hxxps://www[.]mediafire[.]com/file/kydby9iy7ks7pfc/KASU+V5[.]rar/file

Resubmissions

23/08/2024, 07:51

240823-jp4xwavdql 5

23/08/2024, 07:48

240823-jnfhwssdma 3

23/08/2024, 07:45

240823-jljsjavcmk 8

23/08/2024, 07:42

240823-jjnzgasbre 5

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/kydby9iy7ks7pfc/KASU+V5.rar/file

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
3308	msedge.exe
3308	msedge.exe
1496	identity_helper.exe
1496	identity_helper.exe
5688	msedge.exe
5688	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6044	7zG.exe
Token: 35	6044	7zG.exe
Token: SeSecurityPrivilege	6044	7zG.exe
Token: SeSecurityPrivilege	6044	7zG.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
6044	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 4028	3308	msedge.exe	84
PID 3308 wrote to memory of 4028	3308	msedge.exe	84
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4744	3308	msedge.exe	85
PID 3308 wrote to memory of 4340	3308	msedge.exe	86
PID 3308 wrote to memory of 4340	3308	msedge.exe	86
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87
PID 3308 wrote to memory of 3564	3308	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/kydby9iy7ks7pfc/KASU+V5.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbdec46f8,0x7ffdbdec4708,0x7ffdbdec4718
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1334736397118358828,119458351824254936,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5832

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\KASU V5\" -spe -an -ai#7zMap27052:76:7zEvent5481
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\WINDOWS TWEAKER\explanation + credits.txt
1⤵
PID:3084

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\REGISTRY BASICS\READ ME.txt
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
45b60adf6112b3070e68b5493c860efe

SHA1
95efd9ff42831b7bb8a2ca8c26e6ab421b3fa4cf

SHA256
39f6778f7fd0bfdf9961b7ccb3c83fda0e3443c710a1ac410eb724666ed1f3ff

SHA512
07b134ee8effc3d313119727e879b5690bef3b236a870ab8d5791db4fba9e0c0165287e93a143818789927f55b86c63224c6bdf2c2893d0df62b655fb2822b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f7649470f0b5c0722c4bda6c6a152dd6

SHA1
b2b4ebcacbac9c2be96ddb6b63b0c3fb6bb09e3c

SHA256
23b4c0d58cd286226d0e68040d40dfcdb48699c5925c7492f016f1f01c28575f

SHA512
b5dac40fce8e626b60094ad7f5a55512f3a2cb32ea7156aea6091104737c0ef949918d2e35adb389eb5092ef197eadcf056f747541ca50df8fbe606446a00e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
45fc44e3c4ed96a37d95020509e0fb1c

SHA1
3e7d0ab75a4771e611056d566a4dc19059b67941

SHA256
3c34c7e7a93798fb5a3012780b26a0822707de9648786c71c1ac72e3651a64cb

SHA512
9570c6afd5d223583528e6ae1e8a4dd1c2403ae16faef9f25ac52762c949c7f72c886c029ab1f247f56109cd82fb67ed5fee866fd34a4684b9d4eef982f7e415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8151328b2982be84b0c6ddf8247ae3de

SHA1
6d64767151a728b7b8577bbe00fbf7bca32ba3b3

SHA256
9cfb1d978eb3da0d2894ebaac14754525dd316a4cdc8b771ff9a88507261e04c

SHA512
db29eb237b778119d18698062525ce03c7170395c362c2b8680bffd8d68480e5c24bfe3998c9f03e8267da65b4e40b73d9ffa447ace8e92699d5a389ea001115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5d4386f82291462bce439dfc52bee951

SHA1
9d2c4762dbd68a304aaf79062078575694a8f9d3

SHA256
0652101e8ebb3821473172dd5a311e792c98682d1ffbea7ecb29bc5b50b3bbb7

SHA512
6bf4ff64247d7543f823df88349f81943c0e83c42a725d04a5ba3f0f334a019ce9920a1bc6419b592787bbf19b867bfb4118e9fb05ebe039f09aa127df9724d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab3b5a242e5c0fd83666658de4a8ffec

SHA1
1c2ba816998ee39b6ff6acc2aaf9000a0eae31cb

SHA256
72624c3e1aff8267b7204620f2df5ceb0bf006f009d4981fc19f2af677159153

SHA512
7cc3193d531f06d8a9d6e7e3fb4768e209d30705f31606a94d533c3b0f0f8f473d93577f3bdb55fb5ae8c99817b3d406bd74969a909c282ae5014a845f0224de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
90fded02198a5673da38fa1f5a01ba1e

SHA1
dee182f8a0280def4c7d63661edea806bc052dcd

SHA256
2b714b0202c1bab4d603f1cf1df998861e5d59ebb5fcbfddbb250c064002da01

SHA512
69881f8ac6b66969a59be9747592e0a983eeed0b519dbecb99503071aa8389e67ca1081bfdc2ae01b531335b7b87697faee9f2859eb180e010b4b29e901b0f0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
339d042ffb4672c564aac9116df077c1

SHA1
7e60288d15f61af222b382aa20af3d61a2510b8b

SHA256
997759be33eeb3242d211a5e252bbc6321005f09a5d4de7bd42967fb2da87ec2

SHA512
d3968b36e68947424317612013583e58df3bc98566a0b9ea6ec9922a778f2135d0d530f7272eb9ef5ecc922e5d53d3d9283431cc91f88cd04ccf0f31b475b66a

Download Submit
C:\Users\Admin\Downloads\KASU V5.rar

Filesize
21.5MB

MD5
522d76cad51e0e6eba24fb2556cdd506

SHA1
503b1bf9251af41e946069760ebee7ada28c6f02

SHA256
f8afb32af7d2f0c4e60aafad88e046c10d21d8162a81b84a55066993cf443e00

SHA512
d36823c2543d18b6bb628c62b64ddb21c7d3fb30ff0c75303fe94eb397e0bc35a6d99e68762c0d4ee16d7696fa5b370f2a890b1b06af05503bdf53c16011bec1

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\REGISTRY BASICS\READ ME.txt

Filesize
81B

MD5
4e90a4b9131f7adfc3c34aa9d077b273

SHA1
c430d08b1bb7ce33d100796f0dde9ab52bfcd8af

SHA256
420a408012dd15d143ba90e5536ae91f123149618c689cc48e2180253f9612be

SHA512
ea2b492f4dcc18185703613688c7d8e9a3df64702a5c8962477f152ce0039585a6eb960b54fd575f31939bd3f4568d12d52c1a78d27ec0cd50c15c7115628eb1

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\ROPRO CRACK\RoPro_Rex\Extension\_locales\en_PH\messages.json

Filesize
4KB

MD5
94a75b93caacabd05bf1a0987a14afae

SHA1
7a0606f4c9c8a8937dda955f9e2df6aae3c1da75

SHA256
21706c41c93af0d4b8d23c822e43c5b7d7011c9f4ed5048a5aecf12a0f785ac5

SHA512
103973cc303bd12d422ca329f9770eecdf5253bdd836aca681f9ef3f9818959a157621e7a61fbcdef8aa9e0caa67085ccf4c75379b1f67da0034a276a9a00a52

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\ROPRO CRACK\RoPro_Rex\Extension\_locales\es_US\messages.json

Filesize
4KB

MD5
dda454c66f68e8ae133b96078358b00a

SHA1
68a61271b24db6844776e56d19e256479252679f

SHA256
8ec49f381698bf428b7ea8f49fc6208479af3451d09a1223d4d24f93483c4438

SHA512
6d45a90ca2dea977007cc729ae580f44895bb32443aeb40ed2949b8a754cfaa1309484eb86a42a24bbdd9c53afd1e0517c5b55e8648d2dc3f3d81bdb1c1a0d07

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\ROPRO CRACK\RoPro_Rex\Extension\_locales\no\messages.json

Filesize
4KB

MD5
bd4c63bd77cf9e9d71a6879c935cc566

SHA1
ba9dec87c2a1dcdfc3b778eecea20baa97432927

SHA256
5013bd334055df78a365532496d3c1eb1e26315bb552f79d2bf6f37f9b836431

SHA512
385b14b22cd791f64d7adf1955f0ed05f6dfcb85b5821ab3dd4dd1d0525952bc82bed72739bb4b40d5883205b48e4d6d28e507a42b84663d73b20da5790bca47

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\ROPRO CRACK\RoPro_Rex\Extension\_locales\pt_PT\messages.json

Filesize
4KB

MD5
d0b1e7acc802bba89e15c735c81e0f02

SHA1
9ddbe137afe5640aacde424bc93e994523bd0b22

SHA256
4b1f62dc79f3f1307bd916efcae0204b69f46734ceef420d46aeee469c24793a

SHA512
1e9629c0f0e52535b0d93097afe1fb49c8fc9b700b295575f1c31ae227b99a2269bda4e10489dcc5b93cf00d9a5c7b0045647b1d1fe73c30d755ddbf8f0d48fb

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\ROPRO CRACK\RoPro_Rex\Extension\_locales\zh_Hans\messages.json

Filesize
4KB

MD5
671be8f15414f65774a8ddbe668a8d18

SHA1
bc84bb42cd2f63d99573fb91575361481d90c71c

SHA256
d158d4efddf442b65311bf433aa5449627225ab7632f519589879f355fa883a3

SHA512
4102268aa07d374aa272d5a4fdab90d4b35febc360fd1905167b3e1653de490166a0611ef1af8023548ae9761a2b597978394c2e93a27e029d4c6b04e6e7bf47

Download Submit
C:\Users\Admin\Downloads\KASU V5\KASU V5 (1000 FPS)\WINDOWS TWEAKER\explanation + credits.txt

Filesize
595B

MD5
2ac7a23bea606ca785298565efdd5054

SHA1
0fa57f5d286bc81d1ac5c00a2d1030b7ca783bba

SHA256
d415c39ff7de8ee8d39dcc96c77c04b4e8ea91c4b5457969a019b9f7f118c9a6

SHA512
dd454ffc2844fb32fded8bd49633e1b30217f4d30ced37a5a122e3a770cbcb460920381f3a054f4631d2279c627adad58905663c3a8284bbdab8cfab85f2c2f4

Download Submit