Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 22:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
UsnJrnl2Csv64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
UsnJrnl2Csv64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target UsnJrnl2Csv64.exe
- Size 1.0MB
- Sample260814-2xdprstygw
- SHA256 273f18e0a6075252ee0ee02e0e5d3962dc52bbf38f1557510e5148f2d7a2540a
- MD5 f3a2f1a95efccfeb0f4141cff77069c2
- SHA1 b57744242292feb1eee2c4ac9b48d92590d9e694
- SHA512 08e096ac751df6638c4bf31eac01457d0aeb83271bfa5086c895c1d5e8c61b45c2d764c86b9ef4baf04e275e7b9d102f260effa2a59e102ad1d78a928914a645
- SSDEEP 24576:QmJZW2wSdIHuiCyhuGaD0y13DrmmfVpd+c2ZAa7ZRaRJ3T:QmJZW2FIOiCIuGaD0yh/zvd+c2ZAafa7
- TLSH T157357C4973A4429DFEABE176CA13C607D7B178460277862F01E49B766F337712A2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4324 UsnJrnl2Csv64.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe 4324 UsnJrnl2Csv64.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-57-56.sql
- Size 786B
- SHA256 db168bf494c37580cd59c21e30d95d9406a2131feff90cf48a4361546546250f
- MD5 751835e39d719e24b1dc17c2a5255457
- SHA1 be2a9d5f14bbbb06433a0eea18a54d1b67be4592
- SHA512 29665d12c79d8121c552f919e47df7f597794af3669be68e18900715b505651d848078ca07469dfdba3779d047bf2ea0ae887427bdf1bbc7b6306f8d1b61d3ed
- TLSH T12A0189209C6707213CA1A1B972E425F0BFB0BF038C0A00CBB919219E04565AEA3B5929
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-57-56.sql
- Size 832B
- SHA256 598e5040f3a9593c32c219c7720deb4536eb6dec65c216b6f628249cbe6e4cc6
- MD5 cb881a28711fd0cbe054f2ed28cef34c
- SHA1 e816ade02f762e25098134aed7514080d50aa680
- SHA512 58debdcee0379a537d6c4e46b4bcad5bf5d61d9c4a1eedb8dbc655b9759c73610bb8cbbfcbb61a18278631f928fc1ee56aef8a608899c4581343714593ea0ca9
- TLSH T10A016B20AC7757213CA1B17D73E42AF0BFB0BB079C8A108BBA14219E045656EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-02.sql
- Size 832B
- SHA256 bbf70f46633472210ee93d162e45bf0377b85842a3d27ce1de15a662059d6b8b
- MD5 150e0a9eac72f86aee0dc691f7c2b741
- SHA1 56c0dd327a67c76b300fd7d32377c7b39423d7e2
- SHA512 8def818ff2144f89a1f994cff394f50178e3237947abad832ef48e8aeff99933c85a49dd00611758f3ca5be56c345afc235452e9475d0912dc3257a02b639c60
- TLSH T1E9016B20AC7757213CA1B17D73E429F4BFB0BB079C8A10CBBA14219E045655EA3B6D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-09.sql
- Size 832B
- SHA256 471e525d211d58a48d245fd1100faf9f10908f20897f843c702b96b7415a11bc
- MD5 8f3541924ade960bcf8770edabc3fc1b
- SHA1 ea749dc1160ad9a7e743785d39f94f4ae6c0d9e8
- SHA512 159b274d2102efdfde7d9df67d90dbbda58ba0f195517aa732d9a03098ca4275ca7acde16a04cd4ba847c20058770c45fa983c76bb93a685c9b110420bc8e172
- TLSH T126016B20AC7757213CA1B17D73E429F0BFB0BB079C8A10CBBA14219E045655EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-15.sql
- Size 832B
- SHA256 63f0ae62910279f6bc396d67a71fd1caa12b2ae56eb85ccd91e528cf979b4fd7
- MD5 cca039952c54417f3a7c4cdda66efaad
- SHA1 e1d46dcc8aafa48243e86419e4fb1e232d87dbc7
- SHA512 b3c4fb7b8b51a9fc21ec0a580c3000c0500bfc6eef0358761451e51116add7d4db7a72316f3716f954ea7880585fc6b0e557144ea3359a756b8212b99ce6d9de
- TLSH T1D5016B20AC7757213CA1B17D73E439F0BFB0BB079C8A108BBA54259E045655EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-29.sql
- Size 832B
- SHA256 cf6c725ee99aadcd05274d3579bb5ac4db7b662cdba8456356c932ef72dd3198
- MD5 a154d0b1ffb224747139d843e9926797
- SHA1 910a325d51f0da231cb7edde26a219a7f8e1880d
- SHA512 a5dac36820ba2e7441c5e052bd1db831dbfd14983c61879da846c2161385b1f1e9b1e6cf22191850dae6dab01d9b5fe8606be40a0c0ab66cac66795def1c2118
- TLSH T170016B20AC7757213CA1B17D73E429F0BFB0BB079C8A108BBA14219E045655EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-35.sql
- Size 832B
- SHA256 6cc43953c59cf022528e048b7a042121240d67901e4afc0c6b431e35d675b389
- MD5 86c5235f224e4caff4778e2b4c0b86b5
- SHA1 69ab7bf7a05977172a22ebe16c90aa4e1bfdeb58
- SHA512 4b3cbcf286b9fe6836b9bfc2df28e926cda2b11f1ec0f0694b39c308865a197a04ee2dac3395b25ac1aabed6aa10966c76b6c4e204881c266397bd3e8a5ca5f2
- TLSH T11B016B20AC7757213CA1B17D73E439F0BFB0BB079C8A108BBA54259E045655EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-42.sql
- Size 832B
- SHA256 1633ba4f4200524acd8d2220f0ffe1619c154f3b9ac1eee101a3026638c12843
- MD5 db295abc1b281618088aa53a1f1e5e44
- SHA1 794c1b211134521e09ade45d980122262ce07257
- SHA512 a5162618db3c9919f52c2f74a840291b123ef38220a0237e1bf5ec64674ab8ba00a562e3be57309f010746f0764c1e64abc9a822dd8bd70d5d1c1698885aea12
- TLSH T125016B20AC7757213CA1B17D73E429F0BFB0BB079C8A108BBA14219E045655EA3B6D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-58-55.sql
- Size 832B
- SHA256 d845f040a3293bddb5e5f4ff341f74cf165f908f299abc162cad8450801adeeb
- MD5 4b4fef0196b9332ca5d6e7635be3c55f
- SHA1 2d50328593633192f399019a0560fd51a8a5b1c6
- SHA512 a45cf49f1d1733acc613ce30b7e66518a13950e552df311bf8c4bbdf2cc2263b7d9eb5527a72001ec3cf568d175ef52459794062bcee22938dcdb1199ddc5845
- TLSH T147016B20AC7757213CA1B17D73E439F0BFB0BB079C8A108BBA54259E045656EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-59-08.sql
- Size 832B
- SHA256 387fab57b87eef4eba637e0e83657e4e0565eb4b7bee2a29be59c9ce06248180
- MD5 5b56a38b1891a7b8ff47d1e10fad9b6b
- SHA1 8e8eca237adc7403c2d8486209620c4c0460dbac
- SHA512 c6a7c6f4cc4771bd74923073c8e19427d2bff784eaf8bce5aa2facf66f1a48cf5d15ecd00f2360ef13f1b04f51205f152ec20be20fc8f3318fdc3e96d2f7fe02
- TLSH T1C2016B21AC7757213CA1B17D73E42AF0BFB0BB079C8A10CBBA14619E045656EB3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-59-41.sql
- Size 832B
- SHA256 fcf31cc346a501e48e74b862eb785b13c3e9f9165f2a67816f45f1aa98a60d7b
- MD5 ed5fbaf0c15920798610f1056980225f
- SHA1 ce5ef4bdf56e34acb139b77e067066ce1b4ddc59
- SHA512 8f3a620c127208e1859f47aa518435c37a3902b799462e017d179e0b6556069b5b53ce51912a5a8dd2e23b62b1587523eb8264e92cad4775b74444befb6fc558
- TLSH T1BD01AB20AC7767213CA1B17C73E42AF0BFB0BB079C8A00CBBA04219E045655EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-59-47.sql
- Size 832B
- SHA256 10d3f54d4bcdccd9e6de227d2ebf0a66883a4657119b97110cf58114d5397bec
- MD5 ae4f929aed2e97991efcef07001848b0
- SHA1 4bd20314da3b5674561f3ace2f6fea12eef1969a
- SHA512 3c73805cc329ea1824c81d81094ef0ff9c91ae41965128f67c0d1080b98001551d353762242f4049937afc71466e8a718c09b5273843f03db4bb208366741ad9
- TLSH T18B016B20AC7767213CA1B17D73E42AF0BFB0BB079C9A10CBBA14619E045655EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\UsnJrnl_2026-08-14_23-59-54.sql
- Size 832B
- SHA256 a2dd71df74927e25951a1d358b417e2080f702bb19dac3c30cb203299126a765
- MD5 e2463a686157973cb6c277e5ff575f56
- SHA1 7ceb4d5233cd703df1c4bfe922a053f1f9795a4e
- SHA512 a711967aa1e575a1a4f3f61e296c0c2d1bf1d75a62a14c8cc5db5365edff6a8f9476c17c762dba6246168c37d4cbdcb0615f0d5c0c7856f89a3736d107bb3835
- TLSH T175016F20AC7757213C91B17D73E425F0BFB0BB079C4A1087B914219E045755EA3B5D2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\aut4917.tmp
- Size 454B
- SHA256 5b41335f722e8dca374a866d553858fefbc07b97a2c6f2dee2ada3a74df0f453
- MD5 057ea43300e175e75b89bdba464522c5
- SHA1 7e47abeda80c8e12b678d59b6b4b3a8812e5d6b2
- SHA512 feeb1f94c2f772b92a91b3fef2d9d399da99bf50dc11fd3acc451e23a039f448de4b208a58cc13057d28d95d29cbc09d81be87570d653286350e01338b9497ff
- TLSH T1E0F0DC03A8BF56F4EC6EB01635029F4F6C6022F282042494AC65E68A061722EE8139AA
- MD5 SHA1 SHA512 TLSH