Analysis
-
max time kernel
164s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:48
Static task
static1
Behavioral task
behavioral1
Sample
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe
Resource
win7-20220812-en
General
-
Target
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe
-
Size
241KB
-
MD5
432e72f8c7c3a6c3fe08bc37c7d05eb1
-
SHA1
37fe5b4a590d5634b9c426688c014226eccbce4f
-
SHA256
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c
-
SHA512
21e4f8ad5946c4d4817a8d81db919bba7721c547fb06435f0dda8223a26e854666bfedcfd978e80e9ec8c0c4d92bc600822e94e81d03ef6c2a2451062d3608c1
-
SSDEEP
3072:ynxwgxgfR/DVG7wBpEu/olCccw+Um4i1APz/S1vKic2GL2jAnEAfuGSlyrYI:y+xDVG0Bpvccus187aKXfdSuR
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exeWaterMark.exepid process 4740 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe 2456 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4740-141-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4560-143-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4560-145-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4740-148-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2456-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-165-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
Processes:
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.execf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxD6D.tmp cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\pxDFA.tmp cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4312 2256 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998408" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998408" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998408" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "418623822" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998408" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376006217" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3140A724-6B7B-11ED-89AC-DAE60F07E07D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{31408014-6B7B-11ED-89AC-DAE60F07E07D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998408" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998408" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "418623822" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "280029348" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "135341899" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "280029348" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "135341899" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe 2456 WaterMark.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 628 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 2456 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1104 iexplore.exe 628 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1104 iexplore.exe 1104 iexplore.exe 628 iexplore.exe 628 iexplore.exe 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE 32 IEXPLORE.EXE 32 IEXPLORE.EXE 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.execf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exeWaterMark.exepid process 4560 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe 4740 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe 2456 WaterMark.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.execf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 4560 wrote to memory of 4740 4560 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe PID 4560 wrote to memory of 4740 4560 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe PID 4560 wrote to memory of 4740 4560 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe PID 4740 wrote to memory of 2456 4740 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe WaterMark.exe PID 4740 wrote to memory of 2456 4740 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe WaterMark.exe PID 4740 wrote to memory of 2456 4740 cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe WaterMark.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 2256 2456 WaterMark.exe svchost.exe PID 2456 wrote to memory of 1104 2456 WaterMark.exe iexplore.exe PID 2456 wrote to memory of 1104 2456 WaterMark.exe iexplore.exe PID 2456 wrote to memory of 628 2456 WaterMark.exe iexplore.exe PID 2456 wrote to memory of 628 2456 WaterMark.exe iexplore.exe PID 628 wrote to memory of 3264 628 iexplore.exe IEXPLORE.EXE PID 628 wrote to memory of 3264 628 iexplore.exe IEXPLORE.EXE PID 628 wrote to memory of 3264 628 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 32 1104 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 32 1104 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 32 1104 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe"C:\Users\Admin\AppData\Local\Temp\cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exeC:\Users\Admin\AppData\Local\Temp\cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2256 -ip 22561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
119KB
MD538a96de610bef6a122677e93885fd380
SHA15db38bffdedc43790359bab324121dd60472ee77
SHA256c41c2011fe11b2bddf392d57fa1f7513f234243fd79cd34f01030e86a15827f9
SHA5129520643685d3c5a90b39f51668cfb5f2eedca1c02f2d3acabc9834946fd107d97b526f882d739b617c0881a1552d0065d27ddd9c1cf244dcaf061c9f6ddb1830
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
119KB
MD538a96de610bef6a122677e93885fd380
SHA15db38bffdedc43790359bab324121dd60472ee77
SHA256c41c2011fe11b2bddf392d57fa1f7513f234243fd79cd34f01030e86a15827f9
SHA5129520643685d3c5a90b39f51668cfb5f2eedca1c02f2d3acabc9834946fd107d97b526f882d739b617c0881a1552d0065d27ddd9c1cf244dcaf061c9f6ddb1830
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{31408014-6B7B-11ED-89AC-DAE60F07E07D}.datFilesize
3KB
MD5fdbdbaec23fce61c04e753d05f799ae0
SHA1070e5f12b7cbdfe1941a11627765408ebe16ce58
SHA2565d2b5e4924c7d7c299dde3e94800843e838b4cccdeb747eb8cc0f2f40cf1a44f
SHA5123a00d630baa6de18588fcd5d1c892f40bc5c5544117ea97500b55cb4956b1301e64b46f0c5f7c0cb2214c5f53aa328df093e892109dae36bd31400572a6d23a1
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3140A724-6B7B-11ED-89AC-DAE60F07E07D}.datFilesize
5KB
MD5fd97ccd2edac158da8fd1136c170de0d
SHA1b32917a80d66eb0dac90e7cc78faf2fc86c5e935
SHA256b95616386ec39f93f2a03a3ca677bf92bef1b82116b5aedbba1b4942b66b4e9f
SHA512081cffee606c17c5687127bf965bf572fe800547b4e2580698675b0dd61ad6df9e80fe631c6640c1d95f31c2f8c07b48c67641338532a430db6e497461feba6a
-
C:\Users\Admin\AppData\Local\Temp\cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exeFilesize
119KB
MD538a96de610bef6a122677e93885fd380
SHA15db38bffdedc43790359bab324121dd60472ee77
SHA256c41c2011fe11b2bddf392d57fa1f7513f234243fd79cd34f01030e86a15827f9
SHA5129520643685d3c5a90b39f51668cfb5f2eedca1c02f2d3acabc9834946fd107d97b526f882d739b617c0881a1552d0065d27ddd9c1cf244dcaf061c9f6ddb1830
-
C:\Users\Admin\AppData\Local\Temp\cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993cmgr.exeFilesize
119KB
MD538a96de610bef6a122677e93885fd380
SHA15db38bffdedc43790359bab324121dd60472ee77
SHA256c41c2011fe11b2bddf392d57fa1f7513f234243fd79cd34f01030e86a15827f9
SHA5129520643685d3c5a90b39f51668cfb5f2eedca1c02f2d3acabc9834946fd107d97b526f882d739b617c0881a1552d0065d27ddd9c1cf244dcaf061c9f6ddb1830
-
memory/2256-155-0x0000000000000000-mapping.dmp
-
memory/2456-146-0x0000000000000000-mapping.dmp
-
memory/2456-163-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-162-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-156-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-157-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-158-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-159-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-164-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2456-165-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4560-145-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4560-143-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4560-132-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/4740-141-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4740-148-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4740-135-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4740-133-0x0000000000000000-mapping.dmp