Resubmissions

16-08-2024 13:57

240816-q9e8ksybje 10

15-08-2024 21:49

240815-1pfnqawgmc 10

Analysis

  • max time kernel
    299s
  • max time network
    292s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    16-08-2024 13:57

General

  • Target

    NetworkIsooProSetup.msi

  • Size

    14.0MB

  • MD5

    4fff2618d8f4f571bd0fed70db95a6a2

  • SHA1

    0c2dc8df585ef1fb3d963820d4b9a5c5a41ad0f6

  • SHA256

    d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6

  • SHA512

    b05a8627f52943f5b1beacfdbc45c49c9cc70c9a12e8a165b8587d6a7bab18edf1bb7d90231c404a4be7c0c7b73856056a5d11d642eefd83a8d2cf236636dfc8

  • SSDEEP

    393216:75Nm1Z7nsPSUTtXmAKARHAnm3z1GQOjKE7Uov:nm1ZTsaUTtZsE1GQOjvt

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

45.133.74.183:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-1QFIL0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 39 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NetworkIsooProSetup.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2480
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2692
    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe
      "C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe"
      2⤵
      • Adds Run key to start application
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1996
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Coolmuster PDF Image Extractor In Service" dir=in action=allow program="C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3996
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall add rule name="Coolmuster PDF Image Extractor Out Service" dir=out action=allow program="C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4004
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4028
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4072
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2808
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:3012
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2376
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.0.1265542512\55254930" -parentBuildID 20221007134813 -prefsHandle 1256 -prefMapHandle 1248 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae1d198a-79d3-4b3b-808b-f1dc0ef5bc01} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 1328 f7b7858 gpu
          3⤵
            PID:1756
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.1.119141793\755918250" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8732a294-f073-489a-8437-2a8f76db3016} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 1524 d71658 socket
            3⤵
              PID:2152
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.2.1038546641\261116664" -childID 1 -isForBrowser -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bf89527-d6e5-467f-a707-945c27778746} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 2412 d64758 tab
              3⤵
                PID:2088
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.3.16759404\1030676803" -childID 2 -isForBrowser -prefsHandle 2772 -prefMapHandle 2768 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {257b1ba6-e4f3-4460-99cf-2d558bb535f2} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 2784 1bca7258 tab
                3⤵
                  PID:2200
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.4.460897612\1856942546" -childID 3 -isForBrowser -prefsHandle 2880 -prefMapHandle 2876 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47317c14-52ca-4ec2-b78f-248565e3f444} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 2892 1bca5458 tab
                  3⤵
                    PID:3040
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.5.228048729\116525053" -childID 4 -isForBrowser -prefsHandle 3840 -prefMapHandle 3848 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cd31981-08c2-43bd-b7d5-0792da1d53c2} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 3860 d30258 tab
                    3⤵
                      PID:680
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.6.1115976028\8042862" -childID 5 -isForBrowser -prefsHandle 3968 -prefMapHandle 3972 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e41b5d1-e8f1-45a5-9083-934862e64102} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 3956 1d717e58 tab
                      3⤵
                        PID:1736
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2376.7.434012032\1348333865" -childID 6 -isForBrowser -prefsHandle 4148 -prefMapHandle 4152 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48d69df9-a57c-4b23-9d1a-c3cf7eadaa8c} 2376 "\\.\pipe\gecko-crash-server-pipe.2376" 4136 1e8cf658 tab
                        3⤵
                          PID:2600
                    • C:\Windows\system32\DrvInst.exe
                      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000588" "00000000000005C4"
                      1⤵
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:316

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Config.Msi\f770282.rbs

                      Filesize

                      23KB

                      MD5

                      736723d61dca6535dc0df2f0777d2db2

                      SHA1

                      8831e2d724f48e9954d23353af9fa5ec7a485fda

                      SHA256

                      4a08ecaa994f1a4a7b639ce0c62c82a5575a3a45e23d5b43bb3ce4367ff20822

                      SHA512

                      da82b38402862b2006357dc9354e7575c44bc2cead6d0a68391a5b8bcabaff841ccf41c726308b40609f0e85707d422305dbcb02e3839dc5d13120ff03e052fd

                    • C:\ProgramData\remcos\logs.dat

                      Filesize

                      184B

                      MD5

                      dff1bdc90993f369c971f1f853560995

                      SHA1

                      e69392f25947ae6643c5793782e8fd6cc096f077

                      SHA256

                      b4db878e1190c3126a95fc79b42d9885eeb6fdf074ebfc37601cd5df8b4cad86

                      SHA512

                      e2662ad5d20f7a64f6b193c9e307455b9dce37984cafd388a48c92b42264a991b680730fab8da91616b76ad4ccc393a0e9fd258bf78d76bdbe861d7f623c3cfe

                    • C:\ProgramData\remcos\logs.dat

                      Filesize

                      508B

                      MD5

                      8e46032c75196fc6459d6f5e720fd585

                      SHA1

                      c89b2894b5427f37881457b278a01ca9e151a548

                      SHA256

                      2d6bc6bdcf5fd17e8da3c644f2eb84c27317d512d959a1abd87af5c12f219898

                      SHA512

                      2ead16c91d547b7d51f4299e35b90e651499ff1bb1631ce825fafd4aca079ff2c875dc97d5ea1da691d9ee213dc644c61673225fbfb5aea2c452135685b46882

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      304B

                      MD5

                      3899f8106720f72519aa81c912c60f71

                      SHA1

                      fb29131c238a53440f584090480389b83d3bc9fc

                      SHA256

                      75d51b4658a0d90eee32ca2b0f73238100dc97faf752298c739afffecffd20c7

                      SHA512

                      04cd28b8b6301bb88f9b496b7d4e7672f0785a962552961fd2dd1b8866c42a8e2401b2d08a993b0acbb967265bf0606f2aea30b765e3afb57738bca804027179

                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i7f18jmm.default-release\activity-stream.discovery_stream.json.tmp

                      Filesize

                      31KB

                      MD5

                      80c572651a0abfbeb2d0fdb5a2f1f051

                      SHA1

                      92c072295b801a0b19af45e66576575f6534b6fc

                      SHA256

                      0beb6e16302292880043f4655d319068c6b54ebcca90c1b3d9d9220a64d50fb5

                      SHA512

                      0debdf3c29fe63beead9e5199e8339e141a522e16b4792e2c4b3f10547be6798df24c2592692dd0b50d7db6f825b374774ef48122a4c7461a4747f95ef2af2d7

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe

                      Filesize

                      607KB

                      MD5

                      e11235cb041e3ae98cb17d746b45cb66

                      SHA1

                      fcaa4feab36f28bd38e71ee762cc499f731d3d47

                      SHA256

                      c7030fb23fd25fc99c39457618a3afd2b27b381d7b833d4662995493d85deaf4

                      SHA512

                      08da0141966050864a404c413f51fada820489872da15ddff1ef8273211deab106bf912105076f24e801b88276db772cb8f8f15201b83ef35e069d0a4de63db4

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\MSVCP140.dll

                      Filesize

                      439KB

                      MD5

                      5ff1fca37c466d6723ec67be93b51442

                      SHA1

                      34cc4e158092083b13d67d6d2bc9e57b798a303b

                      SHA256

                      5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                      SHA512

                      4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\Module.View.dll

                      Filesize

                      212KB

                      MD5

                      74bc438e41c723c1389ee2484e0359c7

                      SHA1

                      927bb7bcb50965a896757a28744887eade204337

                      SHA256

                      6b1002b04d0334d6afcf28147918df5f284c016da605bdc36f4f2c5806950316

                      SHA512

                      55d03871b1fc7afa9d35df978ed968be603b10754b43f3e4aa8cf89b989549e7114f183cad10b242e3ab27f85f10b8cd91207364f170c02cc8e94d24c6e6caab

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l1-2-0.dll

                      Filesize

                      19KB

                      MD5

                      045e4617b49e817007d8a88652af7734

                      SHA1

                      305026109a1eabf49bf7ae6a233a4a11e2a22580

                      SHA256

                      fd387d4e358e3755db38a618066fb72cd03b17b54d058dbe3dab82065519edc7

                      SHA512

                      7e21cf4982ce6f4aa52f0281eae101287a850152c70577b456876356201e12983c9d211d04e05d2c81f80a56bc11ab54eaefa7e492e3910af21af14ff10962cc

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-localization-l1-2-0.dll

                      Filesize

                      21KB

                      MD5

                      2a3da8e1cd09aca0fc13be43848c7695

                      SHA1

                      72380005fde41e6c6b37db5a46cdb0efc3d6cb08

                      SHA256

                      c3f671d3b41fffa444a33f79c0e65df7ca01e56598e4b2f90e7af18c77b97652

                      SHA512

                      e4b659aa290a6c256799a76890c296e702316094b132b9bc4b393dc6bff7640b7e62de0f05097932291db411dfb871533f7473cc6c55805f69d75562aae6dc44

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processthreads-l1-1-1.dll

                      Filesize

                      19KB

                      MD5

                      1f462654c1bbc1ced7e4d8e879732e14

                      SHA1

                      a56a7c4154870db07395d50f4d8d963e4cce92ab

                      SHA256

                      b8e6deceacbc5f8e483ad076196df819377d2731e146eb4f48c5a59da9abdd65

                      SHA512

                      917edfc5cbf3f82708d6cb84a2ad31c41b1b02cf44a921b6934bff614b69d0754115c35aaf4d181085a4b77ebd816fe06cb9def01addc5c68846da0850fe8cce

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-synch-l1-2-0.dll

                      Filesize

                      19KB

                      MD5

                      5a8978023b93c8c369d3696c8251b71d

                      SHA1

                      1ffc61471c2f49a80d5e3f83df2a9010d3c5a1c7

                      SHA256

                      dba254b1446808887d452bcd6c27685462c39dc2f1da181765f0898b4eb1b953

                      SHA512

                      53ae57280e593d886b609d55c313e2ef208c3f0ce53b5d015f57aaf3cce901a192efe60b24d9e9b5c6e9ef7779c9103a951e813780a53d12a27680965e5b39ad

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-timezone-l1-1-0.dll

                      Filesize

                      19KB

                      MD5

                      ed3a91953d5ce03d65bd90fa46c1e29d

                      SHA1

                      92cdac4071850ac96759ae77a0b3c5f6bebdc2ef

                      SHA256

                      35ea6ec01e55108182c743b47fed5be381acf295982be87d92b4588ccb71240d

                      SHA512

                      edb4539b6081e73bb410668c420d437a0a746fc4aba28f7f15f7a2debc8bf8eb11e03f38957b438bfb95e86652b44c1bdb0162f449146df467ff5e1de281e56d

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-convert-l1-1-0.dll

                      Filesize

                      23KB

                      MD5

                      2e7fcee0944d063d8528399f22c9b2b7

                      SHA1

                      05a68b73e778817f52885e6f27800e99125efdca

                      SHA256

                      a38f46fe1a1bba3a8c7cc942bac945413c5c0e992ca599f9f09181b7f5645f52

                      SHA512

                      df689de14369d858412b79156acd8e2fcafeb45793eac91f1ce0cba37bcc2e88c53533934647960176c48133c1e5383f406eef859bfb5231f49730acf4320d95

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-environment-l1-1-0.dll

                      Filesize

                      19KB

                      MD5

                      f966b9ff936d60de02c37b16b9d23e4e

                      SHA1

                      7dffea259d7e5ffdf005900ac9417319acc66f33

                      SHA256

                      90788cc217e4f5e78ec988061552fcd1c1a3ab61c6df3de132aae606383fbc27

                      SHA512

                      bc27f4871e872d76b89d7f0ba5ed7d7062a04218bdf9a741598bfce82cd788e866d2c20513594726948e1701bfdb17afc2280405b0d994aaa3cd2ebefc1c8cf7

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-filesystem-l1-1-0.dll

                      Filesize

                      21KB

                      MD5

                      735d7e5ae0a53b644482f5e70efeff5d

                      SHA1

                      8e99689cf9d24aa4268a51bd377015e9d9ad7f64

                      SHA256

                      e9d88aa96743aa2ff29ac8d7930ba0c8ebb21372329a1bf5926cce59a4b39f4b

                      SHA512

                      12239d14a634b7cdaa07e39186b674bc905f73c928db5230752407650f274bd401d10487b3ac2c426cc8da708f0ca6fbaffc2a5075e299901961bd205ad7bbd8

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-math-l1-1-0.dll

                      Filesize

                      29KB

                      MD5

                      2b20bc164f817ffbba1b547857b0da2a

                      SHA1

                      c40095898cfe64c6132e81090333317563184c3c

                      SHA256

                      a7a4ba2270ae7e5679ff9413d1e53ba706a95bec28c906de378ab4b1a8fbf6e7

                      SHA512

                      a760294cd9b9f3c0c9c0ec4800536df874ef7d3757cad9469da96c293187a9382867f332caf714f91c9059a90a3dda7670b265f3a5e2339b9e12ca05eb373e56

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-multibyte-l1-1-0.dll

                      Filesize

                      27KB

                      MD5

                      e92ba8ab3be45a5fa0b0439966583d8b

                      SHA1

                      88ec890850a4d531476151ddabb6f6def5d87273

                      SHA256

                      f65bb318be803581780fed95f57d0fd7b5c1b0e070e0062a8d06e4e5dde4c9ee

                      SHA512

                      4a5d11dfb7ed1c95eb2b839c9a094f7a8cd32e78d3af9f1eefe52857d9b17cc69649638b8afd8ae581518cf9b223c352ccdf84a46990ac56b57577502a9035dc

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-runtime-l1-1-0.dll

                      Filesize

                      23KB

                      MD5

                      f24259dabe9905bf00eef0374053937b

                      SHA1

                      b1949c85cfaeb2b2cdf99b51d3191e4e3bd0dd54

                      SHA256

                      f99a3f408880834ce3c762fb434cea98c87bc6df19b63d509d1093f2295bbc8e

                      SHA512

                      fc46db162ba62b46106c7b5c942e2ee186b126deebb8f2e48daf9892620d4b4acaa244fb4b65e1e6f02e06072a8b61d95e49e2ecbfa676cedc361735abb34f01

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-stdio-l1-1-0.dll

                      Filesize

                      25KB

                      MD5

                      5f158413a85e905b0ceb5aaa1aa35f28

                      SHA1

                      8807fa016b184ae6e8b66177bf34f1810f5d6095

                      SHA256

                      93780b67e8ff9dd076cc67c620d1baa7b5518ecb5cf45ecc1dbf92e6bafcf646

                      SHA512

                      e20e433e45ac817f74fca61be03bb9a998adfb2038b50f4476bcb2fcaf0e09236844dc2a9fa4200724d62c646aa9ea5ad315e51fcb4aa9fbf1add1a55a735983

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-string-l1-1-0.dll

                      Filesize

                      25KB

                      MD5

                      c04f55920b25221f81575231bbb5e4d7

                      SHA1

                      b0a65c6ee855e49a4a1d937572f7aaa7b6d9539a

                      SHA256

                      c87e13d8fb07cdf07deb3222270afec1de7fc7e481a9fb22068eee74f2a60685

                      SHA512

                      2159de09ae92d8a88feb7eb1d0072b928c726fad94a3a72d3523fb15e41a2ad9cb26affdb23cb3d6441fd2b377f29b3df5cd7e0db0ec48871c9dcdaa35a4a000

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\groceryc.dll

                      Filesize

                      368KB

                      MD5

                      5bde978a0febd4a59de0e6b835180389

                      SHA1

                      1c522ff3fa433a2302bfa6538c4460ce04833ee6

                      SHA256

                      74c9d82bebeaaecb50001ff0b1ee6ea129fc9de3c6a673d29d3e12615b75b3c0

                      SHA512

                      aa598c8c1a0f701c22fe38f53693e5f6c4ff855f66fd568ddfcb5f46cef058773038f947236d21442575c63e77987127f7fdb1fe2b7223109c25fd0411220318

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\libBasic.dll

                      Filesize

                      241KB

                      MD5

                      4dc44d5151384fa688d01dff77e7bf97

                      SHA1

                      e538146be27b44ad54fd857a17c518ea7096a22e

                      SHA256

                      f490db01d8a604117856ff993726456b6d3aa087b017c8cbc5ed1b917cd4df57

                      SHA512

                      56933d16050765e0262bd38bc96ee9a71de4ac28c6748ad908c08955fc5463feed5966481176354570404923cfc3fc699a3d93e0470807a26613ba3ac6ad5f32

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\libRG.dll

                      Filesize

                      55KB

                      MD5

                      90c5a4208aa1ac6dafb6189159cd7e10

                      SHA1

                      7df05caa1dbbfa7d8f65abeaa2d5b3a49ac66032

                      SHA256

                      17927ae7a1e834dd150c5c26e21f68dfa6404a813dfe1a1c33d0dad446ba3489

                      SHA512

                      e0fba99ac770a15338a6f06c94f99ce948cc9406444799bba7eed2514f122f0062dc330c2e67bd41f0235d526fca232974c9d19b40c9c1c5e0ed01e82494bdbe

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\libdrive.dll

                      Filesize

                      7.3MB

                      MD5

                      1406431ed0927c24bc87045547cb7892

                      SHA1

                      68e0710011ea9948a7a72f5bbac3a2732953f4a2

                      SHA256

                      2a2b4cd5722f251c56ae5b7ac7671bb423b229ee30089e8723bd942aed0bf36e

                      SHA512

                      3bb4eeaf6b1181a68d9ba2351ca3212fe99d49af8d99ab7dd3e1dcf0bcfac6caa9de1828644127cea694cd66cf862eb339c705fe56a378ea625f88775961f5f8

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\libglog.dll

                      Filesize

                      136KB

                      MD5

                      dcda1583d25968da25b1d1bf91169680

                      SHA1

                      10681c51922cfd06a088c6a6c75cd186f9c8d9d1

                      SHA256

                      84a73bc173a30b2d174a66637bd075bd2c01e48e4fd97ed032dcafb2c8c0dea3

                      SHA512

                      3df130f1a7a82f8401f7e7ec9d56b65f453ecd4cc525fe4aa196e090356951fc00fdcf9a99e776b2cde2b3ca9276af7db270bb2db4ff1b6cf3f63b648f7dca76

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\libxml2-2.dll

                      Filesize

                      3.5MB

                      MD5

                      72b58be0b56aa0f7bbfdfddd2554b06f

                      SHA1

                      c4519063ee6cbbb8feb6c846949b1c5c81da26ba

                      SHA256

                      f52724ae696b5c9e2586fd41047e6ac56541efdfc157a33ba20ad5826234bf53

                      SHA512

                      640b747ebe5efa39ec05558a75b418bf1c60de9f503698b2e8a68afb5bfb2dc890943d13bfa3cd6366c7f9d7e293c9aa9b783c00e313aa27f6e15065937628c1

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\pthreadGC2.dll

                      Filesize

                      117KB

                      MD5

                      72c1ff7f3c7474850b11fc962ee1620c

                      SHA1

                      b94f73a1ce848d18b38274c96e863df0636f48a7

                      SHA256

                      3b159da9dad9afd4bd28b5b1a53dc502a2487068055ed8c30136a76cd6924890

                      SHA512

                      1ed4b3c34dd0033ec2aa05bdacaa45041d9cd5880fdb5530ca033308ab349c09d4811bb276bbdf51a3040b7a337f9a5d33796924550962a56058203799c5bd53

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\ucrtbase.DLL

                      Filesize

                      1.1MB

                      MD5

                      6c2810f92a98551650cb268e68a12441

                      SHA1

                      0086b73b79da608bfb969d06d72b6cb9fed948f4

                      SHA256

                      656e7fe89e902f00e5115d23f69ffbd043d923277c5a21149f2c60e0abbb4614

                      SHA512

                      d8ed5fc3c7ca60225f4965bd097b86ea197a111655e5974690f926900ec787a103b62431b113818b1f81f9a576cc970b1b8798d30d89fa4713abdc13ffd291a3

                    • C:\Users\Admin\AppData\Local\Programs\Network MPluginManager\zlib1.dll

                      Filesize

                      101KB

                      MD5

                      13cd5ab2da5a98f5f76aa6f987187461

                      SHA1

                      dd2d54668258b989cc500c132d9a686babe67fa5

                      SHA256

                      3310ca85f0cb26e07bb3d8e1168c49e572a7c50762fa8140768663a5df9823e9

                      SHA512

                      c1c0c11b9804e6d25c8b1c74a09bfd3133255fe47ab9515cde124ec73231205b11d0536a66fccc9379dd84a33bb589cc78f867ef423ff30067363fdee7d605ca

                    • C:\Users\Admin\AppData\Local\Temp\CabE330.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\TarE3FE.tmp

                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                      Filesize

                      5KB

                      MD5

                      67068677ec3385375b2defe4b0795885

                      SHA1

                      8270060033eebc1a668e5b546fb1c59e8c06f950

                      SHA256

                      60f0f0ac58d8f9f22529adea5dd502da7a6b622bc7cba83e0c20e7888fc05947

                      SHA512

                      a9bf3bf094a8fa006f9ab8a564e2b7cfcdaef878673896af3d7aa349ed825609b8ffd82ecccf295e223472130b083f0ac5c01e6b2953d77f00ee9693150efe77

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\db\data.safe.bin

                      Filesize

                      2KB

                      MD5

                      d42b5c5980ce5ea9ecc5d9946879afd5

                      SHA1

                      aaebbaa35a3f8b0227fffc6e2f6d8f52876f3c2e

                      SHA256

                      edf88fb16b4a5ecd6fe88a2f23623875ce1b3605609efa5769efd4cf3cbe4fdc

                      SHA512

                      3e01be699fd8cfdad5ffdde7499c6840a9b445ca7a1c569d5af7d2e79c14f99147b5c25089ab02037d262db1baa139c5ccd2f16bb2aa60b0c1ae4d1e1306b4b0

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\pending_pings\219cf823-c4d6-421d-9279-f68ccab6c077

                      Filesize

                      745B

                      MD5

                      b09a16dae146a7d36f3602541dd727f9

                      SHA1

                      9d55d323313d76892a7d129db4489e748f439939

                      SHA256

                      5947054367aa25f64404d566781f506213b6fbb38f70601dbc150c7f1a467d19

                      SHA512

                      b7196328c387407178f97457f81634653566e49ccf994a2d1f7c68c951d9355e678beae3692389a3fdd7cdf84281ce6796510963aa872762dbbde43a953ed1cd

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\datareporting\glean\pending_pings\7420c430-3b15-4cdb-95db-1e586975c98b

                      Filesize

                      11KB

                      MD5

                      a0085f7e5463c5912256dd96c93a667b

                      SHA1

                      8dab4a99a8ab4d422c419fc29316c48c26d95085

                      SHA256

                      8282c73ae3b9ce9b08c816c74c40fd37b344e6762b50475abe1c6b392901a88f

                      SHA512

                      e21abe49b6771b465f69d4463d915f05bd5f54cdd479611b51431bf0448c4931bda3bed3c920a3aea655b9b8e837d63f93eac4d117aff705f2acaad49853af1a

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      64d7418f468a1ea2d4d822bcd94d8ca7

                      SHA1

                      9cc7c1ff7bb047840f46acf8b52ce14c81e9916e

                      SHA256

                      93b6540208adf76701ebcc479569c515bd79d9404539845f256944db5644d567

                      SHA512

                      5d5128760f7b8608494fdf3f9d154580e031ef09ffd677a90fe1cb699f59ac1c2ecfaa77aa387f69dd5c57c7c1913e4f7886adacf1666eb187119f83ee43ee28

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\prefs-1.js

                      Filesize

                      6KB

                      MD5

                      8921cb82f992fb76f8ddff38b07bf5d0

                      SHA1

                      685dfdfb18329bf719caf8b48e6b2404135d56fb

                      SHA256

                      4d59c4eb32d890076c6db47f285fc641b2b34e0bfdd1e75f75368c26bf7072c5

                      SHA512

                      b6c6adf7fd4f6651a7fb47c7847273ec1bac1c65f815b682a030a5b43cc97561e247b7dc1f2442bfdecd98b4bbf151a6e2d4e79995421fb1b0fd63d02a144460

                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\sessionstore-backups\recovery.jsonlz4

                      Filesize

                      1KB

                      MD5

                      487b84b4088dc971299f14085801c2bc

                      SHA1

                      a608851199a63f33bb9fa942d5614ca4b58cf9cb

                      SHA256

                      2eb9976d5be0acbc9521ba301302590ef3bbd595c7e313f4802528280df4c12b

                      SHA512

                      1345c626534fdfdaf6942a6083d755c2edad2aecd8d91814817652e63c1eda02619d37d873ed6917ca8b4ef6c9f88ded83c1d497466c28d9bad577caf25c0f20

                    • C:\Windows\Installer\f770280.msi

                      Filesize

                      14.0MB

                      MD5

                      4fff2618d8f4f571bd0fed70db95a6a2

                      SHA1

                      0c2dc8df585ef1fb3d963820d4b9a5c5a41ad0f6

                      SHA256

                      d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6

                      SHA512

                      b05a8627f52943f5b1beacfdbc45c49c9cc70c9a12e8a165b8587d6a7bab18edf1bb7d90231c404a4be7c0c7b73856056a5d11d642eefd83a8d2cf236636dfc8

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l2-1-0.dll

                      Filesize

                      19KB

                      MD5

                      adfc5bebc4a2c52023f47a1e548b0cc9

                      SHA1

                      a2562ef8534b1448409adfa6c5d7e283ad005a70

                      SHA256

                      7de5743f68d9bd6cff0fb8021c22d4069e2e993d97735db0ef65756ff915f39c

                      SHA512

                      89665104bd17f9020a871215f03acd40294302e933e503ad22b208ec7c96dddcf5f7b1ae1aa2c3d83fbd608d525d36ff2f7ee86762e44e441153124da352a278

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-heap-l1-1-0.dll

                      Filesize

                      20KB

                      MD5

                      6521cf7e6a66c747726fd09e51a1f92d

                      SHA1

                      b89168c27063a2b4f81c69df4ce23f144b55bcc4

                      SHA256

                      dc8ae6136313ed0ee26aed6e9d3a192413d62e12c7c568fae5a7abb784ca4c72

                      SHA512

                      03a63ed3c2e0be3e1e918eb01e5fb722be06d8e32179782ed3f7106048f522426bda045cd3ae605a066403bded2621923a8c33d075bf8e11b58c432a69481ac2

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-locale-l1-1-0.dll

                      Filesize

                      19KB

                      MD5

                      281399c6a7ca9c52c6b20c78938ec2d3

                      SHA1

                      5e76793588075edaeedab8d30297d9a8031c74b5

                      SHA256

                      58e0f4ae04529a03bc5a453cdb891fcdaf82e4d7ec2757b3f88f5f967407fc94

                      SHA512

                      459fe7cb8433fa23dc765894b78c1e2fd007ac3ed659d6f4fc9191a589e349107f7c4c03718e34c9a9231324fdcd970fae75e2772c153a97001933869628a7e6

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-time-l1-1-0.dll

                      Filesize

                      21KB

                      MD5

                      32abf928ec4678c2bd68a894da7de229

                      SHA1

                      eccc5e68ecf49a8bc448b88a6a8887a570ce47d4

                      SHA256

                      ae60603ed90d3ce024a9c05bdac449abb34ba43251241a27298f4a717a27c249

                      SHA512

                      0e71ba1249f65e05461c3e416876502104dc302131312d44151ebde2d95df9433b6faeea3ca0e1afe5831172d59eaf3f348735609894e5ecec3f8d31d199ab2b

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-utility-l1-1-0.dll

                      Filesize

                      19KB

                      MD5

                      59bf6195153eab0d466f501bf8f14f68

                      SHA1

                      e6e156d6c3eed6b4190a266f7374cafac8ad1c07

                      SHA256

                      28af247eca739d17fd68979b8c5067deaf85d4bf8478f480d00dc0337c06f47c

                      SHA512

                      abd4e96c6e1f54e989e3167402188136aca172cd926e9910a456094bcd0fade2f0eaac97887dcd1bdef658d8b6d5606a9a493d6b0687653a0496228cf1907ecd

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\libI18n.dll

                      Filesize

                      25KB

                      MD5

                      602aeec43305021dcea0103bfd6167ae

                      SHA1

                      1eef22e0c1a076cf88fbe875974d0dd4d40e4d19

                      SHA256

                      33e177db21f3f21b7d8cbe0d87e92042f3e45f892491046a26fba1e989e2c38e

                      SHA512

                      921e2b8be67b8180f0c77fb186d03c02ed3f5c3aa492618a399de3f72113161d131d081d0a34dd9ae8dc1b1218601154bf4281e5511679683389f151399a6165

                    • \Users\Admin\AppData\Local\Programs\Network MPluginManager\vcruntime140.dll

                      Filesize

                      78KB

                      MD5

                      a37ee36b536409056a86f50e67777dd7

                      SHA1

                      1cafa159292aa736fc595fc04e16325b27cd6750

                      SHA256

                      8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                      SHA512

                      3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

                    • memory/1996-335-0x0000000073EA0000-0x00000000740F8000-memory.dmp

                      Filesize

                      2.3MB

                    • memory/1996-372-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-331-0x0000000062E80000-0x0000000062EA2000-memory.dmp

                      Filesize

                      136KB

                    • memory/1996-333-0x0000000070F40000-0x00000000712A4000-memory.dmp

                      Filesize

                      3.4MB

                    • memory/1996-334-0x00000000743D0000-0x00000000744F1000-memory.dmp

                      Filesize

                      1.1MB

                    • memory/1996-332-0x0000000062480000-0x00000000624A5000-memory.dmp

                      Filesize

                      148KB

                    • memory/1996-324-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-363-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-367-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-370-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-374-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-373-0x0000000003EE0000-0x0000000003F6E000-memory.dmp

                      Filesize

                      568KB

                    • memory/1996-376-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-336-0x0000000074120000-0x00000000741A4000-memory.dmp

                      Filesize

                      528KB

                    • memory/1996-381-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-382-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-378-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-369-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-383-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-384-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-385-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-394-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-395-0x0000000007BC0000-0x0000000007C40000-memory.dmp

                      Filesize

                      512KB

                    • memory/1996-325-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-452-0x0000000073CF0000-0x0000000073D6B000-memory.dmp

                      Filesize

                      492KB

                    • memory/1996-317-0x0000000003BE0000-0x0000000003D39000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1996-316-0x0000000073CF0000-0x0000000073D6B000-memory.dmp

                      Filesize

                      492KB