51e04d53d99e1f171203214ecd64641d123a3f634e97967e9d05b2a789c1f0d2

Analysis

max time kernel
10s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension-fix-39KQES.hta
Size 3KB
Sample260803-ltrjfsfe96
SHA256 51e04d53d99e1f171203214ecd64641d123a3f634e97967e9d05b2a789c1f0d2
MD5 dca443930be4964ad77003090fe936ae
SHA1 17ab95ab9960f944a7a2f84198ee56e4de237b71
SHA512 18d1babdbcd8d8697f0b344b159cf77a038da87715f5049e6992f715c4ff12c0e553a963d881d32a0a5df021d1894dc700dcb120ca0c93243303f8d7704c2526
TLSH
T1556134F7B94A82C6BC328AEB1A2F519D109117021366E4F8F696DC00EF8CF5D45B83D8
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware defense_evasion discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5052	mshta.exe
6	5052	mshta.exe
8	5052	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4548	cmd.exe
6044	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6044	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1112	rundll32.exe
4292	rundll32.exe
4988	rundll32.exe
5532	rundll32.exe
5052	mshta.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1112	5052	mshta.exe	91
PID 5052 wrote to memory of 4292	5052	mshta.exe	90
PID 5052 wrote to memory of 4988	5052	mshta.exe	92
PID 5052 wrote to memory of 5532	5052	mshta.exe	93
PID 5052 wrote to memory of 1548	5052	mshta.exe	94
PID 5532 wrote to memory of 2252	5532	rundll32.exe	96
PID 4988 wrote to memory of 4064	4988	rundll32.exe	97
PID 1112 wrote to memory of 5376	1112	rundll32.exe	98
PID 4292 wrote to memory of 1696	4292	rundll32.exe	99

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1548	attrib.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\extension-fix-39KQES.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5376
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2252
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +h +s "C:\cpnmolfy\"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1548
- C:\cpnmolfy\cpnmolfy.exe
  "C:\cpnmolfy\cpnmolfy.exe" C:\cpnmolfy\cpnmolfy
  2⤵
  PID:692
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  PID:3228
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4548
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 300 -w 1000 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 15de2e48561a1125008ed37c9fe1f40a9e49023e56516474246732f533794fc7
MD5 248d5373a9819dc0a655e1d72a55841a
SHA1 e881702f7a52869a33dd0c953b8231629bfcd670
SHA512 dc9a98b56f3e7b1d90329b6ddb7fc0af3b7a1611458e36e1b937325c3fe4ed27e6f3b92569c98f49ad011ecd0ba394f213919c35e06226354d1a1f692e96687b
TLSH
T14FC02B0433F10175F2300D7F0643530147FBE100CD4183000F345218C21CB028CF0C02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 b23d755ce26ba39ebbead6efef09e17e8d39508b6ba8f36e2dd196dbb07151f9
MD5 559cc29eb8a8eb56a0fbb82acd156cc6
SHA1 126f1579b142f316f149eb87b8943130fdc042a5
SHA512 8ddd212fc802b5cb0906b07479ce6a7ab7e92237aa340f7dea7e53a4ec12efc76a5b8c7a9359a80b3f8c86c052b0d399a2ddad9c750a75029e5ae1fb3cbac248
TLSH
T12DC09B1473A54715F10E113D7DD51A0457B55115F5CBC3044B785134861864448B1D05
MD5 SHA1 SHA512 TLSH

Submit Download

a1.zip

Path C:\cpnmolfy\a1.zip
Size 494KB
SHA256 a0fece68992adf46d5617a535a6c4c43e0d35b16ca280e88b6b029d5b7e2a3d7
MD5 ea934669433831cdc2c310c8e164775e
SHA1 fde8d97a69950496cfdfb8f6ad4533ed5a739f9a
SHA512 fe524c2d05e61c09a31336dacf94c5e8e22d1cabbdae7d4d21a79beda9176b0bc4491aa7f858519f417c2c928e925d0b4d3f257ef54730a1b915fd9d4f7e864c
SSDEEP 12288:qxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIY:qq7hblmK/dgGeVlk22aCarIY
TLSH
T109B4231C22C4BD086D3D97FB58539F7405EA269E14B8024CE18B63C4BBCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\cpnmolfy\a2.zip
Size 1.3MB
SHA256 4f1b74cade3e0519d1055bf6e8f570f31ae1189a8c72fe91e7fbbe005ed24a53
MD5 aef1b6be4ab45568b9e929f324d174dc
SHA1 cff75bf3c0bc71b0dda8ae790426f3b891d9bdfb
SHA512 7e32c40beebb443461dc2dc6bf049e70943f7b155d93f3494c4bcbb7b01e23a2afe14ca8b312a2329e89da1cac28acc7f8dfa1bdd789eb319612a324441db1f8
SSDEEP 24576:8AuYNwua6NduNqjRt1pSdu4E0mcKptG6lgVT0kQkmSp9QpDH1tMlya+:8AuSw7Ku4xpSd7m7BlgVQmvQJH1tj
TLSH
T19A553355B7EDDF14E07D52A1C9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\cpnmolfy\a3.zip
Size 2KB
SHA256 b628dd03391e836c2dec15c647fd7af1e6a009dcae3ec373add2303667860d43
MD5 7678115629a22137b204bfad7c32464b
SHA1 d2263d14c020fc98d8fe0769521a068769d5a6bb
SHA512 54b59e58b182a0d4c105b04ab755bdd6e05ce26ff07637fcb60ad6820967e1bcbf7efa6ce112f1fd82a241643250f3ce38d3f85fc735da956a35beb9661a93ae
TLSH
T1D9413AE88D6CBE91D28EB9349A245870563B2EC489C061680EBFEC442230398DA2F42C
MD5 SHA1 SHA512 TLSH

Submit Download

cpnmolfy

Path C:\cpnmolfy\cpnmolfy
Size 1.3MB
SHA256 30af0a4b9b7c7d8cf41c169be3d51c03d9dabd0c18ed699b31850b618b5db55e
MD5 3acd16edf0a4a2c6ece5bdb47bbfe252
SHA1 f2c68a96d6233778d1900a859ff089284c1672f2
SHA512 db484aa924751393a2bb72b482dea0882e2ea077a48f24e9535c1dd4fb49491779832533a50b509770220503952dc01253e62205b3a376ee4660d7c7f3348172
SSDEEP 24576:wAsYBwwc6NnutqPLth3SduIE0mcKppG2RgzTckokmGpVQpHH3tghysG:wAsiw7WuYn3Sdpm7PRgzIYrQhH3tb
TLSH
T121553355B7EDDF04E0BD51A1D9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpnmolfy.exe

Path C:\cpnmolfy\cpnmolfy.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-110-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads