valleyrat_s2 | 1d0b8f081975cc9dfb542c8da5d173c3a68a23531e83f07e86ccc706e56d76f3

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B33A668328313F6843B1B8094BFAFFE3.exe
Size 4.1MB
Sample260804-1mnasahd35
SHA256 1d0b8f081975cc9dfb542c8da5d173c3a68a23531e83f07e86ccc706e56d76f3
MD5 b33a668328313f6843b1b8094bfaffe3
SHA1 9681a8e07a3f673e5fad0cd3fd844ed67422ee0d
SHA512 5441fa5095ec3ff480dc8b5ca59057561f26aab571810a986f22d944b9dbcb3c79e1c2285a6df76eb5f08814c7a92c9baf8398ae72320c374ee29a76d32e81ad
SSDEEP 98304:3rYNP16C0RSAqUcfQCS1bNmVnLLa4OHb5fO36rojDTg:bYF4CLAtp7pNmVnOO33jng
TLSH
T16A160213B28BE43EE05E0B370572A26494FBB7656127ED1697E0889CCF661502E3FB47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution valleyrat_s2 installer persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

47.86.2.244:557
47.86.2.244:558
127.0.0.1:80

Attributes

campaign_date
'Y#W726

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Executes dropped EXE 3 IoCs

pid	Process
5080	B33A668328313F6843B1B8094BFAFFE3.tmp
3816	LockAppHost.exe
1612	LockAppHost.exe

Loads dropped DLL 2 IoCs

pid	Process
3816	LockAppHost.exe
1612	LockAppHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsLockHost = "C:\\Users\\Admin\\AppData\\Local\\1s0o22zn94\\LockAppHost.exe"	LockAppHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	LockAppHost.exe
File opened (read-only)	\??\W:	LockAppHost.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\L:	LockAppHost.exe
File opened (read-only)	\??\P:	LockAppHost.exe
File opened (read-only)	\??\S:	LockAppHost.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\B:	LockAppHost.exe
File opened (read-only)	\??\M:	LockAppHost.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	LockAppHost.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\J:	LockAppHost.exe
File opened (read-only)	\??\O:	LockAppHost.exe
File opened (read-only)	\??\T:	LockAppHost.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Z:	LockAppHost.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	LockAppHost.exe
File opened (read-only)	\??\V:	LockAppHost.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	LockAppHost.exe
File opened (read-only)	\??\U:	LockAppHost.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\Y:	LockAppHost.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\Q:	LockAppHost.exe
File opened (read-only)	\??\S:	LockAppHost.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\M:	LockAppHost.exe
File opened (read-only)	\??\N:	LockAppHost.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	LockAppHost.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\D:	LockAppHost.exe
File opened (read-only)	\??\H:	LockAppHost.exe
File opened (read-only)	\??\N:	LockAppHost.exe
File opened (read-only)	\??\Y:	LockAppHost.exe
File opened (read-only)	\??\Z:	LockAppHost.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\H:	LockAppHost.exe
File opened (read-only)	\??\Q:	LockAppHost.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	LockAppHost.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	LockAppHost.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\V:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LockAppHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B33A668328313F6843B1B8094BFAFFE3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LockAppHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B33A668328313F6843B1B8094BFAFFE3.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1408-0-0x0000000000680000-0x000000000075F000-memory.dmp	innosetup
behavioral2/memory/1408-38-0x0000000000680000-0x000000000075F000-memory.dmp	innosetup

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	B33A668328313F6843B1B8094BFAFFE3.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{3ACC07E0-D93B-4A2A-8996-D2524A35BEE2}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	wmplayer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5844	schtasks.exe
5884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe
3816	LockAppHost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2604	unregmp2.exe
Token: SeCreatePagefilePrivilege	2604	unregmp2.exe
Token: SeShutdownPrivilege	5304	wmplayer.exe
Token: SeCreatePagefilePrivilege	5304	wmplayer.exe
Token: SeShutdownPrivilege	5304	wmplayer.exe
Token: SeCreatePagefilePrivilege	5304	wmplayer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5080	B33A668328313F6843B1B8094BFAFFE3.tmp
5304	wmplayer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3816	LockAppHost.exe
1612	LockAppHost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 5080	1408	B33A668328313F6843B1B8094BFAFFE3.exe	89
PID 5080 wrote to memory of 3816	5080	B33A668328313F6843B1B8094BFAFFE3.tmp	90
PID 3816 wrote to memory of 5844	3816	LockAppHost.exe	91
PID 5080 wrote to memory of 5304	5080	B33A668328313F6843B1B8094BFAFFE3.tmp	93
PID 5304 wrote to memory of 572	5304	wmplayer.exe	95
PID 572 wrote to memory of 2604	572	unregmp2.exe	96
PID 1612 wrote to memory of 5884	1612	LockAppHost.exe	98

C:\Users\Admin\AppData\Local\Temp\B33A668328313F6843B1B8094BFAFFE3.exe
"C:\Users\Admin\AppData\Local\Temp\B33A668328313F6843B1B8094BFAFFE3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\is-VCFN2.tmp\B33A668328313F6843B1B8094BFAFFE3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VCFN2.tmp\B33A668328313F6843B1B8094BFAFFE3.tmp" /SL5="$400B2,3355742,856064,C:\Users\Admin\AppData\Local\Temp\B33A668328313F6843B1B8094BFAFFE3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe
    "C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /tn "WindowsLockHost" /tr ""C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe"" /sc onlogon /rl highest
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5844
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\1s0o22zn94\decoy_8537230515.mp4"
    3⤵
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        5⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604

C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe
C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /tn "WindowsLockHost" /tr ""C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe"" /sc onlogon /rl highest
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LockAppHost.exe

Path C:\Users\Admin\AppData\Local\1s0o22zn94\LockAppHost.exe
Size 74KB
SHA256 65e0de657a7bd32aaf53239edecc608b1bf08ea0a6cfed58894993c437b83b15
MD5 425a5c140eb53e863b77513cf1b981fe
SHA1 944ecb6819c0060cb31a225c5663d954a48ddb69
SHA512 9e36e7b9ef3af51622ad3902824689330e877199ba7783f2a2b1fe9c48e56528b136568c8212c2838cb43de3614e70ec0a77f436cc86c881cb02a1d5ac06823a
SSDEEP 1536:o+4RQ8COb5ZhrGPSd1EOzag9M2KAGXU9FGtqx53zxx0132sP+dkzQn3:o+F8CuFtUazngU9F6qx53zn01GsLW3
TLSH
T15A736C63BB406471C6A238700A5AFA355BBEA3B04F2046D3175496F91DB23C35E3766F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockHostingFramework.dll

Path C:\Users\Admin\AppData\Local\1s0o22zn94\LockHostingFramework.dll
Size 236KB
SHA256 eb7b821d8201f6d4a2eabade84d8c42b2959a053543a24636db91c3cd2a53903
MD5 74823c388cacd26dc59db35362147aec
SHA1 d61be8941529795e715cb561eb0691f7e1aef8f6
SHA512 df846143e84709848bc2a02f1801be4b8137633efa5bf3dc7bb6170f2f548febdee74191935e63d2e5732d96fe1f2b35d10f98eaa4d94b50d75704610b7f8a81
SSDEEP 6144:9QqDIuzA/JUcrKuZFwLCmh4W/ck5+EUt+WjIJ:pe/J3euZFwLCmhAzW8U
TLSH
T11B34F89CF70B01B5F223A6B54D1ED7F7C72874158126AB77FF4BCA06B4B360A2851289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoy_8537230515.mp4

Path C:\Users\Admin\AppData\Local\1s0o22zn94\decoy_8537230515.mp4
Size 2.0MB
SHA256 2d0c314b6cde73bbc078502db57ea5027df10d21e83cd5199f8a27ec545c69a1
MD5 1cbbddcbb68b5f3f2d89fefefb3a0368
SHA1 c1b662225653fba3055f2dcb4f8bb346be8670d0
SHA512 949a422e389498e36271b205ab9bc1baa783c26c7b13b54bc9a97db1cc4d639729ad3a86d0eec6f42b0fb7b51996503b0ae2085908b0c50918cef701ab430832
SSDEEP 49152:iqReKHHYlLYTvffZ8g1oTkugCfCzVb0vEGC5mC3zU2ytdOS:iqRDH82ffZ8gFNBuduR3QvOS
TLSH
T1BD95332D2B323D0BD784033EEAB0630D6FD8F5A11BE3C4A78355C6C91D582456AA79F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.dll

Path C:\Users\Admin\AppData\Local\1s0o22zn94\msiexec.dll
Size 4KB
SHA256 053bb457d695fb3af6864a1fb7cafc9f6aa2e780872a6058a5234171ad6da3a2
MD5 e65a6097d4ab0db01d5192afbc73124c
SHA1 42c1b2939d964310443144347ce0b5706e0786a9
SHA512 089a983617bc4aea18a18a95549d3135e0005a174a4dce08177a35c2f0ac52093dddc964f45710f5901902b03222d224e6aff6261435e3a184e7445fff1f11db
SSDEEP 96:YLgWgx6VzAENmAsbgiMVavEL6+VOxr2sjpZo+iO9aj:Y0WgOszAsbgi5p8+iOo
TLSH
T11591421562417A7A36DFC706A511722AC9186E107B42304E9FF642EE3F5FBF24B790D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbem.dll

Path C:\Users\Admin\AppData\Local\1s0o22zn94\wbem.dll
Size 4KB
SHA256 ed72873639c4d756b3da17e9e6d2f7c9e9c27daca6d0e474ccdc3242b5958430
MD5 31cdd9b41558f319154033d11adcf26a
SHA1 ed0addd48b91a8aa928bb861d06c75f9cd0836b4
SHA512 10ec3872cc599cfcffcbb3e2d812123bb17f3377a7cf63afc715a93d213992835ac7453b766be9a5ae9979aadad1af85237a615c9ec5c36207bb6e9f640364be
SSDEEP 96:YLgWgx6VzAENmAsbgiMVavEL6+VOxr2sjpZo+iO9vqj:Y0WgOszAsbgi5p8+iOA
TLSH
T10F91422561417A7936DFCB56A911662AC9286E107A41300A9FF281EF3F5FBF24B340D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 fb54b902455c0514eadd4d9164d6a80d83f3e9e00d515c48692095c4c92c43c9
MD5 c78168f829e4d6e7de5e91dd7074bf42
SHA1 43e44f7383bc07619ba44b8da18bb38da60f45a2
SHA512 a137616fcdffb4dd4edfed2685c461e019becfc2caa9787b77da07de55f400017427f8c205c1a07d9e00987b050514114b247c980b2af5a85d2ad83128a907fa
SSDEEP 768:10aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbai:zZP2tFP3vqY8NqEMJTaBacg
TLSH
T12D257437D190B0C5CE2CB171E9ED8F09BA63A10B11A052465FF8A57E7A533D98D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 384KB
SHA256 3f508c488624502aeea2cce22e6d9f05b64404915175018dc30b7cf255e73b24
MD5 9195efde611b14e970e427db808ad635
SHA1 8e1b34021ac414fcc0bdcc834bd31ef60c209a40
SHA512 a826de1fcbeb4cf7f3e4f5f1b5a5b37c91aee461bcb6160dafd2e55ff163533b3d09e51f08b09f3ef29d8ef3ca9766f8f3206d6dd15331ec397e44e2379b294b
SSDEEP 768:Df0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt35:D69tQeoVYo
TLSH
T1D4843037E5A0A084DF3C7171E2AC1F4CBE72650B11E406425FB4B57EBA237D58A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 7ee62e1924a5360e3504be16d380a92b237e4bd233584e3598184322f3275d94
MD5 004d22f3c5c0ec1f5cd6abb1300911e4
SHA1 afe0bedf97fc55f43275fe6a6985d7c5ded08190
SHA512 ca026fae7f0b9ef7900f6591f849e2bb484aa455861fe8d19223b58c69105ef04bb5c5f8231a3ba77b59dca5fac0edd841fc1a4c7d1c071dd086db2c6000f598
SSDEEP 96:tUUx1rIQJltWNXtjUMUstr7XtAUMbst3UMlstAOXt5L2teLXtqt1AtTt:tUUx1rLaninyn6
TLSH
T1AF63A0916AE44A5AF3F76EB5BBFA95172E3A78A15E35D04C0214424D09A0F3CDE30F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B33A668328313F6843B1B8094BFAFFE3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VCFN2.tmp\B33A668328313F6843B1B8094BFAFFE3.tmp
Size 3.3MB
SHA256 428e468a88ab32c81eee58edbdb4250b6bd3d619a7e82b9faa39cfe188d29357
MD5 d17f80fc40b08279755ceb97d05935ac
SHA1 11d43aa053d51b9bab7c0143f8c897cd6043ddc1
SHA512 96d1441a09aa102b433be7ea396c0e613ce4ae9e610a00e46033dea65a592e9eb9730db4ab7a3da6816dc2196d8282e19bffbd4d21808771dcdcbfcb0bf98b64
SSDEEP 49152:LuAKxvISKItheRQSJ3MhjxImhEzAW308A3oWtKFz0ool5+UKLc333Sz:LuAK64MmhKAWHooWJx333Q
TLSH
T1D6F56C23F34D603EF06B1A3A9D379658583B76606616CC5797FC3A4C8F361802E2A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 76d06df9445e86ed742c713abe97e4268c86c1e1d027513c3eadc0430df5f4d4
MD5 c2d6dd337f48de64cb1690f2c710139d
SHA1 ff732c585767ea023194dabc78e7fc41327ffb6b
SHA512 6522317982797581a120bfc4511fa9330c104e79b853ff7ffe1580bdf7f28d4e32a8195d3701b0be6f339ad32d936097120b7a83e5b01132ac4dd8aba269e0bb
TLSH
T167219C574A0AE4B4CD6283B359CC8A2773BAB7CA5754D015738AA02E880113F233D17D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-38-0x0000000000680000-0x000000000075F000-memory.dmp

Download

memory/1408-0-0x0000000000680000-0x000000000075F000-memory.dmp

Download

memory/1612-96-0x0000000002810000-0x000000000282C000-memory.dmp

Download

memory/1612-113-0x0000000073B10000-0x0000000073B52000-memory.dmp

Download

memory/1612-101-0x0000000002F80000-0x0000000002FDA000-memory.dmp

Download

memory/1612-100-0x0000000002F80000-0x0000000002FDA000-memory.dmp

Download

memory/1612-111-0x0000000002810000-0x000000000282C000-memory.dmp

Download

memory/1612-102-0x0000000002F80000-0x0000000002FDA000-memory.dmp

Download

memory/1612-110-0x0000000002810000-0x000000000282C000-memory.dmp

Download

memory/1612-97-0x0000000002F80000-0x0000000002FDA000-memory.dmp

Download

memory/1612-78-0x0000000002810000-0x000000000282C000-memory.dmp

Download

memory/1612-80-0x0000000002810000-0x000000000282C000-memory.dmp

Download

memory/1612-79-0x0000000002810000-0x000000000282C000-memory.dmp

Download

memory/1612-98-0x0000000002F80000-0x0000000002FDA000-memory.dmp

Download

memory/3816-76-0x0000000003020000-0x000000000303C000-memory.dmp

Download

memory/3816-112-0x0000000073B10000-0x0000000073B52000-memory.dmp

Download

memory/3816-108-0x0000000003020000-0x000000000303C000-memory.dmp

Download

memory/3816-89-0x0000000003020000-0x000000000303C000-memory.dmp

Download

memory/3816-91-0x00000000037A0000-0x00000000037FA000-memory.dmp

Download

memory/3816-92-0x00000000037A0000-0x00000000037FA000-memory.dmp

Download

memory/3816-93-0x00000000037A0000-0x00000000037FA000-memory.dmp

Download

memory/3816-94-0x00000000037A0000-0x00000000037FA000-memory.dmp

Download

memory/3816-109-0x0000000003020000-0x000000000303C000-memory.dmp

Download

memory/3816-30-0x0000000002E10000-0x0000000002E12000-memory.dmp

Download

memory/3816-77-0x0000000003020000-0x000000000303C000-memory.dmp

Download

memory/3816-99-0x00000000037A0000-0x00000000037FA000-memory.dmp

Download

memory/3816-63-0x0000000002F90000-0x0000000003011000-memory.dmp

Download

memory/3816-62-0x0000000003020000-0x000000000303C000-memory.dmp

Download

memory/3816-32-0x0000000002ED0000-0x0000000002ED2000-memory.dmp

Download

memory/5080-9-0x0000000004200000-0x0000000004340000-memory.dmp

Download

memory/5080-37-0x00000000008E0000-0x0000000000C47000-memory.dmp

Download

memory/5080-8-0x0000000004200000-0x0000000004340000-memory.dmp

Download

memory/5080-6-0x0000000003160000-0x0000000003161000-memory.dmp

Download

memory/5304-118-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download

memory/5304-127-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-106-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-103-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-104-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-84-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-87-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-85-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-86-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-119-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-120-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-122-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-123-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-124-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download

memory/5304-126-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-125-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-128-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-105-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Download

memory/5304-129-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download

memory/5304-132-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-131-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-133-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-134-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-135-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download

memory/5304-136-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-137-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-138-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-139-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-140-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download

memory/5304-141-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-142-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-144-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-145-0x000000000A7A0000-0x000000000A7B0000-memory.dmp

Download

memory/5304-146-0x000000000A9E0000-0x000000000A9F0000-memory.dmp

Download