{
  "info": "refresh-discord-membership.png",
  "date": "2026-04-07",
  "threat_level_id": "2",
  "Attribute": [
    {
      "type": "domain",
      "value": "wE.is",
      "category": "Artifacts dropped",
      "comment": "confidence=medium context=regex_domain"
    },
    {
      "type": "text",
      "value": "\\\\\ufffd\ufffd\ufffd\ufffd\ufffdfjjj\ufffd\u001c9r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffd\ufffd`\ufffd\ufffd666\ufffd\u0026M\ufffd:u\ufffd\ufffd\u0007\u000f\u0010B3f\ufffd8}\ufffd\ufffd\ufffda\ufffd6n܈\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdBt\ufffd\ufffd츸\ufffdٳg\ufffd\ufffd\ufffd\ufffd]\ufffdXfϞ=_~\ufffd%~\ufffdp\ufffd\ufffd",
      "category": "Artifacts dropped",
      "comment": "confidence=medium context=regex_windows_path"
    },
    {
      "type": "text",
      "value": "\\\\\ufffd\ufffd\ufffd\ufffdq}\u001c\ufffd",
      "category": "Artifacts dropped",
      "comment": "confidence=medium context=regex_windows_path"
    },
    {
      "type": "text",
      "value": "\\\\\u000e\u001c8\ufffd\ufffd\ufffd_^aa\ufffd\ufffd\ufffd\ufffd\ufffd͛\ufffdSj\ufffd\ufffd\ufffd\u0003\ufffd0žb\ufffdN\ufffd",
      "category": "Artifacts dropped",
      "comment": "confidence=medium context=regex_windows_path"
    },
    {
      "type": "text",
      "value": "\\\\L}\u001d)\ufffd\u0015e77\ufffd\ufffd\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd%I\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\u000b\ufffdπ\ufffd\u0001y\ufffd\ufffd\ufffd7i``\u0010\u0010\u0010лwo\u0006\ufffdA}\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffduccc\ufffd޽\ufffd\ufffd\ufffd\ufffdAAA\ufffd\ufffd\ufffd",
      "category": "Artifacts dropped",
      "comment": "confidence=medium context=regex_windows_path"
    },
    {
      "type": "text",
      "value": "\\\\\ufffd\ufffdŋ\ufffd\ufffd\ufffdC\ufffd\ufffdܹs\ufffd_m\ufffd\ufffd\ufffd\ufffd\ufffdכ$I\u0013\u0013\ufffd\ufffd\ufffd\u0004;;\ufffd\ufffd\ufffd\ufffd\ufffd\u0013'R\ufffd\ufffd\ufffd\ufffd\ufffdC\ufffd\u000e]\ufffdzuXX\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdjjj\ufffd\ufffd\ufffdXZHY\ufffd\ufffdb-]\ufffdtԨQ",
      "category": "Artifacts dropped",
      "comment": "confidence=medium context=regex_windows_path"
    },
    {
      "type": "text",
      "value": "$I",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$y",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$iccs",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$W",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$xyy",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$c",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$g",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$G",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$_",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$M",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$T",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    },
    {
      "type": "text",
      "value": "$J",
      "category": "Artifacts dropped",
      "comment": "confidence=low context=regex_env_var"
    }
  ]
}