valleyrat_s2 | fcf7ae64cea20b27c4a43eee73d479efbefd69bad81e4daa716fdc7800352550

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 19.9MB
Sample261012-sxpmlaf18l
SHA256 fcf7ae64cea20b27c4a43eee73d479efbefd69bad81e4daa716fdc7800352550
MD5 971868173bf1c942c55af67f9166ee27
SHA1 e042eedc833a945e7ceb6c4b30a97d76a8b0778c
SHA512 fc30fa60baee9a12e6e29928e3f315330ed1634111c31d47577d22a805dd163559a97f32754eb7fcfca9f4f75005f64ac387a75b5d22faff80c034dfbdb44c81
SSDEEP 393216:1QcRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR2RRRRRRRRRRRRRRRRRRRRRRRRRRRRx:OI
TLSH
T1ED27F10156A604F0D7C1CDB48E276A9BD27E786BAE2B125B8316DB573F333C9882571C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

ccuukkbb.top:443
134.122.204.10:443
127.0.0.1:80

Attributes

campaign_date
2026. 9.14

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Executes dropped EXE 3 IoCs

pid	Process
3856	SafeCenterController.exe
2312	Windows_system_deponcom.exe
3388	Battle.net.exe

Loads dropped DLL 1 IoCs

pid	Process
5032	taskmgr.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3400	powershell.exe

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4524	tasklist.exe
1312	tasklist.exe
608	tasklist.exe
4164	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SecurityProviderCore.log	taskmgr.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5552	cmd.exe
2456	cmd.exe
3424	cmd.exe
2648	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Battle.net.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Battle.net.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows_system_deponcom.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3856	SafeCenterController.exe
3856	SafeCenterController.exe
3400	powershell.exe
3400	powershell.exe
3400	powershell.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3388	Battle.net.exe
3388	Battle.net.exe
3388	Battle.net.exe
3388	Battle.net.exe
3388	Battle.net.exe
3388	Battle.net.exe
3388	Battle.net.exe
3388	Battle.net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1216	svchost.exe
Token: SeTakeOwnershipPrivilege	1216	svchost.exe
Token: SeTakeOwnershipPrivilege	1216	svchost.exe
Token: SeDebugPrivilege	1312	tasklist.exe
Token: SeTcbPrivilege	1216	svchost.exe
Token: SeTakeOwnershipPrivilege	1216	svchost.exe
Token: SeTakeOwnershipPrivilege	1216	svchost.exe
Token: SeTakeOwnershipPrivilege	1216	svchost.exe
Token: SeDebugPrivilege	608	tasklist.exe
Token: SeTcbPrivilege	1216	svchost.exe
Token: SeTcbPrivilege	1216	svchost.exe
Token: SeTcbPrivilege	1216	svchost.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe
Token: SeBackupPrivilege	3400	powershell.exe
Token: SeRestorePrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeSystemEnvironmentPrivilege	3400	powershell.exe
Token: SeRemoteShutdownPrivilege	3400	powershell.exe
Token: SeUndockPrivilege	3400	powershell.exe
Token: SeManageVolumePrivilege	3400	powershell.exe
Token: 33	3400	powershell.exe
Token: 34	3400	powershell.exe
Token: 35	3400	powershell.exe
Token: 36	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe
Token: SeBackupPrivilege	3400	powershell.exe
Token: SeRestorePrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeSystemEnvironmentPrivilege	3400	powershell.exe
Token: SeRemoteShutdownPrivilege	3400	powershell.exe
Token: SeUndockPrivilege	3400	powershell.exe
Token: SeManageVolumePrivilege	3400	powershell.exe
Token: 33	3400	powershell.exe
Token: 34	3400	powershell.exe
Token: 35	3400	powershell.exe
Token: 36	3400	powershell.exe
Token: SeIncreaseQuotaPrivilege	3400	powershell.exe
Token: SeSecurityPrivilege	3400	powershell.exe
Token: SeTakeOwnershipPrivilege	3400	powershell.exe
Token: SeLoadDriverPrivilege	3400	powershell.exe
Token: SeSystemProfilePrivilege	3400	powershell.exe
Token: SeSystemtimePrivilege	3400	powershell.exe
Token: SeProfSingleProcessPrivilege	3400	powershell.exe
Token: SeIncBasePriorityPrivilege	3400	powershell.exe
Token: SeCreatePagefilePrivilege	3400	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3388	Battle.net.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5552	4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 5552 wrote to memory of 1312	5552	cmd.exe	92
PID 4704 wrote to memory of 2456	4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	96
PID 2456 wrote to memory of 608	2456	cmd.exe	98
PID 3856 wrote to memory of 5032	3856	SafeCenterController.exe	100
PID 4704 wrote to memory of 3400	4704	2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 3400 wrote to memory of 3240	3400	powershell.exe	104
PID 2312 wrote to memory of 3388	2312	Windows_system_deponcom.exe	106
PID 3388 wrote to memory of 3424	3388	Battle.net.exe	108
PID 3424 wrote to memory of 4164	3424	cmd.exe	110
PID 3388 wrote to memory of 2648	3388	Battle.net.exe	112
PID 2648 wrote to memory of 4524	2648	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_971868173bf1c942c55af67f9166ee27_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /fi "imagename eq 360Tray.exe" /fo csv /nh
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq 360Tray.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c tasklist /fi "imagename eq 360sd.exe" /fo csv /nh
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq 360sd.exe" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$action = New-ScheduledTaskAction -Execute '"C:\config\Windows_system_deponcom.exe"' -WorkingDirectory 'C:\'; $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $trigger.Repetition = (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 1)).Repetition; $settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -DontStopOnIdleEnd -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; $principal = New-ScheduledTaskPrincipal -UserId (whoami) -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -TaskName 'WindowsSafe' -TaskPath '\Microsoft\' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe"
    3⤵
    PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:4624

C:\config\SafeCenterController.exe
C:\config\SafeCenterController.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\system32\taskmgr.exe
  taskmgr.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:5032

C:\config\Windows_system_deponcom.exe
"C:\config\Windows_system_deponcom.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\config\Battle.net.exe
  "C:\config\Battle.net.exe" --from-launcher
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c tasklist /fi "imagename eq 360Tray.exe" /fo csv /nh
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq 360Tray.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:4164
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c tasklist /fi "imagename eq 360sd.exe" /fo csv /nh
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq 360sd.exe" /fo csv /nh
      4⤵
      Discovers running processes
      PID:4524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecurityProviderCore.dll

Path C:\ProgramData\SecurityCenter\Runtime\SecurityProviderCore.dll
Size 319KB
SHA256 f5449806ad50242a4df9186455434b5957f3fc2044d85a9f1d9135a542b678cc
MD5 e50f8a686d5b07fc45c12362147305ad
SHA1 8f3218a0915c75d331c277be1aa46bbd5a2c84d9
SHA512 72e04e213b2a304f0e3f52212ba8a2c3b846644195e473f71e08b80cb271ff94d47bf3d577fe348fdc7ee04cfc85426f38822ca501d6a94e730917f59afa49cc
SSDEEP 3072:qM4XOn1G5jX6rr4M2kt9ZQd83AVGzcyeLZdSCr4oJ9073BND7UGM9ctUscfr27+:3c7er4Mr0836Gzc1PXJT6+fr2BbLs/s
TLSH
T176647C16F7A510B9D167857CCD938A06EBF2BC5207A0E6CF03A04A967F277D05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntuser.pol

Path C:\ProgramData\ntuser.pol
Size 4KB
SHA256 453672c9a697215a54144a944be080a7f0c0a1b2105f91d9a64583d842d8c0ed
MD5 329ef71d9de7fce865aa6580ef4bcb2c
SHA1 10027b12f7c1352787dea4856452274722dd6ae0
SHA512 a7cd83ebd88efba6a3bb1dd1fc059d8de2f50cff3fbf877acb9c9d424d4532aee865c0057d9d5f2be20397b87453ce86a1398bcd2499b4858ecff03f7bb89553
SSDEEP 96:yIoa4gJrlj/3GVdocgdo1doXljdokdobdoaVtgmsljZ43VXgkeljQ6dVEgtvljs3:x1JrB/3KSJS1SXBSkSbSGimsBZ4Fwkew
TLSH
T161A1DB010BF55A19FBFB0D3658336AA9293B75612E14EC4E101C468E88B7E25CF3372B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntuser_202610121530480211.pol

Path C:\ProgramData\ntuser_202610121530480211.pol
Size 6KB
SHA256 e3f08f78d3eaf9733348a508109018dbcf1470de6f4ccf7b407697ed008a9264
MD5 b07f754e3003105dfcb8332f90570b1e
SHA1 a6dabdd37e4b0ccc3dfae6cb3b95ef6f242e0185
SHA512 0c19cb1c0b4cfe412071a6ca7d79cc6abdfdb5b8636ba18410a6643ed3bd5c645dfc80edddd63d95eb1e968f18f1d738e6a9e1c8294031f906e6c3dfa4fcc8e9
SSDEEP 192:x1JrB/3KvDxBBVtw6OUBfgdSJS1SXBSkSbSGimsBZ4FwkeBQ6HxtvBsT7:x1JN/3KvDnDtw6O6fgd0A0ZejimSZ4Ff
TLSH
T115D1D8111BF51B19FBFB4D365833AAA9293B75516E14EC4E101C468E88B6E25CF3332B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntuser_202610121532320065.pol

Path C:\ProgramData\ntuser_202610121532320065.pol
Size 8KB
SHA256 80de62cc3e799b0a3c89257e106b5fbfa120d04e66e4e6df5e85189149bf1c64
MD5 c521d0b94cccd673de094ca15de6387a
SHA1 bddee39e650a5ede1af19bbb44c9aa0ca47f3f25
SHA512 6601f305f43f9032b3ea90ece3c395ef07edbae9f0bfcb7d0be626c4f0a797b7eeadc5508860db749c0ea03328e864c1dfeb34c710b8af5bedbec4dfa26ba493
SSDEEP 192:x1JrB/3KbXFBh5k6OUB3gd2SYBLsRvDxBBVtw6OUBfgdSJS1SXBSkSbSGimsBZ41:x1JN/3KbXzh5k6O63gd2SGLsRvDnDtwV
TLSH
T1D312D8111BF51A15FBFB4D3668336AA9393B75612A14EC4E101C468E88B6E65CF3332B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntuser_202610121532320467.pol

Path C:\ProgramData\ntuser_202610121532320467.pol
Size 12KB
SHA256 63d6aef418070e090a2edfd5a5a0b067f8e6c93ec4367fcd670733b069f632fb
MD5 64c0cfc3c7bda38bbe6c833c0d7bdff0
SHA1 3d5f80f4da6f56905962500892f5a4b676c4eb7e
SHA512 6119126690a3973194d03aea98ae9c3ec0671a959793da9db20e06926932a9dc2b0150142c96afa274b50feb8a0a4c5b4122f31e877393e23a07191fa4cd6956
SSDEEP 384:x1JN/3KbXzh5k6O63gdUgUv+D2SGLsRvDnDtwbXzu5kSWC2oV6O6fgd0A0ZejimW:x1JN/3KbXzh5k6O63gdUgUv+D2SGLsRW
TLSH
T12642D8111BF51B15FBFB4D3658376AA9393B75612A18EC4E101C468E88B6E25CF3332B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c5dl1y2t.wgc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c5dl1y2t.wgc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Battle.net.exe

Path C:\config\Battle.net.exe
Size 19.9MB
SHA256 fcf7ae64cea20b27c4a43eee73d479efbefd69bad81e4daa716fdc7800352550
MD5 971868173bf1c942c55af67f9166ee27
SHA1 e042eedc833a945e7ceb6c4b30a97d76a8b0778c
SHA512 fc30fa60baee9a12e6e29928e3f315330ed1634111c31d47577d22a805dd163559a97f32754eb7fcfca9f4f75005f64ac387a75b5d22faff80c034dfbdb44c81
SSDEEP 393216:1QcRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR2RRRRRRRRRRRRRRRRRRRRRRRRRRRRx:OI
TLSH
T1ED27F10156A604F0D7C1CDB48E276A9BD27E786BAE2B125B8316DB573F333C9882571C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeCenterController.exe

Path C:\config\SafeCenterController.exe
Size 808KB
SHA256 6d84522d28f20e343086f3a44588ae24aaeb509b53e4a9a81cd425c075972839
MD5 e7feaad582f40103d2e44665ea43cf0d
SHA1 e24b41279ac7b7d2e46cf65bb27dd6b34d30f8be
SHA512 c38901da0d7f06211c67fbfd21a0594666e0016cbb2326c95e853da0090d42c8a6d0259754c9179526c84d28d7476e2bca990141afcc347a12753eaff3244b43
SSDEEP 12288:itTozGGMQwTXgl+yKQdVI0eUMrF7clh6+fr2tLIuDs:itT2ELgl+/QLIZFZAl/z2tLJD
TLSH
T19E056C1EE6AD00FAD1B7D178C9835506FBB1B856136097CF43A14A9A2F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows_system_deponcom.exe

Path C:\config\Windows_system_deponcom.exe
Size 211KB
SHA256 a899063db35e45811a62c7abc8e63f8a2bc91253c1a875899a7bec8bff924e49
MD5 6e594a497f0518922ab98e157da1c422
SHA1 6e8729375d2fb6bfa177c1d61920fe16b398b93d
SHA512 e9d6de0974701032cc8b58afa3516c7e0dddaffa14560420d467ded447dbc0a7aa723bfd7145c7b0ec1a749a707965fc65cbcfc4fc7a292b072866b69276e21d
SSDEEP 3072:ZPD7f0dqA6DPpTBuBDYQ1nvK418T93Lg5tD9l7I:ZOqZp790tD9ls
TLSH
T1ED242AD235C19860E56A073014B4FA7C8A3AFCE51B50C9AB7F84736ECE335D0DA3569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3400-21-0x0000020C7BFD0000-0x0000020C7BFF2000-memory.dmp

Download

memory/3400-24-0x0000020C7C060000-0x0000020C7C07E000-memory.dmp

Download

memory/3400-25-0x0000020C7C2D0000-0x0000020C7C382000-memory.dmp

Download

memory/3400-26-0x0000020C7C050000-0x0000020C7C05A000-memory.dmp

Download

memory/3400-27-0x0000020C7C0A0000-0x0000020C7C0BE000-memory.dmp

Download

memory/4704-17-0x000001F659030000-0x000001F6590A2000-memory.dmp

Download