nromanoff — Live Investigation Report
Standalone investigation. Distinct tool family: spinlock.exe (PyInstaller Python backdoor). External C2 confirmed at 199.73.28.114:443 with self-signed TLS cert — the only host with a live external C2 connection. vibranium account and PSEXESVC.EXE confirmed on disk. 3 confirmed, 4 refuted. ~15 minutes. ~$14.