261144f579fa466a48d4e9a01e9d62b8b72d367ddcd2ba4f4ae885d2759b9dea

Analysis

max time kernel
14s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nota Fiscal Correio-FCS3TY.hta
Size 46KB
Sample260803-qx2wtazgpc
SHA256 261144f579fa466a48d4e9a01e9d62b8b72d367ddcd2ba4f4ae885d2759b9dea
MD5 531c1bfec5a168eb0c38ad8f64af7a3a
SHA1 96e3c0527ca1a56acaec9a6933c9d20f95b8c620
SHA512 18e5ac3b7f82d833e7b05adeab8f650dfb68a9f0454ea0838fce10cfe8a528144f4ae0f563f9b652e0001abd003a86bd07ff2f51debe0ceed7a1ada3afc46bf8
SSDEEP 48:5Rkka0jf3ZRwXkS8Z+ATNNjCzWS03TSaHxHY0LzbqlovL+j9VDN:5RfPRw2Z+4Pe8TSExHx/bqlovChVR
TLSH
T1E723A7F3BA0A06C5FC7149BB4B2F609904C426035396D1B9F2AEED04AF89E5945783E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5532	mshta.exe
7	5532	mshta.exe
9	5532	mshta.exe
10	5532	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2616	cmd.exe
2640	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2640	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5696	rundll32.exe
540	rundll32.exe
5924	rundll32.exe
988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 5696	5532	mshta.exe	91
PID 5532 wrote to memory of 540	5532	mshta.exe	90
PID 5696 wrote to memory of 5936	5696	rundll32.exe	92
PID 540 wrote to memory of 2852	540	rundll32.exe	93
PID 5532 wrote to memory of 5924	5532	mshta.exe	94
PID 5532 wrote to memory of 988	5532	mshta.exe	95
PID 5532 wrote to memory of 792	5532	mshta.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
792	attrib.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Nota Fiscal Correio-FCS3TY.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5936
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:5924
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:988
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:5756
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +h +s "C:\opjsqnjs\"
  2⤵
  - Views/modifies file attributes
  PID:792
- C:\opjsqnjs\opjsqnjs.exe
  "C:\opjsqnjs\opjsqnjs.exe" C:\opjsqnjs\opjsqnjs
  2⤵
  PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:00000000
    3⤵
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2616
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 300 -w 1000 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

D00881249E8ACE3C38D6E432A97CAF57

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D00881249E8ACE3C38D6E432A97CAF57
Size 347B
SHA256 460bbe332720d1fff79afd2f08073794e62e8475f148f47a50c31d07757002f3
MD5 74fa80d699df99133ae50ceb78bd34e8
SHA1 d58ce4369b35c4823822d5fe933fb08255190bf6
SHA512 d476e2740b7b126f3d1861a16bc9c4c9b8dd31c1cb8ab82fddaa363ef2690d49fad0af746da023e883f0de7bd4a790028d49446c5760b50d6fa75190daa0f7b0
TLSH
T126E020D1E6593B937664F800D890C87B5DF454C1255E60512550DA6145D7B87E6C0248
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 7bcd4805774e1776fbd355af9d98f0ee6e189247c120143762e409f2b9d52032
MD5 7ebd3dc9c3683ce6e2a39fce90620601
SHA1 3c00e69b8755a506e4d7edadcc5e2ad1b257823a
SHA512 84c5927c878f53a56c84e7dbba63e56c504891f00eb11dd5af4422d304bbc9333baee6a447604fc0041a13242497323b6d68c2c45edc38104a53c57b03bd3220
TLSH
T10FC09B043BB5415DF1704D7F16D7632147FAF505CE5183544F705259C61DB429CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 64f2e030b864c9d13b37caa4e7565eab286f2b7ad02e37261b19ea15a2a4c7f8
MD5 b5555291d466415b4070c4d0cc8ad901
SHA1 bc3cd438f721d138e2f4ce10bdcd5c8b7907c4ad
SHA512 8ef63e9a7cdc5d819618ec15350ced862d181ecefc572153bdf5e452f4a50cda598f4d2be77123c91decd160c7d69dcf3904d685861bd78987f01aa4c31e6c8c
TLSH
T1D1C09214B7A9471EF14E213E79E62B041BBA824AF6DAC3044BB852389A2CA4408B2D49
MD5 SHA1 SHA512 TLSH

Submit Download

D00881249E8ACE3C38D6E432A97CAF57

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D00881249E8ACE3C38D6E432A97CAF57
Size 192B
SHA256 aca78dfb9acbaa2645c12dcc6c6bd67a0d40292cb73663de4f2865451b3426e3
MD5 0458b5b9899d33522cee453827a739e2
SHA1 aa0c6e5de19f3a5f0be74eb3d2b461ba92736f73
SHA512 d02642a6743dfa2c4412cd238ca31ee798b5d91f33efc01bdba8c9c24aed19085d380e3b4e6ab14f0c40c678569336140d898415f87d297be80fa256cb308b90
TLSH
T133C08C213F24020EE221013E8EB12B6207B8E324810263865BF42205878DA024C20D0F
MD5 SHA1 SHA512 TLSH

Submit Download

a1.zip

Path C:\opjsqnjs\a1.zip
Size 494KB
SHA256 8d0b09de9dbfbd58c859e04521a6354fe7e40d1ab78dac7bcc84e63a36dfbd10
MD5 18acd4e08cff5d80bbe35ddd6ada0ed8
SHA1 b106ddb47f5d17c775174be66951a228c9b04d8b
SHA512 2e7cc2f5596400f422b6239fc620242cdb178245bb237331c1d05c5b30bc510470f5547cfc91a3f37ff724888c0540a5019b3a4d4bbf1ea426e091bc830f5a09
SSDEEP 12288:/xU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIH:/q7hblmK/dgGeVlk22aCarIH
TLSH
T1EAB4231C22C4BD086D3D97FB58539F7405EA2A9E14B8024CE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\opjsqnjs\a2.zip
Size 1.3MB
SHA256 0076f761e0f2ef3e0af272996869b6981ba0e2790871b818b42dcc2a6fcf0511
MD5 4139afe1ef3836d755f8877f062d78e6
SHA1 3cbd1978e5a7a340f53eae9ad8f9921871b9be23
SHA512 515ef4a540d08384cf1739ceba6d6669c15ee32fea242957c1315083caf20d2b461ff7ce776e6908e234de21a295497f8517d0ebcf065476a91b974e5fbabe5c
SSDEEP 24576:3AQYltjM5BqgdnjIyK2UxYGAXTZWyutR+kXM0JyU9mSff3Pc7pOU5JLMiS:3AQUgNIkUx6TZW58kX9UU9mcfUF5J4iS
TLSH
T1DC5533F2195136CAA1ECBC1F05F057D581867C9ABBFE2B4E3641308E0D15F91BEB9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\opjsqnjs\a3.zip
Size 2KB
SHA256 8a6922f66114c5dde8b66040b2f0e8e3c4f1fd628f130c6e80eddb1ed545cb27
MD5 b8e21b2fa72d5b39a960f8ca744251b3
SHA1 6d413e79623cc0c124444563d1aa73e08cf3f494
SHA512 a5b7a142baa959143189b36034615b064d3ea69b6b73b6354c52c2ea9e6f374a08cd83e19527df72e2cb6ece77c507eec2be89f335a6a85849293d50c164d433
TLSH
T13C413CE88D6CBD90D68FB93499245470593B3DC485C061681EBEEC441130298CB2E42C
MD5 SHA1 SHA512 TLSH

Submit Download

opjsqnjs

Path C:\opjsqnjs\opjsqnjs
Size 1.3MB
SHA256 c7f22abb4ddd7fdb324bf80faa5449654a899c22ffc5ab8d5988be10e4a51ea4
MD5 9c4bd2c3a1bc7bd93bad88e795576cc7
SHA1 70ad55f52d1ca30b0b218ff3aa21c2aed48e75c7
SHA512 6279ae4c2b30959d068cf31bfd9bae01c729a6891fd076bc21725f86a2446d7bc6ed2c8c188db55d18ea662d686b6f26191405429ecfadba7a38fa49e5e76709
SSDEEP 24576:xAsY9j7ud5qghDjIKoUU94G2X5ZOaut1+edMyJyU9kGfX3Pc7TiUnBL9iu:xAssgxIuU985ZOBoed9UU9k4XU/nBBiu
TLSH
T1C15533F2195136CAA1E8BC1F05F057D581867C9ABFFE2B4E3641308E0D15F91BEB9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

opjsqnjs.exe

Path C:\opjsqnjs\opjsqnjs.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-113-0x0000000006BE0000-0x0000000006DA8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads