elysiumstealer | 7bcbc81dbfbc85b4c7c40f44931788a814ded426317e6ea9456cc65c37341c92

Analysis

max time kernel
1s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c37879689505f683c1e07b86b8aa7f2.exe
Size

559KB
MD5

4c37879689505f683c1e07b86b8aa7f2
SHA1

58484777d59af5378002ee6cd686525f26449098
SHA256

7bcbc81dbfbc85b4c7c40f44931788a814ded426317e6ea9456cc65c37341c92
SHA512

0b6615a38a67e922527edc694838afa2e96db58ab4f09c03fdf3e71a49bbab6e74addd54efbdd56a25c2bc8fc74e60d8a58409e2c471421438d3193df88acc74
SSDEEP

6144:5fqHpILYw0mlefjZJnu3GHYKDcOuhHovXIslLMJsd/4TelpDtrRA6Ts5v3FNR3:xq2L7UjX0G/xvwsrSeLlTst3t3

Score

10^/10

elysiumstealer stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

4c37879689505f683c1e07b86b8aa7f2.exe

pid process

5116 4c37879689505f683c1e07b86b8aa7f2.exe

Modifies registry key 1 TTPs 17 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid	process
4956	reg.exe
4904	reg.exe
4276	reg.exe
3976	reg.exe
2796	reg.exe
4052	reg.exe
684	reg.exe
4156	reg.exe
208	reg.exe
3328	reg.exe
1108	reg.exe
740	reg.exe
928	reg.exe
4704	reg.exe
1408	reg.exe
3028	reg.exe
3324	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4c37879689505f683c1e07b86b8aa7f2.exe

pid	process
5116	4c37879689505f683c1e07b86b8aa7f2.exe
5116	4c37879689505f683c1e07b86b8aa7f2.exe
5116	4c37879689505f683c1e07b86b8aa7f2.exe
5116	4c37879689505f683c1e07b86b8aa7f2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4c37879689505f683c1e07b86b8aa7f2.exe

description pid process

Token: SeDebugPrivilege 5116 4c37879689505f683c1e07b86b8aa7f2.exe

description	pid	process
Token: SeDebugPrivilege	5116	4c37879689505f683c1e07b86b8aa7f2.exe

C:\Users\Admin\AppData\Local\Temp\4c37879689505f683c1e07b86b8aa7f2.exe
"C:\Users\Admin\AppData\Local\Temp\4c37879689505f683c1e07b86b8aa7f2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic useraccount where caption='Nemesis-21022' rename Nemesis-21022
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where caption='Nemesis-21022' rename Nemesis-21022
    3⤵
    PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3224
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d I LOVE PIZZA-9745 /f
    3⤵
    - Modifies registry key
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d I LOVE PIZZA-9748 /f
    3⤵
    - Modifies registry key
    PID:740
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:800
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\Software\Epic Games"
    3⤵
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1020
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:668
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:740
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4048
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3672
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:644
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:3780
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:852
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:4204
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:1044

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d PizzaXYZ-9742 /f
1⤵
- Modifies registry key
PID:4956

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2960

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:4320

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
1⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 9748-30387-32368-11106 /f
1⤵
- Modifies registry key
PID:4276

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 9748-30387-32368-11106 /f
1⤵
- Modifies registry key
PID:684

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 9748-30387-32368-11106 /f
1⤵
- Modifies registry key
PID:1408

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemSKU /t REG_SZ /d I LOVE PIZZA-9748-30387 /f
1⤵
- Modifies registry key
PID:3028

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\1 /v ProcessorNameString /t REG_SZ /d 9752-8367 /f
1⤵
- Modifies registry key
PID:3976

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\2 /v ProcessorNameString /t REG_SZ /d 9752-8367 /f
1⤵
- Modifies registry key
PID:4156

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\3 /v ProcessorNameString /t REG_SZ /d 9752-8367 /f
1⤵
- Modifies registry key
PID:2796

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine"
1⤵
PID:4848

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers"
1⤵
PID:3924

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" / f
1⤵
PID:4876

C:\Windows\SysWOW64\reg.exe
reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
1⤵
PID:4040

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:720

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /v AccountId /t REG_SZ /d 9758-29864-20424-17760 /f
1⤵
PID:4984

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v MatchingDeviceId /t REG_SZ /d {9758-29864-20424-17760} /f
1⤵
PID:3088

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v NetCfgInstanceId /t REG_SZ /d {9758-29864-20424-17760} /f
1⤵
PID:800

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /v Machineid /t REG_SZ /d 9758-29864-20424-17760 /f
1⤵
PID:2436

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString /t REG_SZ /d 9752-8367 /f
1⤵
- Modifies registry key
PID:3324

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1576

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {9748-30387-32368-11106} /f
1⤵
- Modifies registry key
PID:208

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 9748 /f
1⤵
- Modifies registry key
PID:3328

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d I LOVE PIZZA-9748 /f
1⤵
- Modifies registry key
PID:1108

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:1568

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d I LOVE PIZZA-9748 /f
1⤵
- Modifies registry key
PID:928

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {I LOVE PIZZA-9745-19638-14503-19811} /f
1⤵
- Modifies registry key
PID:4052

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {I LOVE PIZZA-9745-19638-14503-19811} /f
1⤵
- Modifies registry key
PID:4704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2592

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4944

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Filesize
2KB

MD5
dff5049d89c2ebece4faf7ff00457676

SHA1
9fdaf09383b7cf3210a5ba1273e15fcfde483113

SHA256
7e3c973ce2e086e824e2658d0ecc8e726c7f18cb313a8add6d749153447d9aad

SHA512
d7346fad4391ab101aded02846575e600aea867626bcb9ac5aae405a02ae3e3cc257f80e997763ad2b0c272940a1b977cc7a778a1270e9c667948b30cf2f749a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

Filesize
36KB

MD5
ab0262f72142aab53d5402e6d0cb5d24

SHA1
eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

SHA256
20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

SHA512
bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_

Filesize
36KB

MD5
8aaad0f4eb7d3c65f81c6e6b496ba889

SHA1
231237a501b9433c292991e4ec200b25c1589050

SHA256
813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

SHA512
1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\apps.csg

Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\appsconversions.txt

Filesize
46KB

MD5
6edbd101a14d7394a1435a6ef6002314

SHA1
c36caa495ddada12a930eba81fa012856347717b

SHA256
361de409f0eefc694ca46c56987e513e0daec8a8bb34b57b558d4c3164b3e25c

SHA512
44169301bf519e112d62d3f1b460832c8d712f4e722269d8944faca845e52e503c3919f2f3c49f9de903664abe593ef51471aba7897d757a4a2b228c2fffa8f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\settings.csg

Filesize
454B

MD5
411d53fc8e09fb59163f038ee9257141

SHA1
cb67574c7872f684e586b438d55cab7144b5303d

SHA256
1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48

SHA512
67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\settings.schema

Filesize
162B

MD5
ac68ac6bffd26dbea6b7dbd00a19a3dd

SHA1
a3d70e56249db0b4cc92ba0d1fc46feb540bc83f

SHA256
d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031

SHA512
6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\settingsconversions.txt

Filesize
58KB

MD5
4abeae9f173b42bd1420ee17ceab3603

SHA1
8fa8815bf4418b2f0249153b7cb0bfe32645235a

SHA256
e604c393d3ec9c3296e5a2a6ea4177c8786cb0bbcce18211b20bf4ed6f1e7105

SHA512
80bc2fabfbcd33227722f285ddf224b7175e16ac0f84ff6f8bfe010e3550eafb683c796119bd8632de9252f155329c6d60fa37a561a896ae7cf48f491f3ab718

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\settingsglobals.txt

Filesize
22KB

MD5
dc25bdaa19c5ea0d369765cfbe960ef1

SHA1
14eac5b55dfa098bc3c25bbea534b1d6ef87ea38

SHA256
3961b7563fc812bb054d66514545192c2c6524003cc62bfa575be1795979f38c

SHA512
c3ab0f07559fef28280621e8c3101d6b02ea668d4c917577e1f33a365b2ed9675ca3a1360dd9a5f3b044e95403ae0aed2a11f4adaa69ec74c58563ada31fb217

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{56afd99b-b64c-4000-83a8-953f51d08f0e}\settingssynonyms.txt

Filesize
3KB

MD5
3427cd30c9ebbf9b66227f958c80fe18

SHA1
23cd9f5fb15914e70eabfaf3cd2d9511905d96dd

SHA256
7dcdbeb601b45f72ab0a076a7a256e285fce72a72de5214fdd3a5dd8cceac36b

SHA512
085babba9ac101afb7d786f91897ff6def39c5c862c0a925851dcb0b7aa67383e860679560d2320a7a59fa3234f9514cc464ba6fc06c4f7070e600d073c1cfe2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{974f1be0-da42-46e0-add1-611aed51099e}\apps.schema

Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{974f1be0-da42-46e0-add1-611aed51099e}\appsglobals.txt

Filesize
27KB

MD5
7d99010fc46d4977036bb3c933f51ea0

SHA1
9f31c420e577184897c9be670e02a9057bd7b616

SHA256
e28dfedb4177175b65a87bbf9bd1df8aa45f68969758b06384476dbca1155fed

SHA512
67189426eaa64c2eaea12513029064e4f0f7fadd658ad8a282b9eb1597e7c616b69290b6ff20142fab9dc94e6c0872840fa73d5c433a73bd3d9e120616aa5a37

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{974f1be0-da42-46e0-add1-611aed51099e}\appssynonyms.txt

Filesize
5KB

MD5
dedb249606e450f82ccc53f15003194a

SHA1
da006a7f152d5edacb7e841ac4da8df645ca3721

SHA256
f950b382221cc8f8e8931dfd355c71c7141df5369646b4eed96ab6620824c913

SHA512
5f021eb212c0cf4b4107c7ac31f541c4a11d04bb16f618ab4f08fe51cc21fb027f1e756bdb4cbd7966bd2d4524bfa9aa0410f21314c0b957b4090a434b291fc2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133492141213079047.txt

Filesize
28KB

MD5
ca498169dd23b62112cd958502aad5d7

SHA1
19d4139c32b31c6f8ae1e7f0ba670037f0f39ab5

SHA256
5e217d3defffa37c9235763836cc4e6c63b439d1d14402443d468ddecb1d1a17

SHA512
0529a96e52738119d0072ba39aee7d9e81092a24592b3c71b826eb1a25ec4aeaa30a1c71f7a895a995524933301d84d88b1ca148c8df2609d24db6d75b15d203

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
9KB

MD5
59c338b777760b7a4eb8bfc09f165ffc

SHA1
1b87daaed3f0acd2da342b715493a839df30cfbf

SHA256
9fa567edfc64fdc0dce80dafaea4a43c89ca7e9179f34cac59496189c894615f

SHA512
5c5831833583a54a3c95e206e8f2feac8d52facdfbd6b476d8b81e54ae9aae48c44bc5773cd9d30b06d67ff10b1e913727b8fb9419f22089e10b1f8ff33227eb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\K1K8E7E5\microsoft.windows[1].xml

Filesize
96B

MD5
129779775f9c360a01dd27946ded37f7

SHA1
f2ba1be31562f3121e457a52e451bc91c50388f7

SHA256
f8b4748259b0c1ba1017c57808ab864ac2a20ef78889f2fd2d103da27d9540f1

SHA512
ae084738cc69f63fb69397d41c64c5156a9644316251d4681c3bfd2b11164f5b454770710fffe43a267a6181ab9efdd3d937545318f484521e162b343db9f2e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
25KB

MD5
c8a0f96e7fbc2b6d475dcccdd2a3bba6

SHA1
c30d2df8f3c3d144c5d2795d987519b6e2c409fb

SHA256
f27d1d917d41a929e2814334f6e61e73f182fd749b5ad2dd6e5bd99a3c7b5571

SHA512
23e4ff829ef709ec49cfc09b2dd43a4a9315bc70f36a7dd01d4d5eac9d919c684b5d3b0d97bb6e368157774a321b999110d8c17338f9f7104d4d7fbf9dd2be07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
1KB

MD5
a00410b892c047dd49bf2a35ab50975a

SHA1
1330e4032bcdbdb921f2c913f531cdca66f7f5b5

SHA256
6bae206386bc97e3d9a69c0b46066760863d5c2330b68e7ec49d570876f248f4

SHA512
35fd34310d8b17276459bdb8fc3a9b02bed8098232e6b01461075dc5857d7d3bbbd9d60358b6940287e3cdadbc277612aa7237cb93fdfcd82a95db9d69303b4e

Download Submit
memory/1044-76-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-72-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-81-0x000002287FA60000-0x000002287FA61000-memory.dmp

Filesize
4KB

Download
memory/1044-79-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-78-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-77-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-74-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-73-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-71-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-70-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-69-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-67-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-66-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-65-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-64-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-63-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-61-0x000002287FA30000-0x000002287FA31000-memory.dmp

Filesize
4KB

Download
memory/1044-60-0x000002287FA30000-0x000002287FA31000-memory.dmp

Filesize
4KB

Download
memory/1044-57-0x000002287FA20000-0x000002287FA21000-memory.dmp

Filesize
4KB

Download
memory/1044-36-0x000002287B740000-0x000002287B750000-memory.dmp

Filesize
64KB

Download
memory/1044-55-0x000002287AFF0000-0x000002287AFF1000-memory.dmp

Filesize
4KB

Download
memory/1044-85-0x000002287FAC0000-0x000002287FAC1000-memory.dmp

Filesize
4KB

Download
memory/1044-82-0x000002287FA60000-0x000002287FA61000-memory.dmp

Filesize
4KB

Download
memory/1044-83-0x000002287FB70000-0x000002287FB71000-memory.dmp

Filesize
4KB

Download
memory/1044-80-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-59-0x000002287FA20000-0x000002287FA21000-memory.dmp

Filesize
4KB

Download
memory/1044-62-0x000002287FA30000-0x000002287FA31000-memory.dmp

Filesize
4KB

Download
memory/1044-75-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/1044-84-0x000002287FAC0000-0x000002287FAC1000-memory.dmp

Filesize
4KB

Download
memory/1044-68-0x000002287FA50000-0x000002287FA51000-memory.dmp

Filesize
4KB

Download
memory/2960-102-0x0000014C91040000-0x0000014C91060000-memory.dmp

Filesize
128KB

Download
memory/2960-96-0x0000014C90D00000-0x0000014C90D20000-memory.dmp

Filesize
128KB

Download
memory/2960-100-0x0000014C909B0000-0x0000014C909D0000-memory.dmp

Filesize
128KB

Download
memory/5116-1-0x00000000743C0000-0x0000000074B70000-memory.dmp

Filesize
7.7MB

Download
memory/5116-198-0x00000000743C0000-0x0000000074B70000-memory.dmp

Filesize
7.7MB

Download
memory/5116-0-0x0000000000330000-0x00000000003C2000-memory.dmp

Filesize
584KB

Download
memory/5116-9-0x0000000004E30000-0x0000000004E96000-memory.dmp

Filesize
408KB

Download
memory/5116-2-0x0000000004E20000-0x0000000004E30000-memory.dmp

Filesize
64KB

Download
memory/5116-3-0x0000000002760000-0x000000000276C000-memory.dmp

Filesize
48KB

Download