doplugs | 318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd

Analysis

max time kernel
149s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/04/2026, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd.msi
Size 1.1MB
Sample260407-nx963set4r
SHA256 318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd
MD5 d7ee0e37a0f1d9b1f47f496ef2addd4d
SHA1 79d6423eae1749c5a10964bf457f8200b817729e
SHA512 5beee68c8313f6b0bd5d872a97020ef0766ea8eab3c04e0c91fc03187f9f4f57ab9e410f2f7493c9441f926001c44a853d1dd25b9b44145cd782b74204fff314
SSDEEP 24576:i+j+1BxtFbftaGkDc4ku+xqm/YxsjiqoN:i+qtbfI3Q4krxqm
TLSH
T14D353339664C2624E7119EFE0DA7E3E14B49EE8D9D0718D539A1B12FC7311C2833BAE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery doplugs persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

DOPLUGS
DOPLUGS is a customized variant of PlugX malware family.
trojan doplugs

Detect DOPLUGS variant of PlugX 1 IoCs

resource	yara_rule
behavioral2/memory/436-28-0x0000000002C20000-0x0000000002CC0000-memory.dmp	family_doplugs

Doplugs family
doplugs

Executes dropped EXE 2 IoCs

pid	Process
436	cnmpaui.exe
2948	cnmpaui.exe

Loads dropped DLL 2 IoCs

pid	Process
436	cnmpaui.exe
2948	cnmpaui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\CanonPrinter = "\"C:\\ProgramData\\SamsungDriver\\cnmpaui.exe\" 905 228"	cnmpaui.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5805f6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD6CAF26A7E6F6739.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{922EA3FE-ABB3-4956-BEB8-B03D1E427CDD}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A7D0E177B497596.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5805f6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBEF8D7EEA9794EEC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI693.tmp	msiexec.exe
File created	C:\Windows\Installer\e5805f8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEABB67E7D06E477F.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4660	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnmpaui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnmpaui.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Version Vector	cnmpaui.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cnmpaui.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	cnmpaui.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\ms-pu	cnmpaui.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 31004600380045003500390034004600450043003500440041003100460046000000	cnmpaui.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4372	WINWORD.EXE
4372	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5092	msiexec.exe
5092	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4660	msiexec.exe
Token: SeSecurityPrivilege	5092	msiexec.exe
Token: SeCreateTokenPrivilege	4660	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4660	msiexec.exe
Token: SeLockMemoryPrivilege	4660	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4660	msiexec.exe
Token: SeMachineAccountPrivilege	4660	msiexec.exe
Token: SeTcbPrivilege	4660	msiexec.exe
Token: SeSecurityPrivilege	4660	msiexec.exe
Token: SeTakeOwnershipPrivilege	4660	msiexec.exe
Token: SeLoadDriverPrivilege	4660	msiexec.exe
Token: SeSystemProfilePrivilege	4660	msiexec.exe
Token: SeSystemtimePrivilege	4660	msiexec.exe
Token: SeProfSingleProcessPrivilege	4660	msiexec.exe
Token: SeIncBasePriorityPrivilege	4660	msiexec.exe
Token: SeCreatePagefilePrivilege	4660	msiexec.exe
Token: SeCreatePermanentPrivilege	4660	msiexec.exe
Token: SeBackupPrivilege	4660	msiexec.exe
Token: SeRestorePrivilege	4660	msiexec.exe
Token: SeShutdownPrivilege	4660	msiexec.exe
Token: SeDebugPrivilege	4660	msiexec.exe
Token: SeAuditPrivilege	4660	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4660	msiexec.exe
Token: SeChangeNotifyPrivilege	4660	msiexec.exe
Token: SeRemoteShutdownPrivilege	4660	msiexec.exe
Token: SeUndockPrivilege	4660	msiexec.exe
Token: SeSyncAgentPrivilege	4660	msiexec.exe
Token: SeEnableDelegationPrivilege	4660	msiexec.exe
Token: SeManageVolumePrivilege	4660	msiexec.exe
Token: SeImpersonatePrivilege	4660	msiexec.exe
Token: SeCreateGlobalPrivilege	4660	msiexec.exe
Token: SeBackupPrivilege	2000	vssvc.exe
Token: SeRestorePrivilege	2000	vssvc.exe
Token: SeAuditPrivilege	2000	vssvc.exe
Token: SeBackupPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4660	msiexec.exe
4660	msiexec.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE
4372	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1576	5092	msiexec.exe	83
PID 5092 wrote to memory of 436	5092	msiexec.exe	85
PID 436 wrote to memory of 4372	436	cnmpaui.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1576
- C:\Users\Admin\AppData\Local\tBrUsdjY\cnmpaui.exe
  C:\Users\Admin\AppData\Local\tBrUsdjY\cnmpaui.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Сахилгын хорооны 2025 оны 05 дугаар сарын 20.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\ProgramData\SamsungDriver\cnmpaui.exe
"C:\ProgramData\SamsungDriver\cnmpaui.exe" 905 228
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5805f7.rbs

Path C:\Config.Msi\e5805f7.rbs
Size 8KB
SHA256 77087753b3c1843c23779f63ccf09fc2a152c18d45e98b0faa77d09be283a95a
MD5 6c1cee5164b6816374787c4b0366b056
SHA1 9a38b9b7afec5e9f097c6832f1eb7bc08e2dc889
SHA512 e54cfe56bb3392d90c399714dbdd11320bfa8aae48eec327501080096cf12bc724a7e1562d43bfaf0d3936491a97414750ecd54abeb3f66c45be8e55c34e0af8
SSDEEP 192:yjmOs2wVjCAbOY/IAOY/AGCe28xSS30op1E:yjmOs2wVtOWOLGx28xSS/E
TLSH
T1A5022306B6009AA3E47E2737C6572F153BF3D3D9C2563B1F548B88249F437888A496C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD5113.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Сахилгын хорооны 2025 оны 05 дугаар сарын 20.docx

Path C:\Users\Admin\AppData\Local\Temp\Сахилгын хорооны 2025 оны 05 дугаар сарын 20.docx
Size 16KB
SHA256 f21c5fbe05d0fa26842fd321e12f47010e7a35d2cc45c77290ff15b4be5e7051
MD5 a2647c69f8d8dc9b69b73de63fe01f6e
SHA1 5fd3f38d5f49e5cf541a2c75f66cc9067ce1b443
SHA512 5c8c472183475c9db74967e2db3b90fee5c1d6179fb28402cc7eff7cbaa12c8c6f28b1b4117f7db00b41e24e70d7cc9c6bf91a0e0e8604beea9bc39decaf4ade
SSDEEP 384:ac07oaCzMVgbCpwqHmB3/aM5cTPC5Dnut/h0LqAt:50oACWpwqHmF/aM5TDnuJy
TLSH
T1B172B0ACD5C5F809E9D18EFA981D1397F540C54F63587C7D542ABCAA8A303472F1A9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cnmpaui.dll

Path C:\Users\Admin\AppData\Local\tBrUsdjY\cnmpaui.dll
Size 693KB
SHA256 aa6f32f37c6624e4f0c13ce3f68f11275de732b72c361f5a7874996400a80017
MD5 1835b564a36d59944d86ec8ef426e050
SHA1 91a6d9d0a5ad69072e058f1d03273aa4ebd5fda0
SHA512 d58bdfebe504856da478e10bf9e4d22cc4cb8b3402de59e53b7588a3c771e7ee8fb3ca5f80fff7340bf65dceb3eb6aa071d0b3f343867ad05519a0a7af89ba18
SSDEEP 12288:crbhHUF8Xa0zog0JBPRJC2vKNV0DXfQrv9J3BoQ/5YRzD6ax8nGZ:Gbh0F8XtogmRAhJRyx6a
TLSH
T125E49D02F681D072D9DE1036015AE77E5ABC6C318B50CAD7D7E0BDA82D723D16E392DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cnmpaui.exe

Path C:\Users\Admin\AppData\Local\tBrUsdjY\cnmpaui.exe
Size 351KB
SHA256 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3
MD5 0538e73fc195c3b4441721d4c60d0b96
SHA1 baa569318144905563b469a5a006ad54eb616a02
SHA512 61ea88618b317be4123d5ae9abf77c13e20f68510df014d00aaaa762933189e7f90af6d77f1df7e06b1e92690458027fea0b6e1e1f61d43c615a8bf8960da9ff
SSDEEP 6144:Icf1ilncapZSD4CPpdOHFCJdCCKCjdHvvpphA7vvI1k:Lf+capZO4uaEJECKc3phAU1k
TLSH
T1C4747C1279808432C2B738704679F1B21DBEBC315D645A9E23EC2D7A5FB45907B29B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cnmplog.dat

Path C:\Users\Admin\AppData\Local\tBrUsdjY\cnmplog.dat
Size 638KB
SHA256 823d59cc9b0ae5705ba3732ad09897bf83403030c03574641f14dda1a853bcd4
MD5 c810a334ddbeb86677fb2676de6b5370
SHA1 05a292659c0eaafa7a10aaf193e08ccaad91b4cc
SHA512 cedd26ccd28aae9a8f830988f543364a433ae85f2d1c7192e9387a02c71f8f38b092410af63cf3674be1314176104e2aab52aa0122ca9b172bd3d31f58d84654
SSDEEP 12288:UzVmUkHgqymaBk6zwdB6ZQuo8xqmQI9RaQyJj5ia2y:ucPaBk6eQ2udxqmBaxJjga2y
TLSH
T1F8D4232A415C3939D3034CFA3AB5BECACB09D6CDCD5E50D16975795FC6280CB0391AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUSTOM.DIC

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Size 16B
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
MD5 SHA1 SHA512

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

e5805f6.msi

Path C:\Windows\Installer\e5805f6.msi
Size 1.1MB
SHA256 318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd
MD5 d7ee0e37a0f1d9b1f47f496ef2addd4d
SHA1 79d6423eae1749c5a10964bf457f8200b817729e
SHA512 5beee68c8313f6b0bd5d872a97020ef0766ea8eab3c04e0c91fc03187f9f4f57ab9e410f2f7493c9441f926001c44a853d1dd25b9b44145cd782b74204fff314
SSDEEP 24576:i+j+1BxtFbftaGkDc4ku+xqm/YxsjiqoN:i+qtbfI3Q4krxqm
TLSH
T14D353339664C2624E7119EFE0DA7E3E14B49EE8D9D0718D539A1B12FC7311C2833BAE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 fb3a7293333f8288427f852ff7fe3ada3b39ab8cefbccb2c3a75413b2ee88e7f
MD5 a2f206ca2110791281b3145cdc01a844
SHA1 fe66ccc954ea29284af100548dca20cb11f414cc
SHA512 53dc72c73bf2b7fa1e2072eca953c03e368cc6f3a16ff013b6ad763ada6bef49b144d7b7d6a16867955d725f10879aea95343ea50ded1eea53e4612fa3e817af
SSDEEP 24576:e2gmSp15doO/vvTLEGveR0Xaf6pEQYrVWWMN3pkP2U64EjL6o0O47CFox:6
TLSH
T15347D12432FD2240E7F79E3D6CF0AA27493A7D5B9C159E8D45421B4E0921BB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2282f195-31e8-4a44-ae53-126ac253e55c}_OnDiskSnapshotProp

Path \??\Volume{a37a13d3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2282f195-31e8-4a44-ae53-126ac253e55c}_OnDiskSnapshotProp
Size 6KB
SHA256 6084bbf49db004c4f9b41aeef8a5d4006d74812f88549f9b0cc49cd661034874
MD5 13866ed84e667d51fe878991abf0aec8
SHA1 80e8e888c9e5377d9f0a10e82f5701d738dc836d
SHA512 4ff1e16f294e975a5fd677b9a28b2946e86950540c019456f9cf83bb5ca98d594259ccb961697bbd53cf7a662df20aa7faf9fbf400d75650a024e2e492fd8378
SSDEEP 96:FX4nslvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:yWb++ZVmN
TLSH
T184D189185AF54711E2B3AB3129F18557A477B911EF33CB8E0298238E2670A10F876F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-30-0x0000000002CC0000-0x0000000006966000-memory.dmp

Download

memory/436-29-0x0000000002CC0000-0x0000000006966000-memory.dmp

Download

memory/436-93-0x0000000000D20000-0x0000000000D26000-memory.dmp

Download

memory/436-94-0x0000000006AB0000-0x0000000006BFD000-memory.dmp

Download

memory/436-28-0x0000000002C20000-0x0000000002CC0000-memory.dmp

Download

memory/436-40-0x0000000002CC0000-0x0000000006966000-memory.dmp

Download

memory/1576-92-0x000001CE25F90000-0x000001CE26308000-memory.dmp

Download

memory/1576-100-0x000001CE25F90000-0x000001CE26308000-memory.dmp

Download

memory/2948-80-0x0000000002E30000-0x0000000002E36000-memory.dmp

Download

memory/2948-81-0x0000000007420000-0x000000000756D000-memory.dmp

Download

memory/2948-59-0x0000000003610000-0x00000000072B6000-memory.dmp

Download

memory/2948-60-0x0000000003610000-0x00000000072B6000-memory.dmp

Download

memory/2948-73-0x0000000003610000-0x00000000072B6000-memory.dmp

Download

memory/4372-547-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4372-520-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4372-42-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-577-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4372-95-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4372-48-0x00007FFECD5F0000-0x00007FFECD600000-memory.dmp

Download

memory/4372-44-0x0000025DB4230000-0x0000025DB4240000-memory.dmp

Download

memory/4372-45-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-47-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-43-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-575-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-576-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-574-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-41-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-524-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4372-528-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4372-573-0x00007FFED0190000-0x00007FFED01A0000-memory.dmp

Download

memory/4372-49-0x00007FFECD5F0000-0x00007FFECD600000-memory.dmp

Download

memory/4372-559-0x0000025DF41D0000-0x0000025DF4548000-memory.dmp

Download

memory/4660-24-0x0000012A4F440000-0x0000012A4F7B8000-memory.dmp

Download

memory/4660-3-0x0000012A4F440000-0x0000012A4F7B8000-memory.dmp

Download

memory/5092-536-0x00000239B7CC0000-0x00000239B8038000-memory.dmp

Download

memory/5092-4-0x00000239B7CC0000-0x00000239B8038000-memory.dmp

Download

memory/5092-91-0x00000239B7CC0000-0x00000239B8038000-memory.dmp

Download

memory/5092-581-0x00000239B7CC0000-0x00000239B8038000-memory.dmp

Download

memory/5092-584-0x00000239B7CC0000-0x00000239B8038000-memory.dmp

Download