36447cefab0e6771ab580e69336ddb5a166622cc5b045a89a59f1adf180c147d

Analysis

user interaction
yes
max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bayonetta [CentralDeTraducoes.net.br].exe
Size 133.8MB
Sample260815-wp1lnser5x
SHA256 36447cefab0e6771ab580e69336ddb5a166622cc5b045a89a59f1adf180c147d
MD5 49d82196db151494a15bab960abb5e4c
SHA1 c1143abe951807a139974247332a254ece13a402
SHA512 39a515a44b3ebf2e1fe7e4148665f1ad272b285de3f477e5f646e166a3e23ec798413a3d620ea94ac25e8a11b66ff03ce362d8fb0820421a1b16f5e7b4796046
SSDEEP 3145728:1h+kgKKd9jX1gVkXaRiJaC52ASQ/fkcOansqHn0T3xg3T:DgKKd9nWcAzHcOSzH07Wj
TLSH
T19768332DC829F9C9C2292B702A9FF5B93C7700430592962F692FBDB77EA0446305D5F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000244fb-35.dat	acprotect
behavioral1/memory/3796-36-0x0000000074280000-0x0000000074289000-memory.dmp	acprotect
behavioral1/memory/3796-50-0x0000000074280000-0x0000000074289000-memory.dmp	acprotect
behavioral1/memory/3796-122-0x0000000074280000-0x0000000074289000-memory.dmp	acprotect

Loads dropped DLL 10 IoCs

pid	Process
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3796-0-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/files/0x00070000000244fb-35.dat	upx
behavioral1/memory/3796-36-0x0000000074280000-0x0000000074289000-memory.dmp	upx
behavioral1/memory/3796-39-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3796-48-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3796-50-0x0000000074280000-0x0000000074289000-memory.dmp	upx
behavioral1/memory/3796-121-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/3796-122-0x0000000074280000-0x0000000074289000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	3796	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bayonetta [CentralDeTraducoes.net.br].exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Bayonetta [CentralDeTraducoes.net.br].exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Bayonetta [CentralDeTraducoes.net.br].exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\IESettingSync	Bayonetta [CentralDeTraducoes.net.br].exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Bayonetta [CentralDeTraducoes.net.br].exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3796	Bayonetta [CentralDeTraducoes.net.br].exe
3796	Bayonetta [CentralDeTraducoes.net.br].exe

C:\Users\Admin\AppData\Local\Temp\Bayonetta [CentralDeTraducoes.net.br].exe
"C:\Users\Admin\AppData\Local\Temp\Bayonetta [CentralDeTraducoes.net.br].exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 2140
  2⤵
  - Program crash
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3796 -ip 3796
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aero.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\Aero.dll
Size 6KB
SHA256 ab864a3c247e9016414a4a8b26155942b7c3814cc99be6a59b86c456bd22c061
MD5 5c7408c25f1076eb96908e5bba521bb5
SHA1 46df8dfd93593360b9b6d2e4ab1892843246228d
SHA512 9eebf8378a0eab0ab66e70f20aea185392ce0de36e63a37c07ccd93a5d1d8fe95a2ed8c428c63d6aa8c0a5b424e53e412fdeb0e5be2ee57f9eceafa19e03062c
SSDEEP 96:+k+RX2Fg54iQrKWX09fODXCPbnV767ZJG:8X2FA4iyXNm7Ve7ZJ
TLSH
T1CDC1E806B7F95128E8F602379A754B06313EFC50CEBD4B9E194C2116A9B0058DA25F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Delay.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\Delay.dll
Size 7KB
SHA256 b6691bf37f13e37bfc07d45990092fd9398f7eff8cb1bbad05e528def0307c4a
MD5 4602d9a9ed82d646522ead08a58536a9
SHA1 b070bad90e13e85c97bd4e530ca7958c22e36a5a
SHA512 5ebad4e83d411799a25b1e462ac3c7683dd0c973f131eed29131af7a240f92f55e6c60b78f96388bf7c4134941353794d79ef6c91476e8def7e5c803544afec9
SSDEEP 96:fkcYhKlqWFeJ9DekCN3jPpP4DyGE3qLNf:cXKMJRC5BfGE3qLN
TLSH
T15EE1D63777C242E1E44F17B2279A23B35E347A10534485BBC6ABD8921E9322BCC76B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCtrl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\WebCtrl.dll
Size 5KB
SHA256 f7e1e03c140cc86bb7b259f1882b4b461128d70213e7f030360a9c76d6c51884
MD5 f134448c6531c16271d776cdc930cff8
SHA1 6fa6ae69ee46486b33b41f08719319aca5d0382f
SHA512 c83db0d30e51d5dba4fe4abab562fde9358f9970b32aef729f326f394e744698b936b134e8718afd9a2ac970daf287278b2685b77566c50f733f58897fd0c16d
SSDEEP 96:EPR9lrwXckwd7NLLd8e1+A39Lji7juoxiApV3ii:EPR99tZd8e133xjkuri
TLSH
T1FCC15273ABE189F0DA01A43E009625B7EAB5D81B47C180271E6BDD6B3D438ABF665341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newadvsplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\newadvsplash.dll
Size 8KB
SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
MD5 7ee14dff57fb6e6c644b318d16768f4c
SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
TLSH
T1A002E839618096F3D26F15F45882AB1D4BFAE074239290324F73A1EA6DC0297FDB6347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scroll.html

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\scroll.html
Size 39KB
SHA256 4551598e592c11eeac6d77170028c5f42df3f58b2df443540e2864adb27ccec2
MD5 968c104d97546aa9315fccd02f22a4d2
SHA1 84274ad9bb02624e9f8eb49508fe4db05fb976d3
SHA512 aa91b1348941f7e16e4c74339fd95490a4427c4f44edf407786e93aaa91d66ca0a49c2a86ce87c459c4c409fbde22763fdd39dc7f2fa29b64a7a61224ce0df60
SSDEEP 192:I78T5eH8IniRcLGPUvm1ETK5o50NSZE+D4r43YnRY5zgkkS+UGYNs9o/QzHL6SvH:I78TvXojY5LAVF8N
TLSH
T13403F944F8905E577372A2DA7F20E8F05F6B9278C8090657F0E4F65A3883C69E76352B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tg_logo.gif

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tg_logo.gif
Size 25KB
SHA256 99616d738d6718fde19b8408310cf29383a12f315a8a86b521bb93ec5721fc92
MD5 c7d46a49e9967694f856b566cfcf5e1f
SHA1 80c17695f4d003070d35b99bd86adf0dabb4fc99
SHA512 26881525d78eb2f002c643508cddb7eb9429906d50cad3b2a93c459095fe41a0f52ad9b8f0b67d0e7427507e2a15b00f47926989847f00a038b679d6aba1d513
SSDEEP 384:bNNE3pK/+bmHtlcmmjDAzLLNsROum3xpKWWSgLs49yN1xSidK3mi1n:bg3rk3mPyNYax0WWT9ybxS8K33d
TLSH
T10EC2E1AA95AB0544D20A4A7347B1C122BC3CE02D063E46767FB771D76BD127DB1C5AD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cred.html

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tr_data\cred.html
Size 51KB
SHA256 8f0fe53c0fa21cbceb46ad1226da9da1631362fc19ba6dfb3cd46d97cf85f393
MD5 6dfc6d8143b79dafc6e4ee7866bb74e2
SHA1 719719b1af2e51079802a8f1d1d496ebb168cfe2
SHA512 1e8291a934a10b5d7674e41d8465c8fd9251849937d852ffb9dc3a87a7c102418edb2087548c12928eaafd492a7b5d1e2c480c4866666859ff9f727cd4822cd2
SSDEEP 1536:3ql57mtSwwNMXRdBH3LS7UvjdBSZLS76SAdBSSuI:3w7K7M
TLSH
T10B339E44F4505E4773B2A2DA7F70A8F02F6B9278C8090697F0E5F2593883D69E76316B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

legal.html

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tr_data\legal.html
Size 43KB
SHA256 81ef9aab1bac38764893718df361c4600aa7eb893e60d8d66ac855200d02ced3
MD5 b3626e3a94cb2d8c3fc3a253e1846173
SHA1 db38a16e524e1a957825f3b273729536ca3b6b40
SHA512 af3aa8f93cc2677c355c2cec51aa0292e7611db7614991f8cc98d61174e06cc489bb91913d8e1eddf1780ea00ca3f9868f585e40fae6b502cdfcd19fc367c929
SSDEEP 192:i78T5eH8IniRcLGPUvm1ETK5o50NSZE+D4r43YnRY5zgkkS+UGYNs9o/QzHL6Svv:i78TvX7jY5O5FnAjBRcVS5zW
TLSH
T10B131A44F8945E477372A2DA7F20E8F01B6B9278C8090697F0E5F65D3883C69E76316B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scroll.dflt.js

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tr_files\scroll.dflt.js
Size 171B
SHA256 fb295cf92b819f9e7d95b62495aeb15e12cd3291add18093c946184127411984
MD5 46903025390c7274e546ddcf50526cfa
SHA1 c8cf17d978275fbeb42e040bb0538d212ce28654
SHA512 94230f5826b8ce67e0b914687224387fe31187c59ecb20e6f1ad8189e6d3bea76de3c7f505b0c2373b2b5c37257e89a3db6d9c544b5b19cfd2c67995968f3ba2
TLSH
T10AC08CCB736D666944CAFAC09AF0CEB16908F93CC6C114AB39F0650875E049FAC76540
MD5 SHA1 SHA512 TLSH

Submit Download

scroll.html

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tr_files\scroll.html
Size 4KB
SHA256 1d55105e632396f76b046513f1805f8144b8d2dc2a0d75dd78b37cb771be705c
MD5 fa5e9eb978e1acd9cb8e6cbe2ba76510
SHA1 a08920b5c81bd559a859757f6555863b1b0b804d
SHA512 8a156d805f20029ce06e9a78922f21410c0a2b99ec6b9f7d8c26bbc69efefa221c8c9c3c7264a544405eaccac54c259ddeb77384b9ac826720d60ee5a3ef1757
SSDEEP 96:QD9KskjS+e0nOJOJ3nctYcoUV1FzTOKKInCBsHSM4imf2fy:89LkjS90nmm3U3PFPOCnHmf2fy
TLSH
T164A196311F81557A9109F32CBE3AC14CF4749329D883B806A87C98E05BD1EB95ABED7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scroll.js

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tr_files\scroll.js
Size 641B
SHA256 83c74fe20d8cd134c900bc18231311a307fe9d40508bb0a4a3c008333f4755bb
MD5 451adb9f6bed8859cee8ffe17a356dc6
SHA1 7606b460525934d666b19c6159167016bfa4ecfa
SHA512 db4fde5819bef93f4c7709aaeee6ae79c87ae6d8283f408fd420847495ef618da5313b71e2da4afd6e3239b9d6e184856a8694ef201b3cc2d9de08074a6cfb2f
TLSH
T136F0DD46BA7C1606058E53B2F56C8515309EC3A7F622E6144E4A6E2419807FC4FE7F3A
MD5 SHA1 SHA512 TLSH

Submit Download

scroll.tpl0.js

Path C:\Users\Admin\AppData\Local\Temp\nsi7220.tmp\tr_files\scroll.tpl0.js
Size 1KB
SHA256 d61df469c5484d3c20ad027e741321dd1921285142cc8acf73cf363d7798e310
MD5 39133e190f144254ac4a3ba40d8863a6
SHA1 adb69965c2f4b76b10d029761e5eaa60dee10a5f
SHA512 1c877ed7c7d76d858f79e1058181b4e77ccede55f782118f1c189dfd9d1a45e6c610154270f026c7c83fbbcd79e3fd96d3d12a3890508e9e420475a38157f36d
TLSH
T17211AF77338090742748A5A55979E550FB04C0BFC62A353AB9188C7C6481F6A94FBB26
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3796-50-0x0000000074280000-0x0000000074289000-memory.dmp

Download

memory/3796-48-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3796-0-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3796-39-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3796-36-0x0000000074280000-0x0000000074289000-memory.dmp

Download

memory/3796-1-0x0000000000444000-0x0000000000445000-memory.dmp

Download

memory/3796-121-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/3796-122-0x0000000074280000-0x0000000074289000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads