hxxps://cdn[.]discordapp[.]com/attachments/1253476705885093940/1253601576019562569/catgirl_1[.]21[.]dll?ex=6682f932&is=6681a7b2&hm=ecec821da5fe1d40f601755020a4bf92cf63e3d286f240bfe40c204d20a10cbf&

Analysis

max time kernel
690s
max time network
620s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1253476705885093940/1253601576019562569/catgirl_1.21.dll?ex=6682f932&is=6681a7b2&hm=ecec821da5fe1d40f601755020a4bf92cf63e3d286f240bfe40c204d20a10cbf&

Score

8^/10

themida

Malware Config

Signatures

Downloads MZ/PE file
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

C:\Users\Admin\Downloads\Unconfirmed 565190.crdownload themida

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 565190.crdownload	themida

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642532275179430"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1004 chrome.exe
1004 chrome.exe
4544 chrome.exe
4544 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

1004 chrome.exe
1004 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe
Token: SeShutdownPrivilege	1004	chrome.exe
Token: SeCreatePagefilePrivilege	1004	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

chrome.exe

pid	process
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe
1004	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1004 wrote to memory of 2420	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 2420	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 4432	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 3656	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 3656	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe
PID 1004 wrote to memory of 1768	1004	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1253476705885093940/1253601576019562569/catgirl_1.21.dll?ex=6682f932&is=6681a7b2&hm=ecec821da5fe1d40f601755020a4bf92cf63e3d286f240bfe40c204d20a10cbf&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8964d9758,0x7ff8964d9768,0x7ff8964d9778
2⤵
PID:2420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:2
2⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2004 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:1768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2828 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:1
2⤵
PID:2644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2836 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:1
2⤵
PID:1324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:1464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5336 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:1320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5320 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5596 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:8
2⤵
PID:1640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 --field-trial-handle=1740,i,13185136708851476715,15412022047040028993,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
678B

MD5
f4d7d2e0a65e33fb8c59e98fff1d4a33

SHA1
4e0ac303e388274ed8c425e252e62b0e0ebdc6bb

SHA256
9308071bead1b3ad5f2e7dcae9db5e7aafc7c509d0eb93d497fcc520a58208c8

SHA512
fbf02c7d0a14d8926212f5a31ce28885f7b1c9a554c18cc050873252958047d1ba58d7a2e5917b752c30bd5433e264542c746008c1dc29e34efc5aff64f35588

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
751f7aee11bd4be1ae38179213241635

SHA1
4c7a111f765a8fdc2748bf8b0e8a3507b510adb9

SHA256
dc6c6658583bd07dd709b04dc27a8c12c65cc7c428f14e260eaef949a79f4ffc

SHA512
fa694d09f3a0fae61bc0ea5a69068c762ea0d42dc53685627f45df84b0908685ff012717d3a1771cfd38363e1eedd9ff48eb4a41f8adcc1a365a03dd6920633f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
78027098df458882e6959bafb524198e

SHA1
4110a9597f48bb1eddf6cd75e69bb5c7f43badbb

SHA256
142e104cb1d54211ec64258026cee64310f42e17d4a87f850768148ab23a4ac2

SHA512
a92fb87f28e0b64dcaed8c4a8d609f95f88fa64b07af40eaa92bd12436d499a37f2a461b152384d1c3bbb7bd2478503a0a000892da0ea34bab516d41fa3917c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f87d0593e30747e5f2aefd14cf16d2d8

SHA1
c6e946a97acfc14886902f508da6421aeec1be6d

SHA256
db40bf218b39b60c9d420bcfbdb12f2f364a1d79ba2806edf873d071f3da70ca

SHA512
8442acb3585c5e4600e83f17af9bab0f450d6700c19e99ccf63306867c41b7f6f4db569bf43ef13030500def632ac9daea8417e5f75761e27fce3f1dc5edcb56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
93bcda014726b9fe4200103b72135aa1

SHA1
5ae4b9e195ebe30ff9aae28bcb79fdb84054b9b3

SHA256
8911027f6965fa77b342077fd15b3e60edad114330e6089c3b0f3f052457e310

SHA512
314cdd1d43ec3cf39753bedf0dd92375eb2f883433170ee4fd60125abcfc7135d25aa7a9c37ac756efab1bd8d71fa39e8bbeb0931d5cc3a6084e3015cbe76b38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 565190.crdownload
Filesize
6.8MB

MD5
85c9c29093b3097df94a680a8345e631

SHA1
9d45177aa70eb3c18c4a1896335533e86618d7d6

SHA256
bc0fd649456fb61a9b11c1194ce3398254344e1e26f586b1f910cdd1ebd98d51

SHA512
5293de3a7d4f5a373b8dc4f9ce64ce259f21e5d72b7e8020a8345f1956091ec3d2a0767ab3477764a7924e0f9ad1261bf8f113015535acfe4468d666a7febd97

Download Submit
\??\pipe\crashpad_1004_JUGCFQFYNVQYAWWP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit