Overview
overview
3Static
static
3DWMBlurGla...64.zip
windows10-2004-x64
1ReadMe.txt
windows10-2004-x64
1Release/DW...ss.exe
windows10-2004-x64
1Release/DW...xt.dll
windows10-2004-x64
1Release/da...ek.png
windows10-2004-x64
1Release/da...se.png
windows10-2004-x64
1Release/da...er.png
windows10-2004-x64
1Release/da...ig.ini
windows10-2004-x64
1Release/da....dmres
windows10-2004-x64
3Release/da...DE.xml
windows10-2004-x64
3Release/da...US.xml
windows10-2004-x64
3Release/da...MX.xml
windows10-2004-x64
3Release/da...es.xml
windows10-2004-x64
3Release/da...FR.xml
windows10-2004-x64
3Release/da...ID.xml
windows10-2004-x64
3Release/da...IT.xml
windows10-2004-x64
3Release/da...JP.xml
windows10-2004-x64
3Release/da...KR.xml
windows10-2004-x64
3Release/da...BR.xml
windows10-2004-x64
3Release/da...PT.xml
windows10-2004-x64
3Release/da...RU.xml
windows10-2004-x64
3Release/da...SE.xml
windows10-2004-x64
3Release/da...TR.xml
windows10-2004-x64
3Release/da...VN.xml
windows10-2004-x64
3Release/da...CN.xml
windows10-2004-x64
3Release/da...SG.xml
windows10-2004-x64
3Release/da...TW.xml
windows10-2004-x64
3Release/da...re.pdb
windows10-2004-x64
3Release/da...WM.pdb
windows10-2004-x64
3Release/dbghelp.dll
windows10-2004-x64
1Release/symsrv.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
DWMBlurGlass_2.3.1_x64.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ReadMe.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Release/DWMBlurGlass.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Release/DWMBlurGlassExt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Release/data/AeroPeek.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Release/data/btnglow_close.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Release/data/btnglow_other.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Release/data/config.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Release/data/defaultres.dmres
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Release/data/lang/de-DE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Release/data/lang/en-US.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Release/data/lang/es-MX.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Release/data/lang/es.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Release/data/lang/fr-FR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Release/data/lang/id-ID.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Release/data/lang/it-IT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Release/data/lang/ja-JP.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Release/data/lang/ko-KR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Release/data/lang/pt-BR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Release/data/lang/pt-PT.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Release/data/lang/ru-RU.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Release/data/lang/sv-SE.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Release/data/lang/tr-TR.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Release/data/lang/vi-VN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Release/data/lang/zh-CN.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Release/data/lang/zh-SG.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Release/data/lang/zh-TW.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Release/data/symbols/dwmcore.pdb/AB3E8DEE7EDC8B1006D8C2FA5917BEE41/dwmcore.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Release/data/symbols/uDWM.pdb/183C267E422D329FEDB78CD31AC2E1C51/uDWM.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Release/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Release/symsrv.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target Release/data/btnglow_other.png
- Size 1KB
- Sample260925-pwlmrssvcw
- SHA256 0746d063c0b02c37d4fb689dd52d2be3ae9770b7af6070ea07eb8be43791248d
- MD5 65d4ec586a91d0cdbee17a887fdbae76
- SHA1 9d80ef11ee696a3e93df5b3ad1e1e3cd0c5234db
- SHA512 8978d14f42276ae49d99cf2dce8c19d3f95b1643d004e2b72bf32c5ced39b73472807cde882749330f81d0066d4935dcda2420adafb62ed7948b6b9875529e28
- TLSH T125412AD951F14CFD5D6B5412AB62668C4BF4A84A82D0C326D92E673A30AD18CFF1242F
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 968 mspaint.exe 968 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 968 mspaint.exe 968 mspaint.exe 968 mspaint.exe 968 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Release\data\btnglow_other.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4164