home

mgrmount.sys

Microsoft Windows 2000 Operating System

SG Internet

It runs as a Windows 64-bit kernel mode device driver named “mgrmount”.
Publisher:
Microsoft Corporation  (signed by SG Internet)

Product:
Microsoft(R) Windows (R) 2000 Operating System

Description:
Manager Mount

Version:
5.1.2195.6689

MD5:
ccf95454647633c08e232c833854841e

SHA-1:
ec3e868e160be07afefa706622f6629090519879

SHA-256:
cf9bce2bf8a643d243e23930ffbd9396a9e8c25ed2ec410e089d5fdf18299a73

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/25/2024 7:52:06 AM UTC  (today)

Scan engine
Detection
Engine version

Kaspersky
Rootkit.Win64.Winnti
15.0.0.562

File size:
15.3 KB (15,696 bytes)

Product version:
5.1.2195.6689

Copyright:
Copyright (C) Microsoft Corp. 1981-1999

Original file name:
mgrmount.sys

File type:
Driver (Win64 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\mgrmount.sys

Digital Signature
Signed by:
SG Internet

Authority:
Thawte, Inc.

Valid from:
10/6/2011 5:00:00 PM

Valid to:
10/6/2013 4:59:59 PM

Subject:
CN=SG Internet, O=SG Internet, L="Seocho-gu ", S=Seoul, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
6E7CC176062D91225CFDCBDF5B5F0EA5

File PE Metadata
Compilation timestamp:
7/4/2013 2:01:54 AM

OS version:
6.1

OS bitness:
Win64

Subsystem:
Native (none required)

Linker version:
9.0

CTPH (ssdeep):
192:R+wqsepWAlTJkhh0mqkG+ELW4vHWVp7na67wYC88You7+wse+PjPPz78c6:wpsepWz0mqn+ELWgHWfnP7TuuSPLn89

Entry address:
0x5064

Entry point:
48, 83, EC, 28, 4C, 8B, C2, 4C, 8B, C9, E8, 95, FF, FF, FF, 49, 8B, D0, 49, 8B, C9, 48, 83, C4, 28, E9, 52, C1, FF, FF, CC, CC, B0, 50, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, B8, 52, 00, 00, 00, 20, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 40, 51, 00, 00, 00, 00, 00, 00, 58, 51, 00, 00, 00, 00, 00, 00, 70, 51, 00, 00, 00, 00, 00, 00, 82, 51, 00, 00, 00, 00, 00, 00, 98, 51, 00, 00, 00, 00, 00, 00, B0, 51, 00, 00, 00, 00, 00, 00, C8, 51, 00, 00...
 
[+]

Entropy:
6.4291

Code size:
5 KB (5,120 bytes)

Driver
Display name:
mgrmount

Type:
Kernel device driver (KernelDriver)


Scan mgrmount.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.