00b96f5cee633bb2cdb71c182e0e8db749de5a41a14bf07219f695d9c7bd1ea0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Size 2.6MB
Sample260420-dr1eksbz2z
SHA256 00b96f5cee633bb2cdb71c182e0e8db749de5a41a14bf07219f695d9c7bd1ea0
MD5 330e717122b017d2cd5f79eee0707803
SHA1 f67f876b98b912bf20008a6112dbdf6238fe6791
SHA512 18f5f9ed7326c96aa79f6430788859231e3943a4928de6aaa2090461317cb3139e5397e2d1ee20edab142679cd58fbf9c386a061a4824412f2eadfc86992b337
SSDEEP 49152:KeVJC5xuq9nkkCcojBX5QWOk9g2yTKKxO:5Ptksp
TLSH
T100C57D0A62A50199C2A7C174CD56C512F7717C0D17F29BFB36D0A6EA2F73AE07A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x001c00000002b43e-49.dat	disable_win_def

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Preset_Mon_x84.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b43e-49.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b43e-49.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b43e-49.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b43e-49.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b43e-49.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3728	powershell.exe
468	powershell.exe
3320	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5096	Preset_Mon_x84.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Preset_Mon = "\"C:\\Users\\Admin\\AppData\\Roaming\\Preset_Mon\\Preset_Mon_x84.exe\""	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Preset_Mon = "\"C:\\Users\\Admin\\AppData\\Roaming\\Preset_Mon\\Preset_Mon_x84.exe\""	Preset_Mon_x84.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5984	sc.exe
696	sc.exe
1744	sc.exe
4572	sc.exe
4884	sc.exe
2820	sc.exe
5572	sc.exe
5880	sc.exe
5524	sc.exe
2024	sc.exe
3548	sc.exe
3364	sc.exe
3916	sc.exe
2516	sc.exe
3568	sc.exe
4936	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1624	schtasks.exe
2928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
3728	powershell.exe
3728	powershell.exe
5096	Preset_Mon_x84.exe
5096	Preset_Mon_x84.exe
5096	Preset_Mon_x84.exe
5096	Preset_Mon_x84.exe
5096	Preset_Mon_x84.exe
5096	Preset_Mon_x84.exe
468	powershell.exe
468	powershell.exe
3320	powershell.exe
3320	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3116	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeDebugPrivilege	468	powershell.exe
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeSecurityPrivilege	5096	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5096	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5096	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5096	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5096	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5096	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5096	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5096	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5096	Preset_Mon_x84.exe
Token: SeBackupPrivilege	5096	Preset_Mon_x84.exe
Token: SeSecurityPrivilege	5096	Preset_Mon_x84.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found
Token: SeShutdownPrivilege	3116	Process not Found
Token: SeCreatePagefilePrivilege	3116	Process not Found

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4572	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	79
PID 3124 wrote to memory of 4884	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	81
PID 3124 wrote to memory of 4936	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	83
PID 3124 wrote to memory of 3548	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	85
PID 3124 wrote to memory of 2820	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	87
PID 3124 wrote to memory of 5984	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	89
PID 3124 wrote to memory of 2516	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	91
PID 3124 wrote to memory of 3364	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	93
PID 3124 wrote to memory of 3728	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	95
PID 3124 wrote to memory of 1624	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	97
PID 3124 wrote to memory of 5096	3124	2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe	99
PID 5096 wrote to memory of 5572	5096	Preset_Mon_x84.exe	100
PID 5096 wrote to memory of 3568	5096	Preset_Mon_x84.exe	102
PID 5096 wrote to memory of 696	5096	Preset_Mon_x84.exe	104
PID 5096 wrote to memory of 5880	5096	Preset_Mon_x84.exe	106
PID 5096 wrote to memory of 3916	5096	Preset_Mon_x84.exe	108
PID 5096 wrote to memory of 5524	5096	Preset_Mon_x84.exe	110
PID 5096 wrote to memory of 1744	5096	Preset_Mon_x84.exe	112
PID 5096 wrote to memory of 2024	5096	Preset_Mon_x84.exe	114
PID 5096 wrote to memory of 468	5096	Preset_Mon_x84.exe	116
PID 5096 wrote to memory of 2928	5096	Preset_Mon_x84.exe	118
PID 5096 wrote to memory of 5568	5096	Preset_Mon_x84.exe	120
PID 5568 wrote to memory of 3320	5568	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_330e717122b017d2cd5f79eee0707803_blankgrabber_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WinDefend"
  2⤵
  - Launches sc.exe
  PID:4572
- C:\Windows\SYSTEM32\sc.exe
  sc config "WinDefend" start= disabled
  2⤵
  - Launches sc.exe
  PID:4884
- C:\Windows\SYSTEM32\sc.exe
  sc stop "MsMpSvc"
  2⤵
  - Launches sc.exe
  PID:4936
- C:\Windows\SYSTEM32\sc.exe
  sc config "MsMpSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:3548
- C:\Windows\SYSTEM32\sc.exe
  sc stop "Sense"
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\SYSTEM32\sc.exe
  sc config "Sense" start= disabled
  2⤵
  - Launches sc.exe
  PID:5984
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\SYSTEM32\sc.exe
  sc config "WdNisSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableBlockAtFirstSeen $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Start-Sleep 60; Set-MpPreference -DisableRealtimeMonitoring $false; Set-MpPreference -DisableBehaviorMonitoring $false; Set-MpPreference -DisableBlockAtFirstSeen $false; Set-MpPreference -DisableIOAVProtection $false; Set-MpPreference -DisableScriptScanning $false"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3728
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsPresetMonitorTask" /tr "\"C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe\"" /sc onlogon /ru SYSTEM /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1624
- C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe
  "C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WinDefend"
    3⤵
    - Launches sc.exe
    PID:5572
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WinDefend" start= disabled
    3⤵
    - Launches sc.exe
    PID:3568
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "MsMpSvc"
    3⤵
    - Launches sc.exe
    PID:696
- - C:\Windows\SYSTEM32\sc.exe
    sc config "MsMpSvc" start= disabled
    3⤵
    - Launches sc.exe
    PID:5880
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Sense"
    3⤵
    - Launches sc.exe
    PID:3916
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Sense" start= disabled
    3⤵
    - Launches sc.exe
    PID:5524
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WdNisSvc"
    3⤵
    - Launches sc.exe
    PID:1744
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WdNisSvc" start= disabled
    3⤵
    - Launches sc.exe
    PID:2024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableBlockAtFirstSeen $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Start-Sleep 60; Set-MpPreference -DisableRealtimeMonitoring $false; Set-MpPreference -DisableBehaviorMonitoring $false; Set-MpPreference -DisableBlockAtFirstSeen $false; Set-MpPreference -DisableIOAVProtection $false; Set-MpPreference -DisableScriptScanning $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "WindowsPresetMonitorTask" /tr "\"C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe\"" /sc onlogon /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\%USERNAME%\AppData\Roaming\Preset_Mon'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Preset_Mon'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 cad7fa82645bffc55a30f34d2171b358e37496ab44945d39cf6ad5d3653cfb43
MD5 2ed87f0ff6276cca643ce40823ecc862
SHA1 e488b6df5f116b68a177eaa5e09ece10433c52d0
SHA512 3769f962bb2dd68a8f8555233112cd02befc3ccc5e2ce390753e02afb00777c5c0188557a9254d2d18d02fe9b55e1e32f19a2a7930658ae6aebf3b0e45eae8f0
SSDEEP 1536:/flJnrh4iUxubYCMVKfKQ0RWgvrqM21aV8NX+z30voM8xYoe3V3CNBQkj2SOdB6W:/flJnrqiUubYCMVKfKQ0RWgvrqM21aV6
TLSH
T15A538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c39acf1f531ea52ea22cd85742d6855c1a23c10b9f54e20eb90d973376ca77a9
MD5 e742cac862802ef7b83339795362e8ca
SHA1 f916f7a3459bb3bde64ddbbe5ccad38a02bd241e
SHA512 03b6957ac88a09832006c6abc9d2aaf5866d34580108dd164179f58e528bc30f42a5d8dea3faa34464c5e43445c396268e03c78ae51230996aff74b1b893497e
TLSH
T1CA218933B3ACC134C8DA117A108CAD01B2B5C3C7449ECE9B7B84C508A57F899DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sltwktmv.w3b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sltwktmv.w3b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Preset_Mon_x84.exe

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\Preset_Mon_x84.exe
Size 2.6MB
SHA256 00b96f5cee633bb2cdb71c182e0e8db749de5a41a14bf07219f695d9c7bd1ea0
MD5 330e717122b017d2cd5f79eee0707803
SHA1 f67f876b98b912bf20008a6112dbdf6238fe6791
SHA512 18f5f9ed7326c96aa79f6430788859231e3943a4928de6aaa2090461317cb3139e5397e2d1ee20edab142679cd58fbf9c386a061a4824412f2eadfc86992b337
SSDEEP 49152:KeVJC5xuq9nkkCcojBX5QWOk9g2yTKKxO:5Ptksp
TLSH
T100C57D0A62A50199C2A7C174CD56C512F7717C0D17F29BFB36D0A6EA2F73AE07A3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\d3dcompiler_47.dll
Size 3.7MB
SHA256 ea89b930b67d69a405cd5dd041d879744c5b096a3a185e77a5a02763583fbcc0
MD5 07e5a30e909de6afc1e6d780e059a103
SHA1 bd8392d58e6acdcda81763293d1ba9b397e29218
SHA512 06e95255e16c0bae33b779d1ca075666052f8c0feaecbf0e105eec5218ff33e65e0979a2989a28ecd569cf74100bfd57b980a71f2fb0aeb477765280bb8cfc38
SSDEEP 98304:+26y3SWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQ4K:kMVByQyVG/uzGNVyAl3K8fCGB
TLSH
T1070633B43D6584E8CA3C887488C6BF33EC1B0A22DA8691993BD58096D977F5747F4C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\libEGL.dll
Size 289KB
SHA256 f7f8eaafd0eff00954b86bc60188e562995627c49d3844936bce261b5f4da745
MD5 af41e58d1853a23375cde605c23131dd
SHA1 5bc195702624625000b6ffdfa91d0160bb8c4be8
SHA512 ded7e7113acab96292501262de04888b46b6bb0b9f39b2633f1c413c2458805e63f05ce00108820b2fe46665444965911416327036be064f9d8e6a23f449bf14
SSDEEP 6144:BD4Zh8yI/6L88xqAtlo3lsMkNvdMftC+BASK5IMcSxQrRk:l4Zh8y2Y8Atlo1sMkNvdl+BcOC
TLSH
T13F542334FC73C855D6612D3E11E5128AAA5396262CC33264EA1373DF5009BECF85AED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\libGLESv2.dll
Size 6.5MB
SHA256 094d32d387bca3023a4dccd20391513aeed4aad622cfff460d828e9fbc7c6f62
MD5 4ad26285728b8f35c0cc88766d1a4d14
SHA1 022f340ea073c1d13f75fa2ec2cc6fc13535f074
SHA512 336c229e53c44addf439f05b2cfa6c55f84f0cdc9350e771bbc28af8d41f02557041445f448582eff0367843420fc622499b9193fbb6aff67fcaffc088f55642
SSDEEP 98304:5WNxJ7/nATC4K7XsWkkjaHjTo82Pb0c0NZrq9BRVvUdowc9cDbuHn5cFOzF3:Q3JzATC4C8WfszNpiRVxK65DzN
TLSH
T1576633179CD55903FA9AA074AC8E31940FBD19FE431DCBB464717EF468A01B0ADBE4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\msvcp140.dll
Size 593KB
SHA256 d238d756610f062d305cfe32a248c7fdf5aabe1e3ce6946de960fff6e4840b5a
MD5 ac719a8b72566e0118e140716e9894c5
SHA1 73edb6eb4cc18813a06cbd3ba5dda17bf046de31
SHA512 b52924b76799a269962eecb3e99aefc292cbf53a6b07d0fea6a9a352fa88ab18b7c811372a718259f4ddb4259e8e47e05f20be71a5345db98dfb11fe17511045
SSDEEP 12288:XNZpFCYNICoOW7SOsDVt1AqOj8wmViPHI6Uo:XNjw8A7ZsDVvw8wHIy
TLSH
T1E7D423092E7DBBFDFF040B30A62065E31C2D9AD968895D1056BDE6525F085EBCE38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\msvcp140_1.dll
Size 35KB
SHA256 a2b28fc1c401536aae0b6eede86d50f6f00bbd4ec7ee9d23ec92f514873d1618
MD5 2e9f2c523c135ceac19ae5432fe2bf10
SHA1 10cdb84d959c394fc53e4e16b04c1638cad17b8e
SHA512 046ccc5dfa48666d670e6ee5fddefa601189808939ddb69f28af3b54aba07731c3bdff1b3c02603104a2122af3dba9988a67313cfd8993d8b0772fb4e0f85614
SSDEEP 768:Peigl3VBANqMChTM/y8KNqU+c7QfCtdL+22Z5LVTJa5Oi:Peigl3VCNwJeUNX88+223VFm
TLSH
T18DF2F1AC0E585378D058DFF650DD78F7C6D8EEEC5DCD60CE815B50BAAAC889918C028E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_2.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\msvcp140_2.dll
Size 274KB
SHA256 2fa870826ae8fd44d32acfa5fd4aa7e551412f717ed7555ad6d551c1b3392668
MD5 f60e3b659acb87415d695f05b9b84fb7
SHA1 0d23dcb51c2bbb8da19c756e47a4b6c437c55dce
SHA512 6cf01843499e518a1d51d6731eb046cbf19c5a7285970b486bd2088f8ddaac7929a00100c5773af16eda0c1bf54d75c8dc0f70b1544de87704840d9c861c456b
SSDEEP 6144:MJ12MeIan8hB7OJzIma5hly0Wds0qgylxmSW8:RMeIaQB7OJEtlyeGEW8
TLSH
T1265423F00B800E8FDD2D1634776F91178EE7BC18829B250EBA6DD7E63A45949D4CC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\vcruntime140.dll
Size 80KB
SHA256 c711e7e405b60172b18740c13393796cca9795a82fb3bbe2a69d23149f64a888
MD5 eb8513f95d7bcc9445d6934ef9049e9a
SHA1 141c15f3c9c7f2ef57f6cfa1d88af68a212b20d7
SHA512 1fc67f9d738dd169fd99e7e96938c9ee78c90db6474deb6630704a78f67a3aea34b97121634aff33fa2452b02109f53cdf7c4fcca7a3d9982659fdc008ae7546
SSDEEP 1536:da03yaKSRD3ZMEZObybfE4IB9JvCWj0g/1Ze4GA9sE5WDp44jhgW:da0CaKSR3Fbfu5vCWjBfGAtWDpV
TLSH
T18F8302AC66CE6F0FDA268BFC9B1C657D36997304A459B07B081B0271DD07239E8C69F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Preset_Mon\vcruntime140_1.dll
Size 34KB
SHA256 67f6bff4b1d8666cfbaa6aee11a1cfcf1d706614a88832c6410dce6770123c80
MD5 02ea363b5012605112a9074af5240ff2
SHA1 16cd06169af3d9b3683a46518e2a3a5c4bbc5faf
SHA512 aa5da710c1f86f63a3bd5e16a36fe064e25fa8a3af6045f3efc2fb812c40a486f584db97a65899e8dce19f9f3de13dc9cc2c2d22607cc890ee2188f896ad9dd8
SSDEEP 768:LyelHHRqcSVZn6XHZ+OIDrfZ28Qx5AK1GORHDzdsQHzQ68XoqaimGW99n:LpHgtVZnsMOIM8Qxp1TDOgk6OaLn
TLSH
T1F8F2F1E481320F5FD3E743F26193B61D705AC2BF36FA893370E56D54F6A91288DA2029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-95-0x000001E9AFD20000-0x000001E9AFD7D000-memory.dmp

Download

memory/468-97-0x000001E9C8330000-0x000001E9C8342000-memory.dmp

Download

memory/468-96-0x000001E9AFE30000-0x000001E9AFE3C000-memory.dmp

Download

memory/468-140-0x000001E9AFE30000-0x000001E9AFE3C000-memory.dmp

Download

memory/468-139-0x000001E9AFD20000-0x000001E9AFD7D000-memory.dmp

Download

memory/3116-37-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3116-0-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3116-2-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3124-50-0x000002575E230000-0x000002575E28D000-memory.dmp

Download

memory/3320-88-0x0000020D0B410000-0x0000020D0B46D000-memory.dmp

Download

memory/3320-90-0x0000020D0D110000-0x0000020D0D122000-memory.dmp

Download

memory/3320-89-0x0000020D0B4D0000-0x0000020D0B4DC000-memory.dmp

Download

memory/3728-19-0x000001461DE70000-0x000001461DE8C000-memory.dmp

Download

memory/3728-23-0x000001461DEA0000-0x000001461DEAA000-memory.dmp

Download

memory/3728-27-0x000001461DEF0000-0x000001461DEFA000-memory.dmp

Download

memory/3728-26-0x000001461DEE0000-0x000001461DEE6000-memory.dmp

Download

memory/3728-25-0x000001461DEB0000-0x000001461DEB8000-memory.dmp

Download

memory/3728-67-0x0000014603DE0000-0x0000014603E3D000-memory.dmp

Download

memory/3728-69-0x000001461DD80000-0x000001461DD92000-memory.dmp

Download

memory/3728-24-0x000001461E430000-0x000001461E44A000-memory.dmp

Download

memory/3728-5-0x000001461DD70000-0x000001461DD80000-memory.dmp

Download

memory/3728-54-0x000001461DD70000-0x000001461DD80000-memory.dmp

Download

memory/3728-22-0x000001461DEC0000-0x000001461DEDC000-memory.dmp

Download

memory/3728-21-0x000001461DE90000-0x000001461DE9A000-memory.dmp

Download

memory/3728-20-0x000001461E120000-0x000001461E1D3000-memory.dmp

Download

memory/3728-68-0x00000146056C0000-0x00000146056CC000-memory.dmp

Download

memory/3728-130-0x0000014603DE0000-0x0000014603E3D000-memory.dmp

Download

memory/3728-131-0x00000146056C0000-0x00000146056CC000-memory.dmp

Download

memory/3728-12-0x000001461DDD0000-0x000001461DDF2000-memory.dmp

Download

memory/3728-4-0x000001461DD70000-0x000001461DD80000-memory.dmp

Download

memory/5096-91-0x000002B261400000-0x000002B26145D000-memory.dmp

Download