Overview
overview
10Static
static
320260915.8...DA.exe
windows10-2004-x64
1020260915.8...DA.exe
windows11-ltsc_2024-x64
10calibre-launcher.dll
windows10-2004-x64
10calibre-launcher.dll
windows11-ltsc_2024-x64
10msvcp120.dll
windows10-2004-x64
1msvcp120.dll
windows11-ltsc_2024-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1msvcp140_1.dll
windows10-2004-x64
1msvcp140_1.dll
windows11-ltsc_2024-x64
1msvcp140_2.dll
windows10-2004-x64
1msvcp140_2.dll
windows11-ltsc_2024-x64
1msvcr120.dll
windows10-2004-x64
1msvcr120.dll
windows11-ltsc_2024-x64
1vccorlib120.dll
windows10-2004-x64
1vccorlib120.dll
windows11-ltsc_2024-x64
1vccorlib140.dll
windows10-2004-x64
1vccorlib140.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
300s - max time network
293s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20260915.80521125.EDF026321CDA.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
20260915.80521125.EDF026321CDA.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
300 seconds
Behavioral task
behavioral3
Sample
calibre-launcher.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
300 seconds
Behavioral task
behavioral4
Sample
calibre-launcher.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
300 seconds
Behavioral task
behavioral5
Sample
msvcp120.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
msvcp120.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
msvcp140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
msvcp140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
msvcp140_1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
msvcp140_1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
msvcp140_2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
msvcp140_2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
msvcr120.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
msvcr120.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
vccorlib120.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
vccorlib120.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
vccorlib140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
vccorlib140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
vcruntime140_1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target 20260915.80521125.EDF026321CDA.exe
- Size 35KB
- Sample260916-ltdmlaycnf
- SHA256 b92632bdc48ba876cb7bbbda4348eac771fc5a450f4b4f3afa09b2efcedd79f6
- MD5 162262bed55ed7282dad1277936716d5
- SHA1 b50d2e594e6a9999970d4bb47e40fdd92d344e3d
- SHA512 8df774adc17ec97055570e7a7b188a8ebfb89eb58e657beb2df043f5cdeb14592f2c4b88c2b87c6d16a09568567290e9b3c121bdc974b0a6f446983b1ca3a792
- SSDEEP 384:a1LkkX41705BjYjLq91cpUokGkrmf0aGa4rsHDgvKvCy8RbmL4nNy7hFjO:wfS44UokhrO0aGa/8v/5ALTFq
- TLSH T116F2A5F24618090AE89BBA7DB497F93D54347D21AE83D2AD71E8DC333D3A78269C7105
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
156.251.18.127:449
-
156.251.18.127:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 8 IoCs
resource yara_rule behavioral1/memory/5108-67-0x0000012B97180000-0x0000012B971D0000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/5108-70-0x0000012B97180000-0x0000012B971D0000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/5108-69-0x0000012B97180000-0x0000012B971D0000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3456-76-0x000001B36B8D0000-0x000001B36B920000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3456-77-0x000001B36B8D0000-0x000001B36B920000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3456-78-0x000001B36B8D0000-0x000001B36B920000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3456-909-0x000001B36B8D0000-0x000001B36B920000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/3456-954-0x000001B36B8D0000-0x000001B36B920000-memory.dmp family_valleyrat_stage_2_v2 - UAC bypass 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 20260915.80521125.EDF026321CDA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 20260915.80521125.EDF026321CDA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceController = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " Loader.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Loader.exe File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\V: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\K: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\E: Loader.exe File opened (read-only) \??\G: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\G: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\Z: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\S: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\I: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\V: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\E: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\I: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\Y: Loader.exe File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\O: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\N: Loader.exe File opened (read-only) \??\O: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\Y: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\Z: Loader.exe File opened (read-only) \??\S: Loader.exe File opened (read-only) \??\N: Loader.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 7 IoCs
pid Process 2824 ~tmp_48846.tmp 5108 Loader.exe 216 ~tmp_86000.tmp 3456 Loader.exe 2872 ~tmp_88604.tmp 4912 ~tmp_44594.tmp 1972 ~tmp_34666.tmp - Loads dropped DLL 9 IoCs
pid Process 5108 Loader.exe 5108 Loader.exe 5108 Loader.exe 5108 Loader.exe 5108 Loader.exe 3456 Loader.exe 3456 Loader.exe 3456 Loader.exe 3456 Loader.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{9A80B534-FD71-476B-B062-A5B4C3EEFC10}\Shell\Manage\command 20260915.80521125.EDF026321CDA.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID 20260915.80521125.EDF026321CDA.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{9A80B534-FD71-476B-B062-A5B4C3EEFC10} 20260915.80521125.EDF026321CDA.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{9A80B534-FD71-476B-B062-A5B4C3EEFC10}\Shell 20260915.80521125.EDF026321CDA.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{9A80B534-FD71-476B-B062-A5B4C3EEFC10}\Shell\Manage 20260915.80521125.EDF026321CDA.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{9A80B534-FD71-476B-B062-A5B4C3EEFC10}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " 20260915.80521125.EDF026321CDA.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 408 20260915.80521125.EDF026321CDA.exe 5108 Loader.exe 3456 Loader.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 408 20260915.80521125.EDF026321CDA.exe 5108 Loader.exe 3456 Loader.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 408 wrote to memory of 1564 408 20260915.80521125.EDF026321CDA.exe 91 PID 2024 wrote to memory of 5108 2024 explorer.exe 93 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 20260915.80521125.EDF026321CDA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 20260915.80521125.EDF026321CDA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20260915.80521125.EDF026321CDA.exe"C:\Users\Admin\AppData\Local\Temp\20260915.80521125.EDF026321CDA.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:408 -
C:\Windows\explorer.exeexplorer.exe shell:::{9A80B534-FD71-476B-B062-A5B4C3EEFC10}2⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_48846.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_48846.tmp1⤵
- Executes dropped EXE
PID:2824
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Adds Run key to start application
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_86000.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_86000.tmp1⤵
- Executes dropped EXE
PID:216
-
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"1⤵
- UAC bypass
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:3456
-
C:\Users\Admin\AppData\Local\Temp\~tmp_88604.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_88604.tmp1⤵
- Executes dropped EXE
PID:2872
-
C:\Users\Admin\AppData\Local\Temp\~tmp_44594.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_44594.tmp1⤵
- Executes dropped EXE
PID:4912
-
C:\Users\Admin\AppData\Local\Temp\~tmp_34666.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_34666.tmp1⤵
- Executes dropped EXE
PID:1972
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\OpenraVPN\Loader.exe
- Size 35KB
- SHA256 b92632bdc48ba876cb7bbbda4348eac771fc5a450f4b4f3afa09b2efcedd79f6
- MD5 162262bed55ed7282dad1277936716d5
- SHA1 b50d2e594e6a9999970d4bb47e40fdd92d344e3d
- SHA512 8df774adc17ec97055570e7a7b188a8ebfb89eb58e657beb2df043f5cdeb14592f2c4b88c2b87c6d16a09568567290e9b3c121bdc974b0a6f446983b1ca3a792
- SSDEEP 384:a1LkkX41705BjYjLq91cpUokGkrmf0aGa4rsHDgvKvCy8RbmL4nNy7hFjO:wfS44UokhrO0aGa/8v/5ALTFq
- TLSH T116F2A5F24618090AE89BBA7DB497F93D54347D21AE83D2AD71E8DC333D3A78269C7105
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\MSVCP140.dll
- Size 620KB
- SHA256 76c9060fd749d837c92b716a91a190b038f2c03e46da124a36f88075361a9be5
- MD5 ab15feb56d735f4589217d02464b1a06
- SHA1 1362b65006aad34031e51ab005ea54b7337c734a
- SHA512 031a85e5f6973d473641cb84668a3923682b9ab92958a23b3a68f2fb2ccfc79ae0982c7cdef1a28bdfad486c0b411c9eee40188cec6724099e68fa3a2a2543bd
- SSDEEP 12288:CKud5zgdkWhgdq/fazwEQ96d2GYGyQEKZm+jWodEEVmHT:0KqzwEQ9+2D9QEKZm+jWodEE0z
- TLSH T196D41923EB590AA0D091D3B851874742E7F1BC158B21EBC752EBE26D2F277C5A23B750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\VCRUNTIME140.dll
- Size 83KB
- SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
- MD5 0c583614eb8ffb4c8c2d9e9880220f1d
- SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
- SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
- SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
- TLSH T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\_Bottom.dat
- Size 35KB
- SHA256 c5d9b6e889ac776410b9e70930bc12afa202843d8ec2aa971204c416a3251c76
- MD5 79483a9f07969ab33e5ecbe12b29d769
- SHA1 64a09342152fe750082abac628e6bc94cae0202f
- SHA512 48c1d86e99691877b2ab6ecc4c684151689273c382a8919a443f7c90e9acfb5e53f816a1f53b9ec24794135ce1a7520b9cec9097ca6bf1f6f0a74699e645f08b
- SSDEEP 192:FeOKWCNEMIHSya1GIWobDdYgo/l7w+7w9Q+avOVigD482B1jcpTmKBK/UVJJT1Wc:QglNjAtoW+bvOecpqyXWCEEM90MG0C
- TLSH T17EF2B5748790832F5753221D542989CBE2A29728E3F271683FC7684F18BD8F3961DD6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\_Driver.cnf
- Size 144KB
- SHA256 51d8b26a76c165de9aa855dd1945c976afdc99a30a9d46bdc6ecebecc17dab8c
- MD5 2fee59648fc8e854c7c06bc1e9a5889a
- SHA1 fca7b17bb72fac0e9e9e2a1a26f0b59534d5509e
- SHA512 737c562354bf7fc07300c65dac24f4c7dea12abc987011477d4b410d455869d1a0976e82e5f7981622f4904f7f1e25bf15c6251023af32302a53b7ea906f62aa
- SSDEEP 3072:qInX8ZIf12XeFO4/sMDkrTqXC0Cwvb+ClIq0bCKbC/wvNLwv/NyTuD5uVufDRbCR:P1Fz/sohfD+zqYvVV03YTe5u4bhaauqQ
- TLSH T11FE3A6277C9B190A3F0A3363AB93F8596973CEB56FD0BEC8508B50E960997171D809C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\_Top.dat
- Size 453KB
- SHA256 42f21f4389db441c9b57b765320ba628673bd9856002bb20f0359bfd783d48a9
- MD5 b3f9cede4d9f8a731fd0692628eff2aa
- SHA1 b9836eb17dcbc47fb62b3b7f2cc99b9bd074d6c5
- SHA512 133fd48849e696531fdddb26fa9c9b315eb17cbf1720f45911718e66516f7668b63653795d72d58cdccd7e126de261988bf7a908b19ef46d95d338df0075c3b1
- SSDEEP 6144:VDMSTEXUiscf77mIjrqzMDhYhpp5vcIiAOaSzcchtHC48:uvscf77mIflDW15vcIZOaSx8
- TLSH T1DFA43E2C8B50876F8787100E542986EBE222A759D3FA72587FC7280F68EE5F3550ED1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\calibre-launcher.dll
- Size 156KB
- SHA256 7de1a0910a7aec98e5c3fc81432d692aff2086c94c71d5d44720c076d6dc6d65
- MD5 9603fd9e9f55de4ca86d366329cbe880
- SHA1 075216daf9afd7045bdc36fd9b19f89f1ecd15af
- SHA512 7da9b6510f469964a0fd87134fe78bf4f870fc0b2743b16e8955021ec521762c83a66380e50ef6fea14874e3fb0fb0e5dd6cdfce771dd52f17756cba2e7c14f2
- SSDEEP 3072:neDws0VkGR9I/MuA5OFVqfLHgmnk2CZev9+s/x:neDJ0VkY9Sw2qfLHK2CZo9+s/x
- TLSH T1B1F3F84723F80465F2F76779ADB61502EE72BD860731D34F0290A26E0F66F90BD66722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\vcruntime140_1.dll
- Size 36KB
- SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
- MD5 7667b0883de4667ec87c3b75bed84d84
- SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
- SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
- SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
- TLSH T172F24A8167788096E46B95B0C4A35F27FB38F9616750938F0BA4825D2F637D0F63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~tmp_48846.tmp
- Size 54KB
- SHA256 81372e638dc556b777e74d924afe3ddff620c7d21fbac0eb5857103825cf7093
- MD5 2c1a1a8b4d0f6ce2f4364d03f672026f
- SHA1 eda732c296834648e08ab17ab7a8e7c39301b6ef
- SHA512 659ac85207d6c4ff3bc6c92e793b10f0ea7579eed19ff87ce730595e54cd370f3051eff6975a9fe4b8c6a65ca474e7d8cfaab473695df0b184a13c5d8b98dc83
- SSDEEP 768:csQDxKVp5f5fLFbXH3wN0ynlbLFcewnBpvwzLOdNqc8ocNe+ScV8D:csUoVpTF8N1l9cewnrwOWc8ocNecV8D
- TLSH T1AB43388357A918C5FAB79EB8D1B89927EDB2F6951F50D4CF116080490E33BD0EE3821B
- MD5 SHA1 SHA512 SSDEEP TLSH