Analysis Overview
SHA256
bf09875cb64f8b5c5b645baaaf6df787dc41d8c2289300fcebd5f66ccc7768a0
Threat Level: Known bad
The file C11Setup.exe was found to be: Known bad.
Malicious Activity Summary
AsyncRat
Asyncrat family
Async RAT payload
Enumerates connected drives
Drops file in Windows directory
Unsigned PE
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies data under HKEY_USERS
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-19 13:02
Signatures
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Asyncrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-19 13:02
Reported
2024-04-19 13:32
Platform
win11-20240412-en
Max time kernel
1631s
Max time network
1476s
Command Line
Signatures
AsyncRat
Enumerates connected drives
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Panther\UnattendGC\setupact.log | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
| File opened for modification | C:\Windows\Panther\UnattendGC\setuperr.log | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
| File opened for modification | C:\Windows\Panther\UnattendGC\diagerr.xml | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
| File opened for modification | C:\Windows\Panther\UnattendGC\diagwrn.xml | C:\Windows\System32\oobe\UserOOBEBroker.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008822cbff5a92da01 | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0cc76005b92da01 | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft | C:\Windows\system32\SearchFilterHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b650f015b92da01 | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates | C:\Windows\system32\SearchFilterHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b50b72085b92da01 | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie | C:\Windows\system32\SearchFilterHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039d543015b92da01 | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached | C:\Windows\system32\SearchFilterHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\quickassist.exe,-807 = "Connect to another user's computer to help troubleshoot problems" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580060280272230" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-113 = "Windows PowerShell Integrated Scripting Environment. Performs object-based (command-line) functions" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft | C:\Windows\system32\SearchFilterHost.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" | C:\Windows\System32\SearchProtocolHost.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2516240262-2296879883-3965305654-1000_Classes\Local Settings\MuiCache | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\C11Setup.exe
"C:\Users\Admin\AppData\Local\Temp\C11Setup.exe"
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\SearchProtocolHost.exe
"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
C:\Windows\System32\SearchProtocolHost.exe
"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2516240262-2296879883-3965305654-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2516240262-2296879883-3965305654-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 828 2472 512 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 828 2968 2948 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
C:\Users\Admin\Desktop\C11Setup.exe
"C:\Users\Admin\Desktop\C11Setup.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb48e1ab58,0x7ffb48e1ab68,0x7ffb48e1ab78
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4232 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4388 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4380 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4564 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4968 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3224 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4484 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3404 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2456 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4308 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3428 --field-trial-handle=1828,i,10199567974177743808,8394275536700032063,131072 /prefetch:2
C:\Users\Admin\Desktop\C11Setup.exe
"C:\Users\Admin\Desktop\C11Setup.exe"
C:\Users\Admin\Desktop\C11Setup.exe
"C:\Users\Admin\Desktop\C11Setup.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 104.86.110.113:443 | tcp | |
| NL | 23.62.61.97:443 | r.bing.com | tcp |
| NL | 23.62.61.97:443 | r.bing.com | tcp |
| NL | 23.62.61.97:443 | r.bing.com | tcp |
| NL | 23.62.61.97:443 | r.bing.com | tcp |
| NL | 23.62.61.97:443 | r.bing.com | tcp |
| NL | 23.62.61.97:443 | r.bing.com | tcp |
| US | 20.189.173.9:443 | browser.pipe.aria.microsoft.com | tcp |
| US | 20.189.173.9:443 | browser.pipe.aria.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.200.250.142.in-addr.arpa | udp |
| GB | 142.250.187.238:443 | clients2.google.com | udp |
| GB | 142.250.187.238:443 | clients2.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| N/A | 127.0.0.1:4040 | tcp | |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 104.86.110.113:443 | tcp | |
| GB | 104.86.110.113:443 | tcp | |
| US | 20.189.173.9:443 | browser.pipe.aria.microsoft.com | tcp |
| US | 52.123.128.254:443 | dual-s-ring.msedge.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
Files
memory/2108-0-0x0000000000DA0000-0x0000000000DE4000-memory.dmp
memory/2108-2-0x00007FFB3C400000-0x00007FFB3CEC2000-memory.dmp
memory/2108-3-0x000000001BC00000-0x000000001BC10000-memory.dmp
memory/2108-4-0x00007FFB3C400000-0x00007FFB3CEC2000-memory.dmp
memory/4772-5-0x000001D36C230000-0x000001D36C240000-memory.dmp
memory/4772-21-0x000001D36C460000-0x000001D36C470000-memory.dmp
memory/4772-37-0x000001D370820000-0x000001D370828000-memory.dmp
memory/4772-41-0x000001D370FE0000-0x000001D370FE8000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
| MD5 | 0c943d5807f66fd05eaf54b70460b716 |
| SHA1 | 8742f203c9f67681f02d957ead58b8911972d2bc |
| SHA256 | 0e925d935f62bf4b3fdced56bd3a66347f1fd2f5d75bc4b3a6fc5c5c74dd6fd8 |
| SHA512 | d23b577fa223237bad7c08b19a333780f24c942e70bb1c6800bfd97cfd6fef24af547b5d9392e149ddd5bbd151f0d1c4c1f31191aaf2dcb4aa7e1f17c9eabd37 |
memory/3732-54-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-55-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-56-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-57-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-58-0x0000020813B70000-0x0000020813B80000-memory.dmp
memory/3732-59-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-61-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-60-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-62-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-63-0x0000020813C80000-0x0000020813C81000-memory.dmp
memory/3732-64-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-69-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-71-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-70-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-73-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-72-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-68-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-67-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-65-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-66-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-74-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-75-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-76-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-77-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-78-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-79-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-80-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-81-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-87-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-89-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-88-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-86-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-85-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-84-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-83-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-82-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-98-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-109-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-110-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-117-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-119-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-121-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-123-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-126-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-128-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-129-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-130-0x0000020813F90000-0x0000020813FA0000-memory.dmp
memory/3732-136-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-141-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-152-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-151-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-150-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-147-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-145-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-154-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-161-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-165-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-168-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-173-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-184-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-187-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-188-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-191-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-193-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-195-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-198-0x0000020813B60000-0x0000020813B70000-memory.dmp
memory/3732-207-0x0000020813B60000-0x0000020813B70000-memory.dmp
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
| MD5 | cf759e4c5f14fe3eec41b87ed756cea8 |
| SHA1 | c27c796bb3c2fac929359563676f4ba1ffada1f5 |
| SHA256 | c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761 |
| SHA512 | c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b |
memory/5088-228-0x00007FFB3B000000-0x00007FFB3BAC2000-memory.dmp
memory/5088-229-0x000000001B320000-0x000000001B330000-memory.dmp
memory/5088-230-0x00007FFB3B000000-0x00007FFB3BAC2000-memory.dmp
\??\pipe\crashpad_2364_YKMGGSZHQTEBVHQC
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 794d92f8ecc1ebb1117a44ef6ad19e90 |
| SHA1 | e1c9bc3dd9d610250db897ade9bc442eae6953f2 |
| SHA256 | 9a39cf3d8a11b70bccfd063f46b6a82f7095a04abd218026d6c352bd208426ad |
| SHA512 | 7112cf2f83851d28b105a80f33828cc049af0dea7b3107dcfae861714b01e60dac114abb316d47d06e145fe16eef135bc65be0f235ec120adca3c3b3a46fd9f1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 03de09ac4cff29496111659fa598ba40 |
| SHA1 | 8a38ed6819b9cb28a3cab8d647b5187068ac1341 |
| SHA256 | a5742850dd506a9c0a7e3febe8ab6fc2f4c83c2e2e12517cc1be4c050cf983e0 |
| SHA512 | 1ab8853a835834a946418197934c8efc7aa7c7168b59bb42aaf767053025c57a90f434fc892aa0391518747c370cbc3c8de0da74473461ca05613707bcdb26cd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 2de65c2ec4551c20bcdacdac203caf12 |
| SHA1 | e6b3ba8c5e40a54fc77c1a623f1d257b892824d0 |
| SHA256 | d45ab6211ec82877f134d98c7ac4b604f5f1d1ad48ffce5623a07d1489ab7985 |
| SHA512 | c18397f29b86f9d1e848f7c79380062692cffeec4a6fa5d515ea7629460fb6ef77c7a3752bd5a27ee11f53599b405980fff23b226afbc71312f6d33a29d7f204 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | dfa614c266ff324dafbc355dd09ae99d |
| SHA1 | 82de269d59b4e4aa37c298847d3316cfcddda119 |
| SHA256 | 188a8491732233ab3732b5bfe9da5831cbf3da931913ee8482a75edba8cf5af8 |
| SHA512 | c51ed50fe3893baaaca7cdb5d6dc6fe655a33133e3f507cb8af726a9ae239f88426fedc1be463be2795b887d09f0adb4da1ffa938448c0a514ec0b5ce5aaba6f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | c108cb7c5ef7e744196dfd41be1c140c |
| SHA1 | 369a1c310f28b41a76843a8f83a62f91af7ca2ad |
| SHA256 | 4784d90fd1b85b231dc7b47666dc1de1d6198f20c5a15c3b50ef4b8ee7ac3eac |
| SHA512 | b536bf8bcaeecf1b5eb1a29af9f67f53a41ce3c220bc304a0a5f8057f9aa65f5435a10b224a1b08c5b6e2c814ed24f3218eb664a0247714cd8281ae62d570ea9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 9423ef6ed87ac0db54b95d6710800964 |
| SHA1 | 51ac5d2006ec1e89cf1bf0037e627d8681c963d8 |
| SHA256 | 2261202a405a9b0c0c59e472e548ea38ff389ebd08affe0356ff3f0fc20a9f9f |
| SHA512 | bb4152c49580c7bc3fb9553292a42836f41171c38bd6d24d6a8a7917bd0806f4f23da728f2728eb805fe2f352829476ed4ed0680edcfc452dac6a901656cca7a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 3e7e42d72884eedea19658cf70777b7d |
| SHA1 | 28dc4315b4b4e81ffc8ce9f1dc27c202bf27ffdf |
| SHA256 | 0e2703799ab2ac2e83630b1451966a5270be641cf478cfb14f7722ea588a555f |
| SHA512 | 78e8a752adc7e5bd7b4ed01ab84ba5d6fa8a1e13906b7ed6df0d8e41a4bda19a3529984a41bb2744c28be5e974380fcbd65932d7fa40889fe7f2ad5879d27789 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 9aa0d9dc1217fcbfc7b5e317c694065f |
| SHA1 | 568e54a3a62b810bf35709edafab6b37fc751438 |
| SHA256 | d45712595b81f4f1fee86f0ec6729386b4937eec195b36a5bb3d15370ef9ac17 |
| SHA512 | 9b5243667f003520cb62b306451feb9398525eef3c864d9971ce6f525b44afdfc048525c63839e9e183d7aad2ae6da71d61b91b21dd36d096e3d0a496e047d17 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | b6249fcf2a13daaeea80e249fa9dff07 |
| SHA1 | e1f5d37c74e76e632a7a5c1d40edf1083eb51c40 |
| SHA256 | 3dcfcf72c9ab5c056fdd69aefbcb3654563cdf04f919b93e728db7b4c98c895c |
| SHA512 | 3cce7d84a311aed1b7651070a24d0d2fc36af52306452aa6f78c3988a820bb8f9da0807382721f7942d3fd194b0ebb0535ec5b38d356cb4f09edabf1c42868a9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | c1c369fca1c774deb0c8825469ebe1cf |
| SHA1 | 35bacce99a0d4f74c53718c27c40da40437dc9a0 |
| SHA256 | 54fa7cadc4b9bf3e4dbfc113f62c30b80a0e7a6ddda925e9d17a16947be8649d |
| SHA512 | 295a6c900237114778ed406d0181ced7945b807446e5a2e52975a705272dbf98ccf8f6d5d6595e73bda9e327ca9a59032ad2dda383a4ce74eff2edcb4a321456 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
| MD5 | e0af8aa65c6ba429f9b14bb2e03049c2 |
| SHA1 | 62b279115c2a0d769b578b0a5d0c3cd7ed91c46c |
| SHA256 | cd068569a48882804adc7b723193f800012a3abbb93495153378a8bcec51f159 |
| SHA512 | 82f4e71995e80cbac5d752116cdf997b63f988b15c19713d7cd8df8474c09141803f397322e3a9a14e2be545b17c648b5a32e55f6de71d231ddc1c27cf08d805 |
memory/1664-455-0x00007FFB3B000000-0x00007FFB3BAC2000-memory.dmp
memory/1664-456-0x00007FFB3B000000-0x00007FFB3BAC2000-memory.dmp
memory/3440-457-0x00007FFB3B000000-0x00007FFB3BAC2000-memory.dmp
memory/3440-458-0x00007FFB3B000000-0x00007FFB3BAC2000-memory.dmp
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
| MD5 | 54c605c289c05a552eb0db67ffc95c11 |
| SHA1 | e49ee1a50fcbda496a33adda5d3df0bb207f5b7e |
| SHA256 | abff00bea6c2396227287e9cf5e1fa44c06fe62abf3f775fd82a8f2d0e5a6148 |
| SHA512 | 13f562a6b792d32bb3416e5f4aa4efd0070efdc297c99b838d9444735c1ad20a83b9cd1d82e9d2b37329747fa0e1dbef7ece6adbbccb5204ee6d313966bc0e57 |