valleyrat_s2 | 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360

Sharing

Copy URL Twitter E-mail

General

Target
KL-2026.exe
Size 81.2MB
Sample260718-x5ff4say7p
SHA256 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360
MD5 aaed2057837383f973ea9f681c533da5
SHA1 8752896c85760629c8520c88eaa8e1464a3d05f8
SHA512 6daad8e5258a3e9763e50459a26ac91984f21c5a5598f135e09f6ca575d4e7dd7e30234e8a2a43b9ed8e2ceb9e00353f3fbe1fb56a1c5a8388ecebdf50769a69
SSDEEP 1572864:otxRftUgOPzx6HsZFVAuK24cQgbWF0ZK/DZGbQRiVgIZvm9oqSPPWt:KftUgox643P/ZKIkRCPZe9xSWt
TLSH
T146183305C6E3FD67FF08863E318A76EE8BEDD18688CA9902461F15F59175A4C12C327B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

www.ijt1.com:80
ijt1.com:443
127.0.0.1:80

Attributes

campaign_date
2026. 7.17

Targets

- Target
  KL-2026.exe
- Size 81.2MB
- SHA256 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360
- MD5 aaed2057837383f973ea9f681c533da5
- SHA1 8752896c85760629c8520c88eaa8e1464a3d05f8
- SHA512 6daad8e5258a3e9763e50459a26ac91984f21c5a5598f135e09f6ca575d4e7dd7e30234e8a2a43b9ed8e2ceb9e00353f3fbe1fb56a1c5a8388ecebdf50769a69
- SSDEEP 1572864:otxRftUgOPzx6HsZFVAuK24cQgbWF0ZK/DZGbQRiVgIZvm9oqSPPWt:KftUgox643P/ZKIkRCPZe9xSWt
- TLSH
  T146183305C6E3FD67FF08863E318A76EE8BEDD18688CA9902461F15F59175A4C12C327B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation spyware trojan
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 32KB
- SHA256 657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
- MD5 1f24c9859dd6639d0c752d7b96a2442d
- SHA1 7014f711d1d06cdc3d5bae678aad29e8b9ebcfd2
- SHA512 7a488b27031e76873623142e66355d45a2bcd13d0fe235b93db1f92bb5c6658c4b689131672cacdad7b5a3204fca3fdbe020066f442b3a0db17fcf85f3eabf96
- SSDEEP 384:PnpIqrPKteJM6zAzlq0BnPr681qrSYc/RHXCtk6tztN4Ykvdv7WbHwyx1I83cwTv:PpI8yU0tmC/hS3NfgvtQt28PEslxo
- TLSH
  T1FCE21A19FE42A5F6C233A5705AEBD3BBCB04B437D8234F1AEE124B4AB9675B1510D211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Microsoft.exe
- Size 519KB
- SHA256 e4a6acc09b909fa4da2a112b56bc33c5c96447dd38477d7cde69182118748ecb
- MD5 e96b0d29d930fae0c38d2cb14328df87
- SHA1 82a46be88db14030244318b070e58a8973e5ab26
- SHA512 47b1d1630f936cee0c752851e91481e904461d9935cc1f5b89ecb1824c4cbb4b875f0546f5631671128b1880c7262c120442fc291dd2a6ce2e1440a40115b6d0
- SSDEEP 12288:tJCd6Dz15YHUYHkxOj9yFJSNQFmba4JNyL87pMIMSn1bojmtmB7QeIYPE6:vvDx5YHU9iXn11mOeRPE6
- TLSH
  T143B45A0079618036EB6216B6497EE9B8591CAE74074565CFE3983C79AF312E36B3306F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  api-ms-win-core-console-l1-1-0.dll
- Size 11KB
- SHA256 0dd2878a9aad0d1a64848db4a1b4e3851fd5bf049c4ba5b726d114ff45fd947a
- MD5 3c89c64d591ab2eaf01fbd2253b3a623
- SHA1 99b595ed628983c88eb09c484777eea666f631b9
- SHA512 bb370bd639c4b2d25c44d153a7de6dff7fcb8f8af644b6b37243fab1bff282d8d3f13770e6862cf0b348ff83e6d7f73b3aef61e575660debce5664ced50be715
- SSDEEP 192:WfAwWOhWrpT71ojDBQABJwqnajLQvTP+8jIrerl:WfVWOhWrSDBRJwlvQyUIrerl
- TLSH
  T12B422CC34EE85442E956AD7002ACE9437D3DBBC51820955522ABF69E2CD33D6DB04B1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  api-ms-win-core-datetime-l1-1-0.dll
- Size 11KB
- SHA256 289ea86da94de73f0f0de4812caf7eda170ee612c72a713b3036b2669813d15a
- MD5 6dbcafa7fd0b183040b73e7e1d97674b
- SHA1 4a6f7d5ceca5dd225532d95b743fa7b7b724621d
- SHA512 e7c4dbf91c27c2d1570529e33c47e0e2b77c636a22f32f2956c9a59b5acae8b2721ea5802d85bbd179c7931d1542ca20b526487297be729698027ffd97d4ac44
- SSDEEP 192:FWOhWOUT71ojDBQABJwY1UqnajMHxxBNT06YeO7BN:FWOhW+DBRJwHlI66YeO9N
- TLSH
  T118322BC28BBC5443EDA7AD7013ACEA837D3D77D61960841A05AAF1D92C837C2DB14B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  api-ms-win-core-debug-l1-1-0.dll
- Size 11KB
- SHA256 9487da37a92b40720ea2ad64ea0c9adc8b3c7bc4fe1f63a0e03e9c7a18943565
- MD5 d9e02887a85903ee3a4fa7f197865274
- SHA1 f68904fef682461068ea782f1ed911b124793732
- SHA512 43fbb849a9a6e41e3b20813ebbe29e9fc233f6c1a7c00f8798f15f5c896bca7f6906a9a65fbc5569b3d5f901d70ab9a6132f8a9f71193f2d7f5559a607d5cf84
- SSDEEP 192:4WOhWqT71ojDBQABJTwvveqnajsl/cqtm4t:4WOhWrDBRJTw3elPqr
- TLSH
  T1DF323CC28BBC5043E8A7ADB052ACE6877C3DA3C618704956059EF5D92D873C6EF14B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  api-ms-win-core-errorhandling-l1-1-0.dll
- Size 11KB
- SHA256 9cc0615a94b0a320f4b675eccbc3f7b8c279d9f692165afc6ce0c877f3981b08
- MD5 fcc2e13d7db99b2f3725046ca7d392d0
- SHA1 14d31bc9070a47cc58342aedd17b4ead672da6ea
- SHA512 bd9c7f3d97413f14abfe75cd2c5cfcb5aa39de05c8f69a2f6bfac554fdcf0eb0e41a32c34a5e7fe78a2bee2ad9d4be2895a33f138f7f0cb9f02dd3725b1893bd
- SSDEEP 192:GyfmxD3TWOhW0T71ojDBQABJ2ZqnajxcRGlPHSm:GyfYWOhWZDBRJ2Zll7PHSm
- TLSH
  T1E8322B828BAC5043E9E36D7022E8EA437D3D67C618304556169EF6DA2CD33C6DF04B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  api-ms-win-core-file-l1-1-0.dll
- Size 14KB
- SHA256 4b2dc152f33cd7d88beba8696a57cd0383f05c50d2fb63672664717766762a1d
- MD5 d613baa29afa3db1faa991876dd382f1
- SHA1 795ad1269848846294563480750c91abf6bf33af
- SHA512 a7113a430d39a71af764ddddda81f37f280f795ae88f5ab829523b278f82c1487401316c24700be4451a162567c282bcf08390a583ccd18b1baf96cd86ab54b3
- SSDEEP 192:zYPvVX8rFTsBWOhWwT71ojDBQABJ9t6qnaj9RlSIFspC:EPvVXbWOhW1DBRJ9t6lBRAIFsI
- TLSH
  T17E621A83D9A0F64BFC8F9E701196D84368394386043454C61BD9E79E7CE738BE788A9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  api-ms-win-core-file-l1-2-0.dll
- Size 11KB
- SHA256 568d7f8551d8b4199db3359d5145bc4cb01d6d2f1347547f47967eb06a45c3b5
- MD5 00d8b4bed48a1bb8a0451b967a902977
- SHA1 f10ef17bda66d7cab2840d7f89c6de022a7b3ff2
- SHA512 e248cbc06fc610f315d7efcadb39b5cb85dfe5d40858768d5aea8d41b3b4b23eafe0db2b38cce362fd8ba8bc5eb26e9b2dddc00e2e8615395bca818ecfe0decc
- SSDEEP 192:HWOhW7T71ojDBQABJ76qnajMHxxBNT06YeOg:HWOhWIDBRJulI66YeOg
- TLSH
  T11D322B828BB85043D9A76D7023ACEA437D3D77D61820859505AAF5DE2C837C6EF00B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  api-ms-win-core-file-l2-1-0.dll
- Size 11KB
- SHA256 c1bca1bb524c5ae3d877a099f469b6fc34288bab26ae7a7f4fc47cd869f4958d
- MD5 534483b0f4a1924b1ae6d7e66b4a4926
- SHA1 4e954316acd216007f4a0225b138e0c0a04fbbed
- SHA512 cfad2ddf8a9ad67e36e978726d8a12ca26b180f73122b2e8d19a83f73028a050d9f418e7525f576cc3a9601b3369d4494dddbde620b4011b7ca8a7ec4b0d1b12
- SSDEEP 192:tWOhWzT71ojDBQABJUrkqnaj9RlSIFxKV:tWOhWwDBRJ4klBRAIFw
- TLSH
  T15A323AC15BA89442FDA7AD7012A8E6473E3DA7C20860844605A6F79D2C973C7EF14BBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  api-ms-win-core-handle-l1-1-0.dll
- Size 11KB
- SHA256 85546a616d5594b884146aa4e13cdbfe841c9d956e648c6ee4840e6f4428bdcd
- MD5 2bd9500ab908c0e02ca40f19ef647288
- SHA1 de8cd89fba64fa131fa842619b10d7d2d8a681d1
- SHA512 1a3c5e306b6bedc87c250f8cb1b82e2c736a2c0a8e37c67e287914ff49da88af21722effad8cc4918d06b303989b09b35eb5d545a590be9fa8cdbf9028ef75a4
- SSDEEP 192:bWOhWxT71ojDBQABJNf+Q2qnaj9RlSIFr:bWOhWqDBRJN2blBRAIFr
- TLSH
  T189323AC18BAC5443EDAB7E705298E6437D3DA3C61830859609A6F2D92C973C6EF14B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  api-ms-win-core-heap-l1-1-0.dll
- Size 11KB
- SHA256 8434510e84f5ade3453cfe086ed08260d309f761ed922bb8ff9ed436d8575d82
- MD5 2bdca93251d247e98e0a907bf68ffc7b
- SHA1 84bc13dda79a309b2fb06499eba090359dbe7cbc
- SHA512 e86ec2cf9e964921a912c1992a01ceb8eab36f5d29d444d1c9b0b9b2f3fc4a831e4fe034c7676e52c01150ba037ca6f46f7de669a9aac5eb8bae2b848e65e7c3
- SSDEEP 192:iS6lWWOhWDzT71ojDBQABJSWcqnajxcRGlPHi:OlWWOhWsDBRJ0ll7PHi
- TLSH
  T1EE422A898BA85043E8B7BD7012E4E9533D3D73C6087044560AEAF2DE2C933D6DB24B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  api-ms-win-core-interlocked-l1-1-0.dll
- Size 11KB
- SHA256 75b8eae29ab9acc906aafac2a198fe875d34c22b40acace1cd6c3486d67333ef
- MD5 8a6c74b9a1db0d730af45be603d233c8
- SHA1 a6a3e80afeefcc9b34703c6a8ea2c0a94fe998e6
- SHA512 8f2e6be6a08e393acdb7e50687d6e6faefa9243855d92018bc9be5ffead022e4df96d2d51042a1e2d6d2eadcb88e27f7f4aea8a5314f8fb32c05cb9cededcd99
- SSDEEP 192:ClYsFqWOhW+T71ojDBQABJsgqnajLQvTP+8jIrS:ClYsFqWOhWvDBRJsglvQyUIrS
- TLSH
  T155423BC58BF8A442F6A66E7003A8E6837D3D63C518204116079BF6ED2CDB7C6EB10B5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  api-ms-win-core-libraryloader-l1-1-0.dll
- Size 11KB
- SHA256 27078ba4e79087a5c1146f35da386ce043a3c2bbcaed04bd82645eddb6ed896d
- MD5 a9116f560839df0c03be8ad704ab3351
- SHA1 3339421f8cb623b244dda6e76ec5b6c7d987af64
- SHA512 4bded31406e6de3823a72162ba72968047c48f8373b660a431415811052be622fbf5b4d2123086601440e714dabd703ff0c36ed962590c23144a2e2b00b13ffb
- SSDEEP 192:BvuBL3B6WOhWryWT71ojDBQABJFvJCeqnajxcRGlPHZ:BvuBL3B6WOhWryXDBRJCell7PHZ
- TLSH
  T19F420BC68B685042E5FBAD7092A5D5477D3D63864830886905EEF2DD3CE33C2EB00B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  api-ms-win-core-localization-l1-2-0.dll
- Size 13KB
- SHA256 13471eb84db95f8270398ef1deb29f0ea024db17e331497545c36eea7b2a3a7c
- MD5 73483cbc229c62e129627adbf62b0ffe
- SHA1 074ce67665c86355d3218b5e3ea4b1b335095af8
- SHA512 92f06cb8971e29da7607c6b1d1377f21c7e6f0e4a169aaa08326038d5cdb09422b91f4f2d26a7978521e0edbb9cf1235e583f2910048c917ccef8d12c5e1166a
- SSDEEP 384:5OMw3zdp3bwjGjue9/0jCRrndbZWOhWlDBRJIXlBRAIFn:5OMwBprwjGjue9/0jCRrndbvs1PIjRAW
- TLSH
  T132522BD29798E647F84EE9703167E5033C3D62850831989607E6FB653DE338AEB9076C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  api-ms-win-core-memory-l1-1-0.dll
- Size 11KB
- SHA256 d70eb06ed4f0c686dda93f35f065ec5e6249e5c737a24249738314c31f9d5202
- MD5 d9e4e446dcccbfa822059dcd16edfc41
- SHA1 cded5e8dbf7a00e080432257f95406f5728e739a
- SHA512 11deace1b537fb770281468efb265d932a22b797ee268fb60d968f2f238cbbead6c60114572932732b1fd8d5682c1080e7e927a25f73ed2f5e85640b080a37a3
- SSDEEP 192:oWFWOhW0T71ojDBQABJxAY1hXqnajL1dHx3tKCJAC:DFWOhWZDBRJOY1NlXBtpOC
- TLSH
  T106423AC14BB89447F4AA6D7053A8E747BC3E57C618A0401602BAF69A2CC33D6DB10B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  api-ms-win-core-namedpipe-l1-1-0.dll
- Size 11KB
- SHA256 36c42192283f129ff5637a06b7c3d72e5ed8e1c77493623384f2bdac15118f29
- MD5 bb05cdffc71ac2b0c0fb2cc35b409ec2
- SHA1 b327ab67107235beb5fcd1b893a571e21e29f6ff
- SHA512 b55cbf2aaa2f7685925c313d4ce73b8635666e5f2f30e2621fec88f3b526d296e5d1fb5c28bf3ea5e8621b298e01b75542085e9e3d1a966762173a3e53e4240d
- SSDEEP 192:iWWOhWYT71ojDBQABJz0ymVqnajLQvTP+8jIrf:1WOhWNDBRJzxmVlvQyUIrf
- TLSH
  T1A2323CD187A89042F99B6DB013E8E6437D3D67C918208555129BFDDE3C933D6DB20B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  api-ms-win-core-processenvironment-l1-1-0.dll
- Size 12KB
- SHA256 0d10d132cd28b57fb88135d5693ba2c1aace2fc059d85bde0318fb9b379b57b7
- MD5 14e48e802a6690282ebde74fd5b78e6f
- SHA1 8cb9adc2a99c6ca443c2ef0be6bb093f9059aeb2
- SHA512 710356f5e6d4f6dd7754c72deff703b144f91b54e643017c05dc81ebd4150981651e6f3ff20eded5fcd7abe0327692e8d6bab00f454597fc36603bd8389601c3
- SSDEEP 192:0vWOhWUT71ojDBQABJWTfqnajMHxxBNT06YeOXw:0vWOhW5DBRJGlI66YeOg
- TLSH
  T1B5425BC19AB85002E99BBD7012ACE5673C3C63A31C608059019AF79D3DD77C2EB44B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  api-ms-win-core-processthreads-l1-1-0.dll
- Size 13KB
- SHA256 28dd68501f527be6bc54f5f374bc33be983ea7ac640e66e3a56272cd3b9a5655
- MD5 f2fa7c391d7671ab11028e85d29ab27f
- SHA1 734ccf57cab781d367b62d216b6582f3bb89249d
- SHA512 3286fd352fb4149151168babe4b1e44d22e914d950f41c099748e8d3b117ada86391fb4e0ef5863aac07b2a08372ccce0c470642ac8a7c7dbf97ea72af1d0583
- SSDEEP 384:ok1JzNcKSI1WOhWzDBRJS/kPlI66YeO7EN:DcKSmS1P1q66MoN
- TLSH
  T15C520AC58AAC9183E89EAC703259E9533D3B93450D25846106E9F6DE3EEB3C6D72463C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  api-ms-win-core-processthreads-l1-1-1.dll
- Size 11KB
- SHA256 b5f815d0a41add7fd9593036a8e6843fcc221298fefd61808f960eed3cc19830
- MD5 7016bf365a155d29f01a000942a017ef
- SHA1 47e25b97af56edbdd20ca72bba994c6bcf1b81e6
- SHA512 2cd7e88717a2d81811ce03990737888b8a1e9e351dcdad401ffe5924bdf97be086bd766a1a5b25411b760cbf81b68bebd94d915100b6bc1310360813af11f827
- SSDEEP 192:79DfIeNWOhWVT71ojDBQABJUqdqnajLQvTP+8jIrnN:79DfIeNWOhWuDBRJhdlvQyUIrN
- TLSH
  T12C422CC186BC5483E9976E705298F6433D3EA7C61834446505ABF7AD2DD73C6EB00B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  api-ms-win-core-profile-l1-1-0.dll
- Size 10KB
- SHA256 3902aff11857535698367d4db2dfccde6168429defac82c15a535b4a07f7cdda
- MD5 5b222e79ed442685e509bb3f16e93482
- SHA1 fd9de440d03d9b57319c49871b15b8468ab961d3
- SHA512 1d057f6990f9999b82f086cb4c0547d638504ca0ec3e801240fdeb1a20f84cf2b812d9cca64786186f6158954ef5677208eb4f0265e300525b8528cdbdf305b0
- SSDEEP 192:+oJnWOhWbT71ojDBQABJhvz3xHqnajxcRGlPHen:+oJnWOhWoDBRJhvdll7PHen
- TLSH
  T1EE322BC28B685043E9A3BD7052E8E5437E3D67C65930455A05AAF5EE2C933C6EF00B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  api-ms-win-core-rtlsupport-l1-1-0.dll
- Size 10KB
- SHA256 db1622a0b0013991d759c7955454a8006aa27f81a8b9b5c37cf2595b15b1b217
- MD5 308aedd0dd83acfb5aec8c60782a4aed
- SHA1 e5027f0828aaf4b24eb6c6396fbf0b15e49355f1
- SHA512 281c9b854b958426d3c23dda7116af17a95e4bec3eb7e4fa85cd1216bb8a2b999a764866e831d1022590dada7e720d5d930417888f174fc91a3fce78f3393c1c
- SSDEEP 192:1IG5WOhWwT71ojDBQABJpqnaj9RlSIFOwbF:1IG5WOhW1DBRJplBRAIFOw5
- TLSH
  T1E03229C15BB85443F8A36E7013E8EA437D3DA7C60860955615A6F6A92CC33C6EF10A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  api-ms-win-core-string-l1-1-0.dll
- Size 11KB
- SHA256 7bf7ff35fbcbfc1cb57597acfb23d2fb13e04e14906f4a626e4e92d689f19cbc
- MD5 749b5c0031e0726fa45a3bb9b48b3802
- SHA1 551c7adf6233b66d9271f5b705ab45d69cb590aa
- SHA512 b7e7d59307aa2432b978484cfca8e5ea61216c1240bdbd733d4c697609ec371e6f13aef2a654de64711371b35dda2c5c6ae2b13b52e5951b51161d42b2d6ecaa
- SSDEEP 192:yMyMvNWOhWPT71ojDBQABJoUqnajsl/cqta:nyMvNWOhWMDBRJFlPq8
- TLSH
  T1333219829BB89043E8A76DB012ADF6877D3CA3C71870856501A9F6A93D833C5DF14B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  api-ms-win-core-synch-l1-1-0.dll
- Size 13KB
- SHA256 1ff0d9ceff0f982b7a78ef34c45980b88099067f4468f11fcdd46dbac00f6dd6
- MD5 2bbc9cf572b18123a0f27f04492c6ea6
- SHA1 216404ed615263be2271a8db7c64daa5d54d9412
- SHA512 f59cf115e6fd8f82f5d2b3c871ab0cfe3bd1c8c5493aca196da185a3f6e85e6390bcba1bb32d409ba17c3c032c43308f609db14180027fad564daa0d5f570309
- SSDEEP 192:Gdv3V0dfpkXc2MAvVaoKZWOhWpT71ojDBQABJdBqnajsl/cqtV:Gdv3V0dfpkXc0vVabWOhWSDBRJblPqH
- TLSH
  T1C3523B42D7E4A593F85FED7052DAD1836D3853860830882211DAF6AD3EE33C5DF14A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  api-ms-win-core-synch-l1-2-0.dll
- Size 11KB
- SHA256 e1a87d7d01e2376dde81a16658915ccf2ecb692739fef09adfb962523756e22d
- MD5 9efdffac1d337807b52356413b04b97b
- SHA1 2590bd486abce24312066285fa1c1feaf8332fe0
- SHA512 b3c164e50d48a78bd08cf365e02e263b97ec2dd3efcf04914c8677c838e10be23df5178a8618e3f2a6feb6faa2bb74eaf069e7e2db7c6e6fd9d0137dcffbcead
- SSDEEP 192:YttZ38WOhWJT71ojDBQABJFarAyTCqnajMHxxBNT06YeOpFWM:UtZ38WOhWyDBRJErDClI66YeOnT
- TLSH
  T1A5423BD29BA85543F9A7ACB053E9E5433C3D67C51820581605AFF29E2DA33C2DB04F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  api-ms-win-core-sysinfo-l1-1-0.dll
- Size 12KB
- SHA256 b31a83c8cc984c2a7ed9d7c9964f8ba302c1051bc478a3a34b98f4f873a6c011
- MD5 b697440bdbba2e896005de51943ee0db
- SHA1 f4f7ab7a1d8e4fa43f83401585e6e83136cb16e6
- SHA512 81270f3e9a91d001155fb9c7f80132d9611082a68c0f849ce95895dc9835223075531ce11a534dc076d75fb76cdeae9abeac23d371cc0de8428e8c177d7673d5
- SSDEEP 192:XtqUKIMFQWOhWq7T71ojDBQABJONnxqnajMHxxBNT06YeOargRow:XtqUlWOhWBDBRJYlI66YeOaURx
- TLSH
  T174421BD29BB89103E89B6E7022D9D6433D3DA7921420C45901EAF39EBEE33C5DB14639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  api-ms-win-core-timezone-l1-1-0.dll
- Size 11KB
- SHA256 f1667bbda1b58fc688b422fd2f9f7040919c4ababe00a4be78b258cae2dfc3d3
- MD5 42c72d838c34e4e7164c578a930b8fc7
- SHA1 82d02cb090eb6d81a1499189e4d3e6b82aa60061
- SHA512 1020d6010dca512adbc18f44b6453a974a200766013c39f6cb1cd0a72234a241c73587c929f1d0fcadf90c3eb71264086167f05bd7ebceb5b944f4e4a0811d92
- SSDEEP 192:jUWOhWiT71ojDBQABJj6nqnajLQvTP+8jIriNDG:wWOhWTDBRJWnlvQyUIrcG
- TLSH
  T172323CD2CB688442EC9B6E7002E9E6837D3D73961860455A05DBF59E3C973D6DB00B2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32