hxxps://drive[.]google[.]com/file/d/1mOR3BnpIAUn1Xsy7rGeLOf06in2kgZHq/view

Analysis

max time kernel
120s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2025 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1mOR3BnpIAUn1Xsy7rGeLOf06in2kgZHq/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
1	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameMaker-Studio.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GameMakerStudio_1.4_Portable.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
3144	msedge.exe
3144	msedge.exe
1972	msedge.exe
1972	msedge.exe
4488	identity_helper.exe
4488	identity_helper.exe
892	msedge.exe
892	msedge.exe
436	GameMaker-Studio.exe
436	GameMaker-Studio.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1868	3144	msedge.exe	77
PID 3144 wrote to memory of 1868	3144	msedge.exe	77
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4744	3144	msedge.exe	78
PID 3144 wrote to memory of 4548	3144	msedge.exe	79
PID 3144 wrote to memory of 4548	3144	msedge.exe	79
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80
PID 3144 wrote to memory of 1116	3144	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1mOR3BnpIAUn1Xsy7rGeLOf06in2kgZHq/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff846df3cb8,0x7ff846df3cc8,0x7ff846df3cd8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,6087983420005961911,17902445800194183896,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1732

C:\Users\Admin\Downloads\GameMakerStudio_1.4_Portable\GameMakerStudio1\GameMaker-Studio.exe
"C:\Users\Admin\Downloads\GameMakerStudio_1.4_Portable\GameMakerStudio1\GameMaker-Studio.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DC4933D42B21E4EC91594406DE229422\TraceIDE.log

Filesize
226B

MD5
91e485fd314afaf8b50d656cfd54dec9

SHA1
f37046097245cd2421000fb4cb6015a798f3275d

SHA256
67930be5e03ea36666155ab9b63585b15a67163c32c8bf3438d7c86debb7785d

SHA512
dc2e51c13725145cb969c29a4b35226f707308271225acf5701f79816fc082faf0fd4dab0affb5f9751efcfacc627fcb55308794046cf3f44c1a9f7447b7fae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
ad3a672aba0b8c46573962f26ffb3133

SHA1
2f58987d4c938b57c2cbe6c97d972fc8376550e0

SHA256
c4db431990d377f69780bcafbf54ddc54dae41ea1d7b45a2638555c4a0b1da88

SHA512
71a0173d81fb73e447b590ceecaa1c967aee7cd77b18a2fed7a1991596c16222e1e0440a0124a35c08631020ec03f237e1cd494668009d52f35ab67ea8919c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
91acdf10084c79ec940c4e0133022581

SHA1
32fe9e20d9a8928974e4fbc23703e257e5b71600

SHA256
8f2e2009bcaa8f0e0d10077910c714b0a842e838e82fcc5b600df6a5e764419e

SHA512
7bd798bc67e3713ecf1e4fee64b35f7e21b859a5e15b4854a1b1e4c13c56683d402a348d125a3a5f3da48d7d855e8ca9af9ec6a721fbdfe9724f778285b8128e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbbd9285efaa4a968b5691d64cf1b5d1

SHA1
b59dca8ca38dcadc62ea66439411ac2886ced7f2

SHA256
b1344031226e14e2826cfd27fcf49b865b75b9e9faf08e14001747e4f1159b73

SHA512
4ee3bb116344ac3654b969a2aa6502d6df91ef8c6069ce63d93be6ff02f13305a92c036cfb365b6d221b699087d32fe5f1e17ca629e0403034685dcb62393eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
358f0812c7cdc321ae83dd6bb95be97c

SHA1
dac51410a5b01b6039c3d04a249231575ce18f1e

SHA256
6684648f0e7802f79c339a25edc9224f5037e65a1dcac83766f539a0eb7c0336

SHA512
02d1a7a202cd7d93ab99ef258e29cbdbb340bdc6e8c5a731413c96d2f77b8cb399690cbd45a633eb78027b25c014f023dbc307d264da9e595b5dffe51a33f8cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6cb61c10d7fcaa246552c6a9a56d8302

SHA1
95e6680d3f93bbd71084df9eb348a396079d3e8a

SHA256
398ef340876a99db37e6d235dca8f019510b964cdece3c09867c0ebbbfa6f20d

SHA512
3fc3cde198965ede9adecbc75e315c88dc903e477b46f9355408d1a92a1a3fec9290513a0bc2956911660effeba32b01452e90f2a06067e6061e40ae9f11ab53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1eb41340c48ca18876461ca83631b17

SHA1
16fa75c31a599172c404f4b5170a0e00f81609fb

SHA256
1a2fcfc615b4d2a5a678d4078c7c15ddf2ffa5bb7cb00425032a5b3db11a36d9

SHA512
71917b343042144817d86952f6dacea9f765299f61e2bde4c843d94ef0bd46b497b8b75fd7f3a04440a0d787d587f6fa10e1a9b2bfdb5ba4025261855d66e5b3

Download Submit
C:\Users\Admin\Downloads\GameMakerStudio_1.4_Portable.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/436-208-0x0000000000400000-0x0000000000FB8000-memory.dmp

Filesize
11.7MB

Download