A Kimsuky-attributed malware analysis describes a JavaScript or JSE-style sample named Min Hyeji2.jre and provides MD5, SHA-1, and SHA-256 hashes. The reported execution chain uses WScript, hidden PowerShell, and certutil decoding to stage files under ProgramData before running additional commands. The behavior is relevant to defenders tracking North Korea-linked malware because it combines script execution, living-off-the-land tooling, obfuscation, and staged payload deployment that can be hunted through process telemetry and file artifacts.