hxxps://drive[.]google[.]com/file/d/1Z4zj9tjX--d4gUPXfFuLW1IKlS3yvdIg/view?pli=1

Resubmissions

22-09-2024 16:13

240922-tpcthayckp 6

22-09-2024 16:12

240922-tnh9wsyaqf 6

Analysis

max time kernel
49s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Z4zj9tjX--d4gUPXfFuLW1IKlS3yvdIg/view?pli=1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com
12	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\.keys	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\.keys\ = "keys_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Ȩ	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\瑴is\ = "keys_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\旺ᨀ耀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\旺ᨀ耀\ = "keys_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell\edit\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\瑴is	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\keys_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Ȩ\ = "keys_auto_file"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
900	identity_helper.exe
900	identity_helper.exe
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3480	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe
3480	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4892	3624	msedge.exe	82
PID 3624 wrote to memory of 4892	3624	msedge.exe	82
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4736	3624	msedge.exe	83
PID 3624 wrote to memory of 4732	3624	msedge.exe	84
PID 3624 wrote to memory of 4732	3624	msedge.exe	84
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85
PID 3624 wrote to memory of 3184	3624	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Z4zj9tjX--d4gUPXfFuLW1IKlS3yvdIg/view?pli=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc77046f8,0x7fffc7704708,0x7fffc7704718
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11045196466483700794,8285460373938130087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3480
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Ryujinx ProdKeyshub.com-v18.-1-0.zip\prod.keys
  2⤵
  PID:2116

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Ryujinx ProdKeyshub.com-v18.-1-0.zip\title.keys
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
0f854627cf861b5f8bf106e76bcfaf1e

SHA1
684d0b9d6dca9e800148d35facae2525d5acb943

SHA256
bff0180cce4716de0d26c3ca271a551ca2e39ce878e96dae632346e673f019dd

SHA512
35a098726043cb3cc3968ffe6b99984e60bf47ffd934050f8afedfa0ac9c25babe83e1dc4daa3351c2aec8ac754fc1d98333fa8750cbf226e144d02c3127e2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e0d92dbfd8a3927574a95af070b6369e

SHA1
f691df538ca36c6a59c2ea488c5a7c6eb495ce26

SHA256
fddf1e00bbeb78ab0628845c0a179bc76bda0cba14099dca7ec4f743d0cba541

SHA512
daa3c390b124c74f9f43f7542b6178fd02aa5bc501cf2c8f77c702fff3b6454ac3db1711dce45c6d50f04248f5608674383ae1e6bd61383f683b73cb5db0b8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a892a73287d33b1dfa09ccbc2a86b3f

SHA1
c0ca100ffa9aba5ef08412b31ac30270093bdfee

SHA256
973e1ea5349aaa9fce45219246d732a45f066dd1a495619e0f8ebd75f2fbc03a

SHA512
2ea709d98a34de5866ecb45ce0c12e6d0c2d8aad21159ff0d0a0f5475e78af09ddc3daa9f9dffa059a31d51bfde34967c48ce9ff343492bf4b7f84e192f0bef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4c36d5b276500b8d64150e57a5c3f84

SHA1
ebdb2f38fe0cec63e7e3c8ea22b588115cc614e3

SHA256
e701f4d61a920f80216e0d0593490dc489e113cadcd8c05e3f85a8c085e0b8c2

SHA512
fa21042abe3f5818f4323d0e1c968ceddcdfb50dfa8ce016c2fabb2444ca0a3ac7394018545dac9a9cfaa14d099c90af9894fbc925fe5614ec99ceff249335d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6afecfa09f7804207ce86eaf96c3a7aa

SHA1
17cbc71bf203723c5de481ddc1340dfb91f260e9

SHA256
7ebe242187a01b2fefdcee3e6b31339d542e906664294d329c2f36ca60db80ab

SHA512
251ce2f877998ca040bafe3d1272377f5601a86066f239724e50b05a837352e6b7284dcbcdb60ad653e9170f3b6ebe27c0c872b466eec501d4b467c3042b0813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27d14d8edb862a3b0eefabe607e4c710

SHA1
6e7720b1508edc372f5983d6de0470b76835d6de

SHA256
872b0e172881bea80d5d033edcb42d3738c7de13ca527ef489ef8971b1f027f9

SHA512
49767791d0522075e0dfd690fb4b3efe56dffff57c9a33b9f0b0ce6ab0511bb5d64a0d71480b988e0e1fa8c22defe1bd9486386e18c68ff8d7bf4fd89f951113

Download Submit
C:\Users\Admin\Downloads\Ryujinx ProdKeyshub.com-v18.-1-0.zip

Filesize
6KB

MD5
46705abc0d734c1b38eac0aac18dfd05

SHA1
0ceb05e5f4038d98fb5f3cb97f8a2808962eab81

SHA256
d9086581d7989d0b5a5ab012ba78cec75b4d26a4ea42bcf37247ecb7a7b6258c

SHA512
2e4e3ee05a08f92afacccb2139281d4dd4d3fa9782208b78ed084b68e39a9f418096e9c8709b00a96540a2180d987858d7c130c60fd45aac35e3037b819439db

Download Submit