ramnit | fcd64b85a47dface08b2a76041ba84b2f2fe28000dcff5ba26146c5ae04f2fc7

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcd64b85a47dface08b2a76041ba84b2f2fe28000dcff5ba26146c5ae04f2fc7.dll
Size

5.6MB
MD5

0d76119b88cbc634b5c454c3bd0c3e17
SHA1

07bb88f893c84b85b103c6c2ff043d10ec747d0c
SHA256

fcd64b85a47dface08b2a76041ba84b2f2fe28000dcff5ba26146c5ae04f2fc7
SHA512

d02d39a065e19d8c1ed8f660bcebc9f941f0df498d9487bd1168269bc4abb07d60bb6d62463301327e10a80690833796453d0f95caa35e3e3255ff9e437b6781
SSDEEP

98304:fivlGupvdCf9DpTl4cjg1z+X2kU3D4YJRNhu6VKt9wXgvhiWaOuBuc3hF4pBM/31:f0lGgCf5pB4sg1z+X2n3D4GRfu6Vzbl

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 4 IoCs

pid	Process
1736	rundll32mgr.exe
1496	rundll32mgrmgr.exe
1284	WaterMark.exe
2008	WaterMark.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-67-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1736-70-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1736-82-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1496-86-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2008-116-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1284-117-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2008-118-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1284-119-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2008-256-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Loads dropped DLL 8 IoCs

pid	Process
540	rundll32.exe
540	rundll32.exe
1736	rundll32mgr.exe
1736	rundll32mgr.exe
1496	rundll32mgrmgr.exe
1736	rundll32mgr.exe
1736	rundll32mgr.exe
1496	rundll32mgrmgr.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px149.tmp	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px159.tmp	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1284	WaterMark.exe
1284	WaterMark.exe
2008	WaterMark.exe
2008	WaterMark.exe
2008	WaterMark.exe
1284	WaterMark.exe
2008	WaterMark.exe
1284	WaterMark.exe
2008	WaterMark.exe
1284	WaterMark.exe
2008	WaterMark.exe
1284	WaterMark.exe
2008	WaterMark.exe
2008	WaterMark.exe
1284	WaterMark.exe
1284	WaterMark.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe
744	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	WaterMark.exe
Token: SeDebugPrivilege	2008	WaterMark.exe
Token: SeDebugPrivilege	744	svchost.exe
Token: SeDebugPrivilege	1792	svchost.exe
Token: SeDebugPrivilege	540	rundll32.exe
Token: SeDebugPrivilege	1284	WaterMark.exe
Token: SeDebugPrivilege	2008	WaterMark.exe
Token: SeDebugPrivilege	600	svchost.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1736	rundll32mgr.exe
1496	rundll32mgrmgr.exe
1284	WaterMark.exe
2008	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 540 wrote to memory of 1736	540	rundll32.exe	28
PID 540 wrote to memory of 1736	540	rundll32.exe	28
PID 540 wrote to memory of 1736	540	rundll32.exe	28
PID 540 wrote to memory of 1736	540	rundll32.exe	28
PID 1736 wrote to memory of 1496	1736	rundll32mgr.exe	29
PID 1736 wrote to memory of 1496	1736	rundll32mgr.exe	29
PID 1736 wrote to memory of 1496	1736	rundll32mgr.exe	29
PID 1736 wrote to memory of 1496	1736	rundll32mgr.exe	29
PID 1736 wrote to memory of 2008	1736	rundll32mgr.exe	30
PID 1736 wrote to memory of 2008	1736	rundll32mgr.exe	30
PID 1736 wrote to memory of 2008	1736	rundll32mgr.exe	30
PID 1736 wrote to memory of 2008	1736	rundll32mgr.exe	30
PID 1496 wrote to memory of 1284	1496	rundll32mgrmgr.exe	31
PID 1496 wrote to memory of 1284	1496	rundll32mgrmgr.exe	31
PID 1496 wrote to memory of 1284	1496	rundll32mgrmgr.exe	31
PID 1496 wrote to memory of 1284	1496	rundll32mgrmgr.exe	31
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 1284 wrote to memory of 1844	1284	WaterMark.exe	32
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 600	2008	WaterMark.exe	33
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 1284 wrote to memory of 1792	1284	WaterMark.exe	35
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 2008 wrote to memory of 744	2008	WaterMark.exe	34
PID 744 wrote to memory of 260	744	svchost.exe	7

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1052
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1104
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1084
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:276
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:664
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:584

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2036

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcd64b85a47dface08b2a76041ba84b2f2fe28000dcff5ba26146c5ae04f2fc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fcd64b85a47dface08b2a76041ba84b2f2fe28000dcff5ba26146c5ae04f2fc7.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:1284
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:1844
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:600
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:744

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
185KB

MD5
a1ada298faa9819dca0eab0165d978d9

SHA1
50d7bd60790cc2370d4c3a2382e3e7248b95ef6e

SHA256
3f2af8dff9eb0ee18e38ce952c51bf1b461094fd03e71e137a61219c595cc742

SHA512
672a5f15f704932ae0dab2562238be9ca91743ce6885b79fe0bbf000ee1a8e9389278591221dcb6ee5d488faaf374d0603a985a62cb1b639ba27b0e774e25978

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
185KB

MD5
a1ada298faa9819dca0eab0165d978d9

SHA1
50d7bd60790cc2370d4c3a2382e3e7248b95ef6e

SHA256
3f2af8dff9eb0ee18e38ce952c51bf1b461094fd03e71e137a61219c595cc742

SHA512
672a5f15f704932ae0dab2562238be9ca91743ce6885b79fe0bbf000ee1a8e9389278591221dcb6ee5d488faaf374d0603a985a62cb1b639ba27b0e774e25978

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
185KB

MD5
a1ada298faa9819dca0eab0165d978d9

SHA1
50d7bd60790cc2370d4c3a2382e3e7248b95ef6e

SHA256
3f2af8dff9eb0ee18e38ce952c51bf1b461094fd03e71e137a61219c595cc742

SHA512
672a5f15f704932ae0dab2562238be9ca91743ce6885b79fe0bbf000ee1a8e9389278591221dcb6ee5d488faaf374d0603a985a62cb1b639ba27b0e774e25978

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
185KB

MD5
a1ada298faa9819dca0eab0165d978d9

SHA1
50d7bd60790cc2370d4c3a2382e3e7248b95ef6e

SHA256
3f2af8dff9eb0ee18e38ce952c51bf1b461094fd03e71e137a61219c595cc742

SHA512
672a5f15f704932ae0dab2562238be9ca91743ce6885b79fe0bbf000ee1a8e9389278591221dcb6ee5d488faaf374d0603a985a62cb1b639ba27b0e774e25978

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
91KB

MD5
c56eab01a1504045b4e4b4376630e35d

SHA1
1586025ddf036c2ce35601e6021fad5df2814963

SHA256
e41b8af9b477ee81e0c2fa21b6a3a5a598a43874128ba117f287ce99471d8631

SHA512
1f1034f40beeb52e92524dc17984f45f12a911d5364d36ca43ef197b89348d7a3c373ca4ebee20b260693028151df1475d472d3432eed02cce6b2e3ac3d12d71

Download Submit
memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/540-115-0x0000000000210000-0x000000000024E000-memory.dmp

Filesize
248KB

Download
memory/540-114-0x0000000000210000-0x000000000024E000-memory.dmp

Filesize
248KB

Download
memory/540-113-0x0000000074CB0000-0x000000007527D000-memory.dmp

Filesize
5.8MB

Download
memory/540-112-0x00000000746E0000-0x0000000074CAD000-memory.dmp

Filesize
5.8MB

Download
memory/540-111-0x0000000074CB0000-0x000000007527D000-memory.dmp

Filesize
5.8MB

Download
memory/540-209-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/744-122-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/744-129-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1284-117-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1284-119-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1736-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1736-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1736-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1844-95-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1844-123-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1844-103-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1844-257-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2008-118-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2008-116-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2008-256-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download