Overview

overview

7

Static

static

3

incy-windo...up.exe

windows10-2004-x64

7

incy-windo...up.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    281s
  • max time network
    334s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 16:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    incy-windows-setup.exe
  • Size 121.7MB
  • Sample260627-vcaztact9p
  • SHA256 056361d0648dcecabf343b1e0364c68afee242658da4c39a1356da982eba0ac4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutioninstaller

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 29 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 13 IoCs
  • Modifies registry key 1 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\is-V8EPF8FCQ1.tmp\incy-windows-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-V8EPF8FCQ1.tmp\incy-windows-setup.tmp" /SL5="$50226,126372602,893440,C:\Users\Admin\AppData\Local\Temp\incy-windows-setup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill" /F /IM incy.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill" /F /IM hev-socks5-tunnel.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3200
      • C:\Windows\SYSTEM32\taskkill.exe
        "taskkill" /F /IM xray.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3652
      • C:\Program Files\INCY\incy.exe
        "C:\Program Files\INCY\incy.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Program Files\INCY\incy.exe
          "C:\Program Files\INCY\incy.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4932
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKCU\Software\Classes\incy /ve /d "URL:incy Protocol" /f
            5⤵
            • Modifies registry class
            • Modifies registry key
            PID:2656
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKCU\Software\Classes\incy /v "URL Protocol" /d "" /f
            5⤵
            • Modifies registry class
            • Modifies registry key
            PID:5928
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKCU\Software\Classes\incy\shell\open\command /ve /d "C:\Program Files\INCY\incy.exe" "%1" /f
            5⤵
            • Modifies registry key
            PID:5400
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c "for %I in ("C:\Users\Admin\AppData\Local\incy\incy.db") do @echo %~sI"
            5⤵
              PID:5000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:568
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Local\incy\incy.db /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:F
              5⤵
              • Modifies file permissions
              PID:5184
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\.secrets /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:(OI)(CI)F
              5⤵
              • Modifies file permissions
              PID:5620
            • C:\Windows\SYSTEM32\reg.exe
              reg query HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid
              5⤵
              • Modifies registry key
              PID:5260
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\.secrets /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:(OI)(CI)F
              5⤵
              • Modifies file permissions
              PID:1960
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\preferences.json /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:F
              5⤵
              • Modifies file permissions
              PID:5424
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\preferences.json /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:F
              5⤵
              • Modifies file permissions
              PID:2288
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\preferences.json /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:F
              5⤵
              • Modifies file permissions
              PID:1416
            • C:\Windows\SYSTEM32\reg.exe
              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
              5⤵
              • Modifies registry key
              PID:3252
            • C:\Windows\SYSTEM32\reg.exe
              reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
              5⤵
              • Modifies registry key
              PID:2156
            • C:\Windows\SYSTEM32\reg.exe
              reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
              5⤵
              • Modifies registry key
              PID:2912
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3524
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1808
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4408
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\preferences.json /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:F
              5⤵
              • Modifies file permissions
              PID:3612
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3564
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player Legacy.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4140
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4060
            • C:\Windows\SYSTEM32\icacls.exe
              icacls C:\Users\Admin\AppData\Roaming\incy\preferences.json /inheritance:r /grant:r *S-1-5-21-28459746-3881314244-166055492-1000:F
              5⤵
              • Modifies file permissions
              PID:2340
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:484
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5536
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3396
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1288
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2836
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2172
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5732
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5164
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5752
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4992
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5940
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:436
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1756
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3984
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5808
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk').TargetPath"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2804
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4604
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:996
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Defender Firewall with Advanced Security.lnk').TargetPath"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2364
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Calculator.lnk').TargetPath"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5928
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2152
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4380
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk').TargetPath"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4492
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:792
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\INCY\INCY.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:1724
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:3428
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk').TargetPath"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:6084
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:2484
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:3200
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:4900
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Office Language Preferences.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:5932
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Office Upload Center.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of AdjustPrivilegeToken
              PID:1608
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2676
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Dashboard for Office.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2996
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Log for Office.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5656
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2592
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1212
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4008
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2544
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5400
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snipping Tool.lnk').TargetPath"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4288
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk').TargetPath"
              5⤵
                PID:5416
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk').TargetPath"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1488
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk').TargetPath"
                5⤵
                  PID:2852
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk').TargetPath"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3744
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk').TargetPath"
                  5⤵
                    PID:5508
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2944
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3152
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4860
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3980
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1184
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\LiveCaptions.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5072
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5684
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4208
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3192
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\VoiceAccess.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4264
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5084
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk').TargetPath"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4000
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk').TargetPath"
                    5⤵
                      PID:5924
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk').TargetPath"
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1768
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk').TargetPath"
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4084
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk').TargetPath"
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5696
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk').TargetPath"
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:692
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk').TargetPath"
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4188
            • C:\Program Files\INCY\incy.exe
              "C:\Program Files\INCY\incy.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5900
              • C:\Program Files\INCY\incy.exe
                "C:\Program Files\INCY\incy.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:2968
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:4548
              • C:\Windows\System32\oobe\UserOOBEBroker.exe
                C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                1⤵
                  PID:4780
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                  1⤵
                    PID:4556

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        animation-core-desktop-1.10.3-a94bab3d67a320ccdc2cc2c2c973bc4.jar
                        • Path C:\Program Files\INCY\app\animation-core-desktop-1.10.3-a94bab3d67a320ccdc2cc2c2c973bc4.jar
                        • Size 313KB
                        • SHA256 44acb4341711dd8547f0bd629d50617096b966f73d5115a5183d6a4a2753665e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        animation-desktop-1.10.3-d75724d6eb8bef26a6affbebcbada5.jar
                        • Path C:\Program Files\INCY\app\animation-desktop-1.10.3-d75724d6eb8bef26a6affbebcbada5.jar
                        • Size 294KB
                        • SHA256 cde51f389600b8804dabdae0354a7a1179b76e2bde65031a1e0f59e2a56e6326
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
                        • Path C:\Program Files\INCY\app\annotation-jvm-1.9.1-1d6a04b3b9847638d0529df8ef76a.jar
                        • Size 4KB
                        • SHA256 506370e0951266a3f167519a6190b3a4f8bd2d9fac8bb0626a9a30173d975f20
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
                        • Path C:\Program Files\INCY\app\annotations-23.0.0-8484cd17d040d837983323f760b2c660.jar
                        • Size 186B
                        • SHA256 ec78af5c658b5fbcfc5bc001e49c87e4bd71535aa367be8a1eaf192abbf2c16a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        atomicfu-jvm-0.23.2-5e4f88ed1c37222d791f5dcadf481498.jar
                        • Path C:\Program Files\INCY\app\atomicfu-jvm-0.23.2-5e4f88ed1c37222d791f5dcadf481498.jar
                        • Size 726B
                        • SHA256 019b4b163765e9351f2dc8dabc32d33d7d1695c79feabec0fc22c342deb0d5d3
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar
                        • Path C:\Program Files\INCY\app\collection-jvm-1.5.0-4421442c114a4f8c8fe587cf2d668237.jar
                        • Size 612KB
                        • SHA256 d5b7a06323596077b1af58dab268d561b0db8d37f0a5ec2b48593b7806662f72
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        core-3.5.4-23cc13611f7f222b9988220fa28a115.jar
                        • Path C:\Program Files\INCY\app\core-3.5.4-23cc13611f7f222b9988220fa28a115.jar
                        • Size 258KB
                        • SHA256 004312033e586a0abe5b98a182f725436285c8ed177ebe6ec8d20d6c289954fb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar
                        • Path C:\Program Files\INCY\app\core-common-2.2.0-2212d240dfe1e8a7598ee117ccc316d.jar
                        • Size 6KB
                        • SHA256 f95f9b04c0f93ee73e4bb608a0d8197b5f87f3d1fde5f9e41cbc802b35da9256
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        desktop-jvm-1.10.3-98023295d6f48188e5b98b192b9a30.jar
                        • Path C:\Program Files\INCY\app\desktop-jvm-1.10.3-98023295d6f48188e5b98b192b9a30.jar
                        • Size 3KB
                        • SHA256 858732a8a07308476deade40291a136beeb6305ff90c84fb5e9cf3ab33a712c2
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        foundation-desktop-1.10.3-70d7b34e8681a374ed1ed640c3ba8c11.jar
                        • Path C:\Program Files\INCY\app\foundation-desktop-1.10.3-70d7b34e8681a374ed1ed640c3ba8c11.jar
                        • Size 3.4MB
                        • SHA256 c96b44c162ad77ad7a773f8dd15fb0dd5de136bc695062d78eeaac60cd70c9ca
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        foundation-layout-desktop-1.10.3-8510263615bf71e2ede4f9451f89f7dd.jar
                        • Path C:\Program Files\INCY\app\foundation-layout-desktop-1.10.3-8510263615bf71e2ede4f9451f89f7dd.jar
                        • Size 449KB
                        • SHA256 5491d7104318d17206fa6a5218351d03b3899edea417c36c2fa9706d5bee05bc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        incy-desktop-3.2.6.jar
                        • Path C:\Program Files\INCY\app\incy-desktop-3.2.6.jar
                        • Size 20.4MB
                        • SHA256 c324922437187fc726db626e5c9455bfe90dcc79badaae142f607666a701b6f2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        incy.cfg
                        • Path C:\Program Files\INCY\app\incy.cfg
                        • Size 6KB
                        • SHA256 e8e18b20e13e61bc76137d62dd5082e4c5bd2a9b99aeabeb9ced123e318988a2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jai-imageio-core-1.4.0-6978d733bfb55ca82639f724fe5f3bb.jar
                        • Path C:\Program Files\INCY\app\jai-imageio-core-1.4.0-6978d733bfb55ca82639f724fe5f3bb.jar
                        • Size 518KB
                        • SHA256 a44ba51d15ce591ad4d7401db589fd4ed38b537fadf9143a59d7a9c786061a9f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        javase-3.5.4-55e7296ac9a75d4e974e536e1d2e65f.jar
                        • Path C:\Program Files\INCY\app\javase-3.5.4-55e7296ac9a75d4e974e536e1d2e65f.jar
                        • Size 3KB
                        • SHA256 193888a7af5e05a49e2e37870ff1179413855c29a1186ba433db910ddd00f717
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        jbr-api-1.5.0-377e771977886f74954db4278394c51.jar
                        • Path C:\Program Files\INCY\app\jbr-api-1.5.0-377e771977886f74954db4278394c51.jar
                        • Size 6KB
                        • SHA256 66d5cb67a06fe43cdab2e62022d17ae009840382e4e14ce295a337b614bf1e0f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jcommander-1.85-8e65d693e8a8bfbf6488898a4b6473d.jar
                        • Path C:\Program Files\INCY\app\jcommander-1.85-8e65d693e8a8bfbf6488898a4b6473d.jar
                        • Size 556B
                        • SHA256 49e730ec84ba2975feb367e9993655333380bcbaea4c04cb8009b4a99ab9ca0d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        jdbc-driver-2.0.2-1410add33fb6f6a4946f9a8f4f69fa8.jar
                        • Path C:\Program Files\INCY\app\jdbc-driver-2.0.2-1410add33fb6f6a4946f9a8f4f69fa8.jar
                        • Size 20KB
                        • SHA256 38e008f7f521db671dc44398701584f8a7ecceb2617f0f7dba703b801ea13b91
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jna-5.17.0-8fc1e1f239ec4511e8d9e5a433f6244.jar
                        • Path C:\Program Files\INCY\app\jna-5.17.0-8fc1e1f239ec4511e8d9e5a433f6244.jar
                        • Size 1.9MB
                        • SHA256 f94e88f3a5ded8e70a2fa05ac9718a073e46a1e6b200dd22cfe85d61648f1c7d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        json-20251224-fec4b08b6ae3b07aa34ff719ee7a5cc3.jar
                        • Path C:\Program Files\INCY\app\json-20251224-fec4b08b6ae3b07aa34ff719ee7a5cc3.jar
                        • Size 70KB
                        • SHA256 bee091e59a1ef99741ccddb88bcd7555c7d219ccbeaeb15250f39e97faf64a9d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jspecify-1.0.0-9133aba420d0ca3b01dbb6ae9992cf6.jar
                        • Path C:\Program Files\INCY\app\jspecify-1.0.0-9133aba420d0ca3b01dbb6ae9992cf6.jar
                        • Size 502B
                        • SHA256 e7221b163b77fbd516371be2b0bea4d488252349dcca3ea92ec20f5ebecd89bb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        koin-core-jvm-4.2.0-d16eea42d1f7fc3357be624550f3d51e.jar
                        • Path C:\Program Files\INCY\app\koin-core-jvm-4.2.0-d16eea42d1f7fc3357be624550f3d51e.jar
                        • Size 328KB
                        • SHA256 57ea48453cad213d31a59f9e6aacc8b5278e992d4c333494e33f56ff4daa2ea3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kotlin-stdlib-2.3.20-17212d4ae1611e51ce4c3c4ba28717fa.jar
                        • Path C:\Program Files\INCY\app\kotlin-stdlib-2.3.20-17212d4ae1611e51ce4c3c4ba28717fa.jar
                        • Size 1.4MB
                        • SHA256 409eab420dcaaa37e914436de38d639e1cb4d96bc19a27fd7e01fccd3eff8169
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kotlin-stdlib-jdk7-2.2.20-b62df9d3ec629ebc7658228fe49529.jar
                        • Path C:\Program Files\INCY\app\kotlin-stdlib-jdk7-2.2.20-b62df9d3ec629ebc7658228fe49529.jar
                        • Size 280B
                        • SHA256 a9c516b824992fb2df160fb581c6d0b6c56577d73b818538f7e85a0fed88abf4
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        kotlin-stdlib-jdk8-2.2.20-c2573686563f7aaca6f7ce98ec9a8b6.jar
                        • Path C:\Program Files\INCY\app\kotlin-stdlib-jdk8-2.2.20-c2573686563f7aaca6f7ce98ec9a8b6.jar
                        • Size 280B
                        • SHA256 0fe9d7992e2eb3ec7171774622d31523df9f145eac7e44b46056064f9038f8a0
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        kotlinx-coroutines-core-jvm-1.10.2-16bb58d0777fca3b2efde66862478c.jar
                        • Path C:\Program Files\INCY\app\kotlinx-coroutines-core-jvm-1.10.2-16bb58d0777fca3b2efde66862478c.jar
                        • Size 1.2MB
                        • SHA256 89e6918498ec7ed5e17d1f937c2691e2a54049eb793463339f6905c0ddf6f46a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kotlinx-coroutines-swing-1.10.2-b9cd9ab0c3f429acd698981c43dd6a2f.jar
                        • Path C:\Program Files\INCY\app\kotlinx-coroutines-swing-1.10.2-b9cd9ab0c3f429acd698981c43dd6a2f.jar
                        • Size 6KB
                        • SHA256 07350b4af7c8bec9b564e6b27202b572c70c2843a916e1722bcbcc1a11818f5c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kotlinx-datetime-jvm-0.7.1-70b44e22ebc7eebfa53f7d1941af072.jar
                        • Path C:\Program Files\INCY\app\kotlinx-datetime-jvm-0.7.1-70b44e22ebc7eebfa53f7d1941af072.jar
                        • Size 589KB
                        • SHA256 cf82b4a7df1de1a1f07e5daa0ce95be1678b55bac8c1c3501f600269ab02b26e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kotlinx-serialization-core-jvm-1.9.0-b84dd8f79d9415c243324bd22d7c3cc5.jar
                        • Path C:\Program Files\INCY\app\kotlinx-serialization-core-jvm-1.9.0-b84dd8f79d9415c243324bd22d7c3cc5.jar
                        • Size 332KB
                        • SHA256 e67dd7c7b5db81af9881d0e8d1faf872c4280799b9ec1cb7951fd8f0229120ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        kotlinx-serialization-json-jvm-1.9.0-1e81a9f08daa85e116eb8551d2f3bc0.jar
                        • Path C:\Program Files\INCY\app\kotlinx-serialization-json-jvm-1.9.0-1e81a9f08daa85e116eb8551d2f3bc0.jar
                        • Size 230KB
                        • SHA256 b89e6af027e4d6a515326f314b773629eb63552124748ac7ac9e087b902c2014
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lifecycle-common-jvm-2.9.4-6430746dbcfa6c26a0d997b9c76f84c.jar
                        • Path C:\Program Files\INCY\app\lifecycle-common-jvm-2.9.4-6430746dbcfa6c26a0d997b9c76f84c.jar
                        • Size 51KB
                        • SHA256 23870d80a3af3eda265c8bbc11f57678c3023dbd99bc96774dfca8bac2df3a8a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lifecycle-runtime-compose-desktop-2.9.4-8f8fe81afd5ce7cf3e8a38142f8aa2.jar
                        • Path C:\Program Files\INCY\app\lifecycle-runtime-compose-desktop-2.9.4-8f8fe81afd5ce7cf3e8a38142f8aa2.jar
                        • Size 34KB
                        • SHA256 249b85fdf3a69186b391fa7362db744c1335299c4d8e30349ab75a12bba2f1c6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lifecycle-runtime-compose-desktop-2.9.6-497e8fcabac8a5f5ee68cb2a1c8e70a4.jar
                        • Path C:\Program Files\INCY\app\lifecycle-runtime-compose-desktop-2.9.6-497e8fcabac8a5f5ee68cb2a1c8e70a4.jar
                        • Size 356B
                        • SHA256 f4eee45e5c6b4b67f1939da4a3b22aa6f8e7d637b70c8ed82e084dad65478a25
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        lifecycle-runtime-desktop-2.9.4-c2c1ed6e1ecd2d037e07bfe64884c5.jar
                        • Path C:\Program Files\INCY\app\lifecycle-runtime-desktop-2.9.4-c2c1ed6e1ecd2d037e07bfe64884c5.jar
                        • Size 39KB
                        • SHA256 2570cd45bb48a546b2b85d83020a42248ab8e4f62442371563c08de4d355079e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lifecycle-viewmodel-desktop-2.9.4-df36d8fe3a9c84b3bd8529b166e73d0.jar
                        • Path C:\Program Files\INCY\app\lifecycle-viewmodel-desktop-2.9.4-df36d8fe3a9c84b3bd8529b166e73d0.jar
                        • Size 47KB
                        • SHA256 83f0c8bbb76b5e7828b088fe4061f80df9b2c3f036b9d8eff6abfd3d4385ccf0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        lifecycle-viewmodel-savedstate-desktop-2.9.4-cf8139ef2d41e155eece234f1b2a358.jar
                        • Path C:\Program Files\INCY\app\lifecycle-viewmodel-savedstate-desktop-2.9.4-cf8139ef2d41e155eece234f1b2a358.jar
                        • Size 29KB
                        • SHA256 fd65b08497bf1c5f5789c3b68e0101305510c90921a4c34eaed43065d337d3cc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        incy.exe
                        • Path C:\Program Files\INCY\incy.exe
                        • Size 466KB
                        • SHA256 925738b897385c0c409fc17bf6c0aee1af61168207146b7dd29cd0eb57874460
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VCRUNTIME140.dll
                        • Path C:\Program Files\INCY\runtime\bin\VCRUNTIME140.dll
                        • Size 117KB
                        • SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        java.dll
                        • Path C:\Program Files\INCY\runtime\bin\java.dll
                        • Size 118KB
                        • SHA256 49d809d1ad05fa0ec58db48cf56a1b9ff10985c4cba03f6761d75a03b962b993
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jimage.dll
                        • Path C:\Program Files\INCY\runtime\bin\jimage.dll
                        • Size 32KB
                        • SHA256 c9ceaf3c1cee4d57c1781a38b2dba04ef9ee4f863cd10d0e0493857662d825a6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jli.dll
                        • Path C:\Program Files\INCY\runtime\bin\jli.dll
                        • Size 87KB
                        • SHA256 27faceb1a40aa2c5d7f4d16087cf99620a5765f4b72016423cbd1dd488219451
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        msvcp140.dll
                        • Path C:\Program Files\INCY\runtime\bin\msvcp140.dll
                        • Size 561KB
                        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        net.dll
                        • Path C:\Program Files\INCY\runtime\bin\net.dll
                        • Size 58KB
                        • SHA256 5c8e0608d52b3c55c79056f5e0467d2d4b2482de3b99d02ebf1c33682373a330
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        nio.dll
                        • Path C:\Program Files\INCY\runtime\bin\nio.dll
                        • Size 78KB
                        • SHA256 4b6e5721ecee05c06edfe62f855cf9d4644b897cb4b2e86c512471468fea9e92
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jvm.dll
                        • Path C:\Program Files\INCY\runtime\bin\server\jvm.dll
                        • Size 13.2MB
                        • SHA256 d6a6eb00ed6c9fa618d45513e846c476605c1c00c226692461b26ac1f387a6df
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcruntime140_1.dll
                        • Path C:\Program Files\INCY\runtime\bin\vcruntime140_1.dll
                        • Size 48KB
                        • SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        zip.dll
                        • Path C:\Program Files\INCY\runtime\bin\zip.dll
                        • Size 87KB
                        • SHA256 963d8c2b4bcc1a4ed565dd0d708e23d0b5dcac7355f97881233f048a560993be
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        is-2XSROSE5DB.tmp
                        • Path C:\Program Files\INCY\runtime\legal\java.logging\is-2XSROSE5DB.tmp
                        • Size 49B
                        • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                        • MD5 SHA1 SHA512
                        Submit Download

                        is-DTA7E2YW8S.tmp
                        • Path C:\Program Files\INCY\runtime\legal\java.logging\is-DTA7E2YW8S.tmp
                        • Size 44B
                        • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                        • MD5 SHA1 SHA512
                        Submit Download

                        is-LPPEO629O5.tmp
                        • Path C:\Program Files\INCY\runtime\legal\java.logging\is-LPPEO629O5.tmp
                        • Size 33B
                        • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                        • MD5 SHA1 SHA512
                        Submit Download

                        jvm.cfg
                        • Path C:\Program Files\INCY\runtime\lib\jvm.cfg
                        • Size 29B
                        • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                        • MD5 SHA1 SHA512
                        Submit Download

                        tzdb.dat
                        • Path C:\Program Files\INCY\runtime\lib\tzdb.dat
                        • Size 100KB
                        • SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        tzmappings
                        • Path C:\Program Files\INCY\runtime\lib\tzmappings
                        • Size 21KB
                        • SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 452eb598b2884fd99242cb5db005e3ac8e31bc9e3d58fe88ad0dd79ba08fbfd1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 61fa021e6fb9bf6e62c66160ca7f4e57206d1371e9779346630293e15afec314
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_hldca2v3.ywz.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hldca2v3.ywz.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        incy-windows-setup.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\is-V8EPF8FCQ1.tmp\incy-windows-setup.tmp
                        • Size 4.2MB
                        • SHA256 b2c151c043b34a162afeea64563c36f22012bebe3e54d5e5917af22526b9fc72
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        jna11098162629471720988.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna11098162629471720988.dll
                        • Size 267KB
                        • SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        incy.db
                        • Path C:\Users\Admin\AppData\Local\incy\incy.db
                        • Size 32KB
                        • SHA256 9f0c7c82009ee55cba652416da614145122ef7189bd5f4fb50c509855ec28151
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/568-657-0x00000189C9440000-0x00000189C9462000-memory.dmp
                        Download

                        memory/2284-8-0x0000000000A00000-0x0000000000AE9000-memory.dmp
                        Download

                        memory/2284-0-0x0000000000A00000-0x0000000000AE9000-memory.dmp
                        Download

                        memory/2284-560-0x0000000000A00000-0x0000000000AE9000-memory.dmp
                        Download

                        memory/4280-552-0x0000000000930000-0x0000000000D73000-memory.dmp
                        Download

                        memory/4280-99-0x0000000000930000-0x0000000000D73000-memory.dmp
                        Download

                        memory/4280-6-0x0000000002C20000-0x0000000002C21000-memory.dmp
                        Download

                        memory/4280-9-0x0000000000930000-0x0000000000D73000-memory.dmp
                        Download

                        memory/4280-12-0x0000000000930000-0x0000000000D73000-memory.dmp
                        Download

                        memory/4280-559-0x0000000000930000-0x0000000000D73000-memory.dmp
                        Download

                        memory/4280-10-0x0000000002C20000-0x0000000002C21000-memory.dmp
                        Download

                        memory/4932-753-0x00007FFA44BA0000-0x00007FFA44C95000-memory.dmp
                        Download

                        memory/4932-842-0x00007FFA280D0000-0x00007FFA2C041000-memory.dmp
                        Download

                        memory/4932-781-0x00007FFA280D0000-0x00007FFA2C041000-memory.dmp
                        Download

                        memory/4932-768-0x00007FFA280D0000-0x00007FFA2C041000-memory.dmp
                        Download

                        memory/4932-752-0x00007FFA280D0000-0x00007FFA2C041000-memory.dmp
                        Download

                        memory/4932-722-0x00000259CA4A0000-0x00000259CA4A1000-memory.dmp
                        Download

                        memory/4932-724-0x00000259CA4A0000-0x00000259CA4A1000-memory.dmp
                        Download

                        memory/4932-1161-0x00007FFA280D0000-0x00007FFA2C041000-memory.dmp
                        Download