bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5

Analysis

max time kernel
91s
max time network
69s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5.msi
Size

17.6MB
MD5

ce12de24c0c3b7d34fb03195c3969265
SHA1

0561d9d3d4dfded43cdd3087d8cb7147eab9e4fd
SHA256

bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5
SHA512

078ca6b0abdb01941b1d9c9d7c5a13a6ede4171df77058069a82e943306502077ebe76a3f215504fa79d13261ed3b8a57f618c9ec85dbe717e2bbe1f2a68ff9d
SSDEEP

393216:HgTZNBsW5aieKUfQ2l+4PEl+R53X+/yTENtOvMXdUEY/X:ATTCW5aiLUfQ2pEly3cNtVXdUt/

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	1744	msiexec.exe
5	1744	msiexec.exe
6	2516	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSID6D.tmp	msiexec.exe
File created	C:\Windows\Installer\f780bb7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f780bb5.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f780bb4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f780bb4.msi	msiexec.exe
File created	C:\Windows\Installer\f780bb5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2188	WhatsAppInstaller.exe
2124	Updater.exe

Loads dropped DLL 13 IoCs

pid	Process
2124	Updater.exe
2124	Updater.exe
2124	Updater.exe
2124	Updater.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe
2056	WerFault.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1744	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2124	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Updater.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	msiexec.exe
2516	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeSecurityPrivilege	2516	msiexec.exe
Token: SeCreateTokenPrivilege	1744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1744	msiexec.exe
Token: SeLockMemoryPrivilege	1744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1744	msiexec.exe
Token: SeMachineAccountPrivilege	1744	msiexec.exe
Token: SeTcbPrivilege	1744	msiexec.exe
Token: SeSecurityPrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeLoadDriverPrivilege	1744	msiexec.exe
Token: SeSystemProfilePrivilege	1744	msiexec.exe
Token: SeSystemtimePrivilege	1744	msiexec.exe
Token: SeProfSingleProcessPrivilege	1744	msiexec.exe
Token: SeIncBasePriorityPrivilege	1744	msiexec.exe
Token: SeCreatePagefilePrivilege	1744	msiexec.exe
Token: SeCreatePermanentPrivilege	1744	msiexec.exe
Token: SeBackupPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeShutdownPrivilege	1744	msiexec.exe
Token: SeDebugPrivilege	1744	msiexec.exe
Token: SeAuditPrivilege	1744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1744	msiexec.exe
Token: SeChangeNotifyPrivilege	1744	msiexec.exe
Token: SeRemoteShutdownPrivilege	1744	msiexec.exe
Token: SeUndockPrivilege	1744	msiexec.exe
Token: SeSyncAgentPrivilege	1744	msiexec.exe
Token: SeEnableDelegationPrivilege	1744	msiexec.exe
Token: SeManageVolumePrivilege	1744	msiexec.exe
Token: SeImpersonatePrivilege	1744	msiexec.exe
Token: SeCreateGlobalPrivilege	1744	msiexec.exe
Token: SeBackupPrivilege	2136	vssvc.exe
Token: SeRestorePrivilege	2136	vssvc.exe
Token: SeAuditPrivilege	2136	vssvc.exe
Token: SeBackupPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	1552	DrvInst.exe
Token: SeLoadDriverPrivilege	1552	DrvInst.exe
Token: SeLoadDriverPrivilege	1552	DrvInst.exe
Token: SeLoadDriverPrivilege	1552	DrvInst.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1744	msiexec.exe
1744	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2124	Updater.exe
2124	Updater.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2188	2516	msiexec.exe	33
PID 2516 wrote to memory of 2188	2516	msiexec.exe	33
PID 2516 wrote to memory of 2188	2516	msiexec.exe	33
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2516 wrote to memory of 2124	2516	msiexec.exe	34
PID 2124 wrote to memory of 2056	2124	Updater.exe	36
PID 2124 wrote to memory of 2056	2124	Updater.exe	36
PID 2124 wrote to memory of 2056	2124	Updater.exe	36
PID 2124 wrote to memory of 2056	2124	Updater.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1744

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Programs\MPluginManager\WhatsAppInstaller.exe
  "C:\Users\Admin\AppData\Local\Programs\MPluginManager\WhatsAppInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Users\Admin\AppData\Local\Programs\MPluginManager\Updater.exe
  "C:\Users\Admin\AppData\Local\Programs\MPluginManager\Updater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 604
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000598" "0000000000000550"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f780bb6.rbs

Filesize
16KB

MD5
d11c655063e8a5094c252ef2d0591d13

SHA1
9dd816f8075e9fb4632734388472fbb1db514d0d

SHA256
2c0b10f6c293508b7fdc67a9f7a9b60696a09f89495d3c723324193c77a16ee4

SHA512
00ab7f0cba68ad758c2dba935bd7fe80dedbc52233b0cd17b540942bb638c0560724c0f77c3da75f56b051e789ecffe5aa381d09074b965bc6675bb43c079d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71811bd6a4342856e9f1fc68f31b1ec9

SHA1
d60548eb7692b729beb6268bddeba77d9996d9ae

SHA256
23ab88154d2ebc4a727dad2721d7b72b0633ccf5c76d03b05a63f1744b11073f

SHA512
0f997cb46bb5c95d990e78ac34bf74e49f28f4ddb1e91f8489e6d68b4ee4f33853aada175e94f34fb4d03446fcacfb606dbadc8dd1208c7102e1ff152f6425b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5771d8658d8e5f5414cc555ec219c179

SHA1
01a9da93da4bc5a3ffdd8c5fba3ab33f4c67951f

SHA256
36ee119a2d2e82b5acfe9b42a40191a4cc20620f5ba4b3f5a33788766dedc11e

SHA512
894f0477a86e0275460267e5e74009b7b992c662d520b44915d53df3a3c091951b820026c1b7c2de2a248f31ed1aba9cfa77983ceba5d18d90059d900a521ba3

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Activation.res

Filesize
28KB

MD5
d5151ea8df2f10cf6decf1ce0ecd2f57

SHA1
84850d624ca451c2fda3058868dcf2651ffab073

SHA256
bcdf4ff72eddcc7615f4da1b0f9c1d74fa4944440adf9a5710a7c77aa809c400

SHA512
157d243511611140471696bacdcc1e3855a80532c60d6201526bfcf5d9ccb5227ec9e991a5c73efef4493f497dd2b8d6b47e72a7f29ab537603d56b5a8f2b91c

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Base.res

Filesize
475B

MD5
c45815d1cbc424c8672ea0fcafb1e19a

SHA1
5d1e73b688958b74f7671b78b8c8e5f9b305667b

SHA256
008a99537cdc64594fac73d3dc48657725d99db077bb8445a705eeb0dc81ee7a

SHA512
f45f20788efe038717ecf3fdc142e5472c32525f7006dd0056e4524f7aed6c5e9a19c208d62060bd83f3feda1c2ba56841d534cbc8c30d823b4f326ed207e68a

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\License.xml

Filesize
868B

MD5
4284e79a6559a4e3917c03148f8aa77c

SHA1
ab2f1e73c1becebda97686fa8799c71d9e475f89

SHA256
b181f3f3ea7c4d750c26de0d731d37a2562340f04585364b6a0667dab0da61e1

SHA512
f9aa57f5998ab48f8897ec243a40976922ae1436159bd5b920a8ce11bae84901cd82467ac307365b3795252526aeb7638cc27b86a870e09771cd19bbdae27e46

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Manifest.xml

Filesize
2KB

MD5
2a8aa39f16c585da9f9332f3c9d4c055

SHA1
7a3cfa14ea7d4cb950dacc1bad05fd3725aeb092

SHA256
5e0d7c5808bf373b96348fb1ef6941d5438455642a75e9431c5cfeef9df13f22

SHA512
b4a98cedd2c167619bdd88de16f821e027a8c32201afb7100b7c1308b23342825b21517cf7370b6d861f3b683f4ceeebdfe4307e878808c5dea42a41f9edcd0b

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Microsoft.VC90.CRT.manifest

Filesize
1KB

MD5
c1eda860810e6299f690459006e4c655

SHA1
3e6b132ebd31297eafabed808e336ef1aa0c502a

SHA256
df2e70333883fa14f1ab0eb04665a26dbd5334edd5c5a886a72075fbebc57ea3

SHA512
836d24e7a4f222db0a1374d624ef3297ebb6aae3601f31cc1f0607b4851eecf520b2898ea7d4883f97aeea1adf890b666557590a6f3631f2f25cb821f65be611

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\PasswordManager.res

Filesize
1.9MB

MD5
e7405b5e68e1050e08b571bac11757c1

SHA1
9ded64ef0279729c2c2edf844b9cdd306fe1f475

SHA256
033b6b4326e506e8888c1173a5d9002cf3d6606a24d4f887526f24359b521885

SHA512
24c27c1f3332657a553cf35d9fff433d0d64ca72792e79dc04b5aff4a293157929233a1043b473c5580c874806fb1cc74295c8a2e014d5dd54e4cbef91481f03

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\PasswordManagerAutofill.res

Filesize
86KB

MD5
44f8618dbc366ac37dcf650ee8d55ef1

SHA1
cbc9f9372f03a34e90b103fbc2242a1c97f7db51

SHA256
e6ef294ead411848fc22fe0b253fa79929f60a6d207a4f7ddf75a1733d848716

SHA512
33ac106e03cbf97270b4adb69f312ad731ed8b4082a29b60e9e9d8394c9e931a7bb66edc8c59fbb5e97ea7b843fab594719c0a722b6cdece981526babd4684e3

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\PrivateFavorites.res

Filesize
15KB

MD5
d0bdd0b4486fa1a185d54873abd12dbe

SHA1
e751c9c3baec335395a33329257ad13880de7b38

SHA256
16dad2ddb5587957822327e3969c7d06146f4040268c95824b9b9b7460338b7e

SHA512
1a0ff0780e34a688fcf3c4823a89803dd680f6395a302eb2fa77f7df906f14618d6ddf3e7a5f195f412d9287b1212911a2a587bad8b44b2f137b5c3ed900d09a

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\SPM22.res

Filesize
200KB

MD5
c1b1bc542f0fe3e12011dca87a8ccb97

SHA1
ab6f5a6eee99ba46076ff11376102b76667a969a

SHA256
99bb55ff3040cf607dc0517bcdbac8b9ab5bd3cbae00592de62ff23a22be7f48

SHA512
d8bb62e0e13a235f071ae0a9166d20ff10794af1c455dbf905acc2c5f1959fd167f549c84deae43abb2ea1b6bc479a8728b47b4aa39ad76eb26f6c189c6c1a3a

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Schemas.de.xml

Filesize
8KB

MD5
daf3cae1f3cc33c0359016dd255a27a1

SHA1
c8087fd3219c2243b1342bc4743e2d428b4d572d

SHA256
f1291ae3abaced9c6c440836c0347a74edc55e9ef59c3ca57122117f94c051f7

SHA512
389d722243e0f74e49b6fc5c1f2ade5baf0116d7db2ba3c3964c36329d97be40be2d0e122722e32b63e63b5eb6e904539ad25dd43609f1e5e8f3991359d4f8f4

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Schemas.xml

Filesize
6KB

MD5
c4cd6304c98f3c3a704eda25e482bdca

SHA1
abc11a3d741404dd2584bf252b9a314e5d1cbe91

SHA256
d100e79bd7c393666734afaabebf0d2be0927653546e0e03106532a1d57b5e86

SHA512
2e298817e87d8343f0df6bc63587485d35da7c96e6b97bf2ccd98dc21c7a3e2d8c77566285d861ffa1f71e11a09daf47c24590633b6aa6d9ef0c1f6c2e92fb6d

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Text.de-DE.resources

Filesize
171KB

MD5
0666d28a161897bf4af4e128cacba76a

SHA1
0a84a75f6465483594346639f9832268537b176f

SHA256
98789d7dcfce59cdef2f10bb5262226002b226628410363885452520ca29838f

SHA512
e9b535f858b0ea3dd327b12dda9bb4817e1ff483e1655662d01292d8a9e9c8ac90325aa7d7bdfa077eb774e6cf0ccc6d9095ea8079199ed2031c1a98312bc1fa

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Text.es-ES.resources

Filesize
171KB

MD5
f80fe21a0fe5b8493c86581d640b0fe6

SHA1
05e106b595ea8b5cfccdb26cae4662e98d55e73f

SHA256
1413969d40c2c8c3c72d96366891dbd1a482e135c04193c2249b188035b68a96

SHA512
ea48b5d32b8a0a8fd0cee4dc77d8b7a97f0d0ac253ec497e94b43587ec12358ceef6e3cfd5463152d634f6504bd92fafd833483b1166b86fc3ba03accd2b1255

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Text.resources

Filesize
171KB

MD5
be3b62261ab70aaf47f2ef5631d6c352

SHA1
f4011f985ab4feba06a7a8f12855ae01a581f8af

SHA256
b04b4dbd8a71a2cceff8c6874f93afc93a4139541a5561ef05306986e62742a0

SHA512
19382c434ab0a8188317f887ee222a8240be0b10649e872a02711a7ea63b7f8d25a4270d6bb24bcacaea07cc41426ff87d63592e1b7bd5938575f74ea7bb8ad9

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Tleilaxu.res

Filesize
475B

MD5
dfc9198ec47ef398d3e900e94254b219

SHA1
e509ccf7116c3ed28a62d7ce2a85ff00dd6bbaf3

SHA256
dc0b785df423123ad712fa7281db092b200e07574cf021bbf26b7e473ccc8c9a

SHA512
2670d940eb9b3962572ecc8e98da396999ac888cb1958ea55ffe32d3680f606dfbe9594ae9cef0d66c8f0d676a483af8b4d4d30fe7c30f542c457540310d20bf

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Tutorial.bin

Filesize
5.6MB

MD5
8cb1b78f3798a9bc5f71455b658e3048

SHA1
a0295a2d1f95d76ab935b8dd86c461b585686cf8

SHA256
1076edd772fdf5eb69c2530397265a27ad41a07d45f1fa02c848a9db88d78001

SHA512
327521fea135b23f8695a49e6668168a73a99030ba2cded186e139ad7612dd7c56dfb958e36d98ceeb13acc521fb724b7443b66b6f484052a0ae93e85b16ba40

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Updater.exe

Filesize
5.8MB

MD5
76db1c71930b638371c13444b0a68700

SHA1
03ec9d4a03ee237259172f4df4ad0a9d6b18f1a4

SHA256
153e3adfa098a60832b77b4c9451c03011c055def3b72c1c63d89a720e22e8ca

SHA512
d222f29bf73e220d412ae3ef4cb8162bada9e8f23d31cf43bd999aef72e48ad3ed5e47aa5f31bdbde762a88199abf90125b70244a04c3326519193b19113d732

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\Updater.res

Filesize
138KB

MD5
c5b75b5657b2cefbb71f86c72ec93095

SHA1
c4a7bb24c2ded792038736136d851a93c1e0ca2e

SHA256
e8dbc94c05167989ef863d79d530b3902805fd0ab4d10bfccedd984382b19530

SHA512
fcbf280ac17e544758b1d868fe058134d04d3b1f140db0df837de916fe706c8fe505770c47ff65fe4268da55676ceaae25192b5234d0bbfa1dc5ca8d351ad1d4

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\VirtualKeyboard.res

Filesize
247KB

MD5
064354077cb1ecde265b86dfed232b02

SHA1
0c2e97c05dd5fa90e71ffb02f2ac6be6ee7a5195

SHA256
1de11e2c18eed512f32906718eb9e57faa5f1da594b92753053f6cfc41b25f7d

SHA512
02271541631e08f5c141e1ef8ad34bb672fff8a066c1f0ae844b58183f33e8dbb77d78b23963cc5b7e19b86a09f4c7c2f1b437b129d3f2f4c5a66108c9cf8169

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\WhatsAppInstaller.exe

Filesize
843KB

MD5
63dcf6d91c13961ce74812c800f34fd6

SHA1
03a5ec12dca88cbc5bd6c35ae8fdaf679b983791

SHA256
d6cb78842802cd9ca52ae17ebefcabb7686333636987c32269a3c82d4c1f48b5

SHA512
3578ca8cc849f8b05f3b1906ee64f794df7c71bd4ce142677f1034cad53e6b40e4c426a24481297a87570185b9e70c1ccbb81a9c5d36d39af6810bcf2f84daad

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\infohelper.cfg

Filesize
133B

MD5
969e8fc14135d13160f4895c652ef539

SHA1
75256a90f69ee1f55d63798150c2a1d390e1da36

SHA256
5aa3aa8f2b3dcb3cc3ae396fb914465fb219a1c623e8d80e78b0638cf9294504

SHA512
2b886707a6e9d766a202e277972e01c9b0ecafd758b602cc10f708382fb516c1e977cadf0b8e7a6312cac820d208f54b446b33678a4c8983eb01689a4e4550db

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\install.log

Filesize
51KB

MD5
9415b0f2111c4dfb328c822fe1603887

SHA1
5c02af0debe28c3e642f8e1d7ac893807ff1e8ed

SHA256
99a041ab860d41bffef5a5efcd9c4585a061af3f64f4ef295351568f34c0863a

SHA512
c8542a4ab238cabf3a3e8082fca66e7248d0565680afa44fbae67f8f28e851e8d3318eccbba23aee487547057ce1a7a4080c3c73ade81b36f17df26d04f14228

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\libde265_xp.dll

Filesize
529KB

MD5
57315ed331cab834fc8d57b884d1d7be

SHA1
887a08829924bf9f48cdceabda627e919917e3f0

SHA256
e0603b324641378d229d95e35d8daa2f55e1b25d1898941a55edb78a32e36a85

SHA512
1a1108b7f03cc8f1b44c808c8da50c1a4e07024be34ed33199eb942440d27417bc276f68d803b302fb9ff578b3bae3340f0b8d3082c7fb6565f397f1253be9cd

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\libtrial.dll

Filesize
2.4MB

MD5
de3aaeabe999176b7e4e078c5cd6f716

SHA1
5b2900f8550316e81b852a6f69e8e932d57d759e

SHA256
6c1e3cdbdb0bf7e8b91b4a7f48fd065cf87cce8532e1e2e3e3cbb61d8baf7414

SHA512
7b859f7a8d928fe4bec15df1f4832b1592b874b4866fd9addad69cfeb2d5335f9b3f26a7e9c73a48195b29e3c715b4019c34dddba72ef65eda91a119312ae1b6

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\lxcsappc.dll

Filesize
322KB

MD5
4c53d508e63238796a04e24a83da0fcf

SHA1
973b9bc7e0211a45af632da0740aa36f2523b7a6

SHA256
534956f43fb57eb4e5c0460e22b5e6ade71834c7dd4bf84a15db8468b1481c9a

SHA512
7fd01702fe013d47efa0a995bff63b5c40e253f1bc57797af6e02edd4b9420423b7143a67c3a232ba85ec67a01626072b895167c93df98cb28a496a4f0280d18

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\manifest.json

Filesize
1KB

MD5
cc1e7a89a999c1c9ae3c70022c664442

SHA1
417236094a92cd2a89a3586d4a6096f82055b57d

SHA256
4e3abf153826ad630132625d16ac0e3cadf1b53d7aded2340c72e852940b2de5

SHA512
d303dd04cf2cb4bc0c848961c1dfa5feced464c6fe7f2e63ef26807606750fcad560f37ab1a5f94d098342743c9fd44be674855f255a933faef721c2e8ae0cd4

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\soundeffects\scholarship.wav

Filesize
4.0MB

MD5
04b719cac4fe8b9ebf13f1268e3aed71

SHA1
7b21b016e24337dce86d410d84590b33eeaf90fc

SHA256
6c9893955d90725240d54ae3c34609b644034ec2391e89b27b3cee47948df27b

SHA512
71e40f8862e4a69dcbfc73726d644ebf89b46e352d6afc8a2aeec32de5c10fd785d109b2e6b4020751f46b4784dd5aaf10f4edea907600de58fe5de842ecf7fd

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\spm20.product.ico

Filesize
56KB

MD5
866b6ad0c1a834888590403ed3d66f7a

SHA1
b47817be7d85f9fcaaa85b673dbff0a93818c108

SHA256
414462624bff7103b56d12448ee1af939aae4bcf7976329dd1d3c51db499f265

SHA512
3f01c2766f175375c95a01b99d82f4718505ffa5f5032c3bc9d8f75becb248d739521ad4a16f66291fede38a71e1241025c1e06f6be1ba08be57898789963fac

Download Submit
C:\Users\Admin\AppData\Local\Programs\MPluginManager\spmplugin3.xpi

Filesize
87KB

MD5
63188109496564f71f638446d1e31ab9

SHA1
099330b0124165aa30fa52b32d55dfd58d572e2f

SHA256
1c54ff6953b55e9211689c0a8f5d64f8c95ffbae8ceeb0119b152aa3aaff7752

SHA512
17a3c2ecd4def8082e4b54eba8415a7622eb2831474b0eab3efc30c7a85babeb0e4f185f7b81952a7492520cfe69f842e8cc07e70c1887cdbbffd1504caa33df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED00.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\f780bb4.msi

Filesize
17.6MB

MD5
ce12de24c0c3b7d34fb03195c3969265

SHA1
0561d9d3d4dfded43cdd3087d8cb7147eab9e4fd

SHA256
bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5

SHA512
078ca6b0abdb01941b1d9c9d7c5a13a6ede4171df77058069a82e943306502077ebe76a3f215504fa79d13261ed3b8a57f618c9ec85dbe717e2bbe1f2a68ff9d

Download Submit
\Users\Admin\AppData\Local\Programs\MPluginManager\client.dll

Filesize
932KB

MD5
e0e41fdead62838889684023ab16b40e

SHA1
16456de2e1ea02e8fa60759b1b58b84418c703d7

SHA256
180946c5bb623ab560dd2b95cff7bdf5c3408248ae43067ea400efd647f209d9

SHA512
cd6972cc4350d989694beb602ac0118eb12316ce1a83b79e05527af000ab0a96575fd01d121d909f85d03b9ffe9030a14edbf1f2b4b0c7e346814f620ca244d9

Download Submit
memory/2124-152-0x0000000003D80000-0x0000000003ED9000-memory.dmp

Filesize
1.3MB

Download
memory/2124-144-0x0000000074C20000-0x0000000074CA9000-memory.dmp

Filesize
548KB

Download
memory/2124-231-0x0000000003D80000-0x0000000003ED9000-memory.dmp

Filesize
1.3MB

Download
memory/2124-230-0x0000000003D80000-0x0000000003ED9000-memory.dmp

Filesize
1.3MB

Download
memory/2124-229-0x0000000003D80000-0x0000000003ED9000-memory.dmp

Filesize
1.3MB

Download
memory/2124-352-0x0000000003D80000-0x0000000003ED9000-memory.dmp

Filesize
1.3MB

Download
memory/2124-371-0x0000000074C20000-0x0000000074CA9000-memory.dmp

Filesize
548KB

Download
memory/2188-139-0x00000000000A0000-0x0000000000172000-memory.dmp

Filesize
840KB

Download