Overview
overview
3Static
static
3DWMBlurGla...64.zip
windows10-2004-x64
1ReadMe.txt
windows10-2004-x64
1Release/DW...ss.exe
windows10-2004-x64
1Release/DW...xt.dll
windows10-2004-x64
1Release/da...ek.png
windows10-2004-x64
1Release/da...se.png
windows10-2004-x64
1Release/da...er.png
windows10-2004-x64
1Release/da...ig.ini
windows10-2004-x64
1Release/da....dmres
windows10-2004-x64
3Release/da...DE.xml
windows10-2004-x64
3Release/da...US.xml
windows10-2004-x64
3Release/da...MX.xml
windows10-2004-x64
3Release/da...es.xml
windows10-2004-x64
3Release/da...FR.xml
windows10-2004-x64
3Release/da...ID.xml
windows10-2004-x64
3Release/da...IT.xml
windows10-2004-x64
3Release/da...JP.xml
windows10-2004-x64
3Release/da...KR.xml
windows10-2004-x64
3Release/da...BR.xml
windows10-2004-x64
3Release/da...PT.xml
windows10-2004-x64
3Release/da...RU.xml
windows10-2004-x64
3Release/da...SE.xml
windows10-2004-x64
3Release/da...TR.xml
windows10-2004-x64
3Release/da...VN.xml
windows10-2004-x64
3Release/da...CN.xml
windows10-2004-x64
3Release/da...SG.xml
windows10-2004-x64
3Release/da...TW.xml
windows10-2004-x64
3Release/da...re.pdb
windows10-2004-x64
3Release/da...WM.pdb
windows10-2004-x64
3Release/dbghelp.dll
windows10-2004-x64
1Release/symsrv.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
DWMBlurGlass_2.3.1_x64.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ReadMe.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Release/DWMBlurGlass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Release/DWMBlurGlassExt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Release/data/AeroPeek.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Release/data/btnglow_close.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Release/data/btnglow_other.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Release/data/config.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Release/data/defaultres.dmres
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Release/data/lang/de-DE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Release/data/lang/en-US.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Release/data/lang/es-MX.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Release/data/lang/es.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Release/data/lang/fr-FR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Release/data/lang/id-ID.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Release/data/lang/it-IT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Release/data/lang/ja-JP.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Release/data/lang/ko-KR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Release/data/lang/pt-BR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Release/data/lang/pt-PT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Release/data/lang/ru-RU.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Release/data/lang/sv-SE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Release/data/lang/tr-TR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Release/data/lang/vi-VN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Release/data/lang/zh-CN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Release/data/lang/zh-SG.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Release/data/lang/zh-TW.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Release/data/symbols/dwmcore.pdb/AB3E8DEE7EDC8B1006D8C2FA5917BEE41/dwmcore.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Release/data/symbols/uDWM.pdb/183C267E422D329FEDB78CD31AC2E1C51/uDWM.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Release/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Release/symsrv.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target Release/data/AeroPeek.png
- Size 142KB
- Sample260925-pwlmrssvcw
- SHA256 e8d37b88ef974f8c0ad0484908d573753ac12db69c6991b17da34f19311c7b20
- MD5 c5193f32f17ce6b13aa4ec1c1eb53e58
- SHA1 41ff6b576e35903c79d776ec87350cb9a768faba
- SHA512 1a3e91940a400fd41bf783dbf3545a2eba67eefe08664f08202b3772f726e2978f19e24a0a4bd5c6cf2a02e3f48fcbc0053dca2e99112dc75bb533ca8bda2716
- SSDEEP 1536:SBB3joMaqAWm1Nc1dssrbKumOYZYcTKpAcbggjdGLvsPIzpRpmjIrjtbl4RzPBia:SSqS7AD2YIgJggjd4swzvpmctR4NZCBM
- TLSH T1F4E3F2DE7F2B9C940CE7CE633661F648062CEC77285EF545E908B9C6CAEBD7010A1161
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4304 mspaint.exe 4304 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4304 mspaint.exe 4304 mspaint.exe 4304 mspaint.exe 4304 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Release\data\AeroPeek.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2528