHtydNGlNYi1ouHg&export=download&authuser=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7c973cb8,0x7ffa7c973cc8,0x7ffa7c973cd8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,14198589076594673019,2849328887204487723,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap16163:378:7zEvent11831
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:672

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\COPIA_ANEXA_PROCESO_00020240902_PARA_REVISION_CASO_SALDOS_VENCIDOS_O_PENDIENTES_DE_PAGO_POR_CONCEPTO_DE_IMPUESTO_PROXIMOS_A_EJECUTORIAR_ACCIONES_DE_EMBARGOpdf\" -spe -an -ai#7zMap14666:374:7zEvent30374
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
796B

MD5
f83a6de527f3513d96c2fa5019d5dffc

SHA1
2f27f8aef557648573f6d00633dbc2021d6903f7

SHA256
6efe58bd476818a2fcaf232b468a7f97ad17e1dac801bc64b812562ffe68bda1

SHA512
aa9e424870c14c4d753b521e82970a76581018008d1f58d707e24e377bfdb2ef1bfd5ea99639fb5e3cc437499cedfac45434c21b0a7c1c4484266a2ff621d398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
765B

MD5
c47b0f7723407cff2db5fa483fc72f8b

SHA1
9d8bfe6311ee1593d368ebf7dcfe74f8c3315ac2

SHA256
71557a36c029ca98e30d29ef78c751e1144877a58b0e235cb0e2cd930e2b640f

SHA512
aeaf153f04c9b04abcdfce2c0b73a2c5b8d666757d3f64f3d4c541a27c1de0b9912a109b94363c3bac36ff7f70bc18af10d542b3b9dfc43e8774905f1598f88b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
690452e201117ba4842c7100c074739d

SHA1
524e91f3336151f5e894fbdc7b0c8b13fd1fd868

SHA256
fa54e0f8b43757d3a09cb06719fd32f677f49cb69fa04fcf0f94b31fb1d0c40c

SHA512
cf7463f10db1dff02451f0ba89264b30c6e9bc7ff7d45f4761bddd59361a4f035f8771bbcd92e915a78e1a9310a9bd5362de2ce5b8122d9041813a28d40b500e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80484d61a9e6f91c40f08dbc30e70853

SHA1
01e05fe785f904f07daf18a63320d9b24b729843

SHA256
6b9048e0d2111cb97245115be71c8098c5f718126d89167e7a3aabbe631e364d

SHA512
1b1b0d095c3af081a82827ee6ebee8c3c915ab1b90bdf68102ebb297c8d0498476152e00498c43140a0cec25c622025d455f6137a0c06e72e81a920d02e7fed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50a6e6e8c878e1c1c84ec2c86821d9cd

SHA1
8d724b453bfd40e6a041a94da98e7a96995a5bdf

SHA256
30108f74f97d35d47b85e5ee065948f646f30858502e259647616b40e4e1fcb8

SHA512
2bb102e38c95b69f151e4b0a3bcd5ac19549707f1e30e9462c3e3a399d1b188662881d44d52d8407b481045988f93be9131848a0995ef42cbe976c173db4ccb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d55188f74c1bcea526d289a508f75c6

SHA1
6e9b177d015155444910fd367b397c6d381747da

SHA256
f4fda7fc840e96f935b69e0cabeb2545d5b877241a9f683903a102d727621282

SHA512
fa6eb9a674078fbb302a97133a612ea4d4553dcf46fecb8f03a3190ddf4105fa694cd1c67fb8deb82921f0f40554220d57adb23841095000e9d7fbb34aa115e4

Download Submit
C:\Users\Admin\Downloads\COPIA_ANEXA_PROCESO_00020240902_PARA_REVISION_CASO_SALDOS_VENCIDOS_O_PENDIENTES_DE_PAGO_POR_CONCEPTO_DE_IMPUESTO_PROXIMOS_A_EJECUTORIAR_ACCIONES_DE_EMBARGOpdf.rar:Zone.Identifier

Filesize
186B

MD5
a71a9ad01b8eb4aeacb68a93a59008a9

SHA1
4a62e4a8e083849ffd83d7de1c8e0969d1bf567f

SHA256
4f0a3604755d00c57846eb6e02cfebfb1bb20cea5fdb91f4cb8003dc347b065b

SHA512
efbbed7e8a97ecee443631a8774707d06b727b33c6d580a77ec104257093d9299adeae702d86aaad604eff9bc133be90842c093e2dfad780432b0f3a10294448

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 38796.crdownload

Filesize
793KB

MD5
5bc206a820baef4708ca6101bc203c3f

SHA1
14d4a8d0a5efea5a1a50502a92676235cf9f281a

SHA256
15b7c7446ff2832e7b9f04c465024e8289423393c6fea83353157e54fbafe091

SHA512
930223f65391463ddeef4c059d449593dca258994e55fce3b9b5f31a16082cb6e6dc618bb13ee8dfe62534f4a2b428834ff605b63267f5202d004f83bc3090a7

Download Submit