1802748d085c9502a4fc7cbdd23e0c9ada2a8d841a4687b8bef6ff6ceb2409be

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1802748d085c9502a4fc7cbdd23e0c9ada2a8d841a4687b8bef6ff6ceb2409be.dll
Size

454KB
MD5

a003aa5c85856f5d4f5ab277358ea710
SHA1

6845fd9cdd1d20c94918aabe87942638b7797762
SHA256

1802748d085c9502a4fc7cbdd23e0c9ada2a8d841a4687b8bef6ff6ceb2409be
SHA512

c469cdbf3ac71f0dbad89dd5c50822aa82ecd83307b0e8eef0e0d74d056119a223336f75eb192abe4b8a91916bc2beb045376a317336bd270abf7ffbe20e28a7
SSDEEP

12288:7xGCOXzURlbDC9K69u2m+SqOWcsQQKiY4leDDGoggH/VREG6j4Gm01b8nPCFZyQ9:twXz2aFZ3Tf

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1272	rundll32mgr.exe
2040	rundll32mgrmgr.exe
1912	WaterMark.exe
1284	WaterMark.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1272-68-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1272-70-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1272-82-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2040-86-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1284-111-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1912-112-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1284-113-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1912-245-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Loads dropped DLL 8 IoCs

pid	Process
1204	rundll32.exe
1204	rundll32.exe
1272	rundll32mgr.exe
1272	rundll32mgr.exe
1272	rundll32mgr.exe
2040	rundll32mgrmgr.exe
1272	rundll32mgr.exe
2040	rundll32mgrmgr.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxF46E.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\pxF46F.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	svchost.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1912	WaterMark.exe
1912	WaterMark.exe
1284	WaterMark.exe
1284	WaterMark.exe
1912	WaterMark.exe
1912	WaterMark.exe
1912	WaterMark.exe
1912	WaterMark.exe
1284	WaterMark.exe
1284	WaterMark.exe
1284	WaterMark.exe
1284	WaterMark.exe
1912	WaterMark.exe
1912	WaterMark.exe
1284	WaterMark.exe
1284	WaterMark.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe
1736	svchost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1912	WaterMark.exe
Token: SeDebugPrivilege	1284	WaterMark.exe
Token: SeDebugPrivilege	1736	svchost.exe
Token: SeDebugPrivilege	1120	svchost.exe
Token: SeDebugPrivilege	1912	WaterMark.exe
Token: SeDebugPrivilege	1284	WaterMark.exe
Token: SeDebugPrivilege	1476	svchost.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1272	rundll32mgr.exe
2040	rundll32mgrmgr.exe
1912	WaterMark.exe
1284	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 1204 wrote to memory of 1272	1204	rundll32.exe	29
PID 1204 wrote to memory of 1272	1204	rundll32.exe	29
PID 1204 wrote to memory of 1272	1204	rundll32.exe	29
PID 1204 wrote to memory of 1272	1204	rundll32.exe	29
PID 1272 wrote to memory of 2040	1272	rundll32mgr.exe	30
PID 1272 wrote to memory of 2040	1272	rundll32mgr.exe	30
PID 1272 wrote to memory of 2040	1272	rundll32mgr.exe	30
PID 1272 wrote to memory of 2040	1272	rundll32mgr.exe	30
PID 1272 wrote to memory of 1912	1272	rundll32mgr.exe	31
PID 1272 wrote to memory of 1912	1272	rundll32mgr.exe	31
PID 1272 wrote to memory of 1912	1272	rundll32mgr.exe	31
PID 1272 wrote to memory of 1912	1272	rundll32mgr.exe	31
PID 2040 wrote to memory of 1284	2040	rundll32mgrmgr.exe	32
PID 2040 wrote to memory of 1284	2040	rundll32mgrmgr.exe	32
PID 2040 wrote to memory of 1284	2040	rundll32mgrmgr.exe	32
PID 2040 wrote to memory of 1284	2040	rundll32mgrmgr.exe	32
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1912 wrote to memory of 680	1912	WaterMark.exe	33
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1284 wrote to memory of 1476	1284	WaterMark.exe	34
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1912 wrote to memory of 1736	1912	WaterMark.exe	35
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1284 wrote to memory of 1120	1284	WaterMark.exe	36
PID 1736 wrote to memory of 260	1736	svchost.exe	7

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:804
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1180
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1112
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:840
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1084
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:316
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:328
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:868
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1920

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1992

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1802748d085c9502a4fc7cbdd23e0c9ada2a8d841a4687b8bef6ff6ceb2409be.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1802748d085c9502a4fc7cbdd23e0c9ada2a8d841a4687b8bef6ff6ceb2409be.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
        
        C:\Windows\SysWOW64\rundll32mgrmgr.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2040
      - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:680
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
241KB

MD5
ccc1590163f5d7ecab7056a44e9db124

SHA1
1dcb42c050ee4bc9eb9a4576e7e74958f3b3a701

SHA256
f26f3a906655f0f2ecf28e4f1ace3ed923ca3c84e58d07632c2533eb2bebca1f

SHA512
5bb0db687caef40a1a918c3e859dffd314de7877827261c6957ea2f5157b8b5d7802938daa26e69d24e0725d3b4f2a145c8e4c315be6a60a611aa0cc5a41afe0

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
241KB

MD5
ccc1590163f5d7ecab7056a44e9db124

SHA1
1dcb42c050ee4bc9eb9a4576e7e74958f3b3a701

SHA256
f26f3a906655f0f2ecf28e4f1ace3ed923ca3c84e58d07632c2533eb2bebca1f

SHA512
5bb0db687caef40a1a918c3e859dffd314de7877827261c6957ea2f5157b8b5d7802938daa26e69d24e0725d3b4f2a145c8e4c315be6a60a611aa0cc5a41afe0

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
241KB

MD5
ccc1590163f5d7ecab7056a44e9db124

SHA1
1dcb42c050ee4bc9eb9a4576e7e74958f3b3a701

SHA256
f26f3a906655f0f2ecf28e4f1ace3ed923ca3c84e58d07632c2533eb2bebca1f

SHA512
5bb0db687caef40a1a918c3e859dffd314de7877827261c6957ea2f5157b8b5d7802938daa26e69d24e0725d3b4f2a145c8e4c315be6a60a611aa0cc5a41afe0

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
241KB

MD5
ccc1590163f5d7ecab7056a44e9db124

SHA1
1dcb42c050ee4bc9eb9a4576e7e74958f3b3a701

SHA256
f26f3a906655f0f2ecf28e4f1ace3ed923ca3c84e58d07632c2533eb2bebca1f

SHA512
5bb0db687caef40a1a918c3e859dffd314de7877827261c6957ea2f5157b8b5d7802938daa26e69d24e0725d3b4f2a145c8e4c315be6a60a611aa0cc5a41afe0

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
119KB

MD5
a6aa2de4617939ba1d45caf06ee26101

SHA1
37855db4d68303311050208ad699825466efec12

SHA256
53aa56335d1c3cc1c4b0db3688c3250c4ded0611ce14bbd165544761c4a195b6

SHA512
f5238d39b66af7234c6b82e5d0bd2225f329e76e6e564712beba7c7b629a19006329e764b0795d5aef7ad689ecc48096591c79996bf0991efa57294d3d29ea71

Download Submit
memory/680-101-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/680-246-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/680-114-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/680-94-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1204-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1272-68-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1272-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1272-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1284-113-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1284-111-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1736-116-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1736-122-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1912-112-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1912-245-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2040-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download