netprofm.dll
Network List Manager file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real netprofm.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNetwork List Manager
2 known copies
10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\netprofm.dll · signed by Microsoft Windows
141861bfe762b074df080d1d0111e0a789743db25c35880e2fc304860f32a78410.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netprofm.dll · signed by Microsoft Windows
09d70c7fc0d7df9d63db0d2bd6fad940a40eb893bd69e876decaaf25295d4c88From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names netprofm.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.