Overview
overview
3Static
static
3DWMBlurGla...64.zip
windows10-2004-x64
1ReadMe.txt
windows10-2004-x64
1Release/DW...ss.exe
windows10-2004-x64
1Release/DW...xt.dll
windows10-2004-x64
1Release/da...ek.png
windows10-2004-x64
1Release/da...se.png
windows10-2004-x64
1Release/da...er.png
windows10-2004-x64
1Release/da...ig.ini
windows10-2004-x64
1Release/da....dmres
windows10-2004-x64
3Release/da...DE.xml
windows10-2004-x64
3Release/da...US.xml
windows10-2004-x64
3Release/da...MX.xml
windows10-2004-x64
3Release/da...es.xml
windows10-2004-x64
3Release/da...FR.xml
windows10-2004-x64
3Release/da...ID.xml
windows10-2004-x64
3Release/da...IT.xml
windows10-2004-x64
3Release/da...JP.xml
windows10-2004-x64
3Release/da...KR.xml
windows10-2004-x64
3Release/da...BR.xml
windows10-2004-x64
3Release/da...PT.xml
windows10-2004-x64
3Release/da...RU.xml
windows10-2004-x64
3Release/da...SE.xml
windows10-2004-x64
3Release/da...TR.xml
windows10-2004-x64
3Release/da...VN.xml
windows10-2004-x64
3Release/da...CN.xml
windows10-2004-x64
3Release/da...SG.xml
windows10-2004-x64
3Release/da...TW.xml
windows10-2004-x64
3Release/da...re.pdb
windows10-2004-x64
3Release/da...WM.pdb
windows10-2004-x64
3Release/dbghelp.dll
windows10-2004-x64
1Release/symsrv.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
DWMBlurGlass_2.3.1_x64.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ReadMe.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Release/DWMBlurGlass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Release/DWMBlurGlassExt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Release/data/AeroPeek.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Release/data/btnglow_close.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Release/data/btnglow_other.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Release/data/config.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Release/data/defaultres.dmres
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Release/data/lang/de-DE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Release/data/lang/en-US.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Release/data/lang/es-MX.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Release/data/lang/es.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Release/data/lang/fr-FR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Release/data/lang/id-ID.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Release/data/lang/it-IT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Release/data/lang/ja-JP.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Release/data/lang/ko-KR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Release/data/lang/pt-BR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Release/data/lang/pt-PT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Release/data/lang/ru-RU.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Release/data/lang/sv-SE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Release/data/lang/tr-TR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Release/data/lang/vi-VN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Release/data/lang/zh-CN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Release/data/lang/zh-SG.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Release/data/lang/zh-TW.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Release/data/symbols/dwmcore.pdb/AB3E8DEE7EDC8B1006D8C2FA5917BEE41/dwmcore.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Release/data/symbols/uDWM.pdb/183C267E422D329FEDB78CD31AC2E1C51/uDWM.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Release/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Release/symsrv.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target Release/data/btnglow_close.png
- Size 2KB
- Sample260925-pwlmrssvcw
- SHA256 0e65281e1e1bd40c89d99a847b85cd7795026bebd59cc141bdbf01defa4abd46
- MD5 37f7405232baa2dad24d640436bf2ad7
- SHA1 aa9e74e31c4d467a5a71ac603fee37b14e557aa1
- SHA512 d1ded1ded17a59898839e9d418f1cf34af109df5ec7ddd8f79b3f873dc66015aade6551ca8f2cb6d05762861139a15d5c3e459ddca1d251b599c0aba270ad76e
- TLSH T166412D67EB9D6CB0C05FCEE45333806F02215D5050113B179EB9AA5781A514A3FD57FB
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4468 mspaint.exe 4468 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4468 mspaint.exe 4468 mspaint.exe 4468 mspaint.exe 4468 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Release\data\btnglow_close.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:1212