valleyrat_s2 | 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20261027.22367819.C8A41F9D8851.exe
Size 343KB
Sample261027-xd9kwaec66
SHA256 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596
MD5 a8c9c91d9f556ddc4c3dee2e7af7c140
SHA1 05cd34af731e5f29a9fe5b7950c25450a893b20e
SHA512 3aace6b6ac91b50bff730a2a01c1c1fc7ee50b932d1464b82ff2b3ea265b033c5b67067a92f1968dd56f619a22f0ab75ad28311a6c0ce73a352a03f3120472fc
SSDEEP 6144:yheV9dmppO7+6q4XZ5iNmlRO2Wst9t+jX:yh6h+KTDRWsntu
TLSH
T1CF743C933B5A1C96F897C0394657BE02EB727C990312C6DBA360B55A5F3B6E03D78E10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence spyware trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

204.194.49.108:21107

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	20261027.22367819.C8A41F9D8851.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	20261027.22367819.C8A41F9D8851.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iServiceController = "\"C:\\ProgramData\\MicroPoint\\WinCombo.exe\" "	WinCombo.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes dropped EXE 3 IoCs

pid	Process
4184	Security_Module.dat
1328	WinCombo.exe
1300	WinCombo.exe

Loads dropped DLL 15 IoCs

pid	Process
1328	WinCombo.exe
1328	WinCombo.exe
1328	WinCombo.exe
1328	WinCombo.exe
1328	WinCombo.exe
1328	WinCombo.exe
1328	WinCombo.exe
1328	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinCombo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinCombo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WinCombo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	20261027.22367819.C8A41F9D8851.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	20261027.22367819.C8A41F9D8851.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WinCombo.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	WinCombo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	WinCombo.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	WinCombo.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3516	20261027.22367819.C8A41F9D8851.exe
3516	20261027.22367819.C8A41F9D8851.exe
1328	WinCombo.exe
1328	WinCombo.exe
1300	WinCombo.exe
1300	WinCombo.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3516	20261027.22367819.C8A41F9D8851.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3516	20261027.22367819.C8A41F9D8851.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2056	3516	20261027.22367819.C8A41F9D8851.exe	92
PID 3516 wrote to memory of 1328	3516	20261027.22367819.C8A41F9D8851.exe	94

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	20261027.22367819.C8A41F9D8851.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	20261027.22367819.C8A41F9D8851.exe

C:\Users\Admin\AppData\Local\Temp\20261027.22367819.C8A41F9D8851.exe
"C:\Users\Admin\AppData\Local\Temp\20261027.22367819.C8A41F9D8851.exe"
1⤵
- UAC bypass
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3516
- C:\Windows\SYSTEM32\citool.exe
  "citool.exe" -r
  2⤵
  PID:2056
- C:\ProgramData\MicroPoint\WinCombo.exe
  "C:\ProgramData\MicroPoint\WinCombo.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\ProgramData\MicroPoint\Security_Module.dat
C:\ProgramData\MicroPoint\Security_Module.dat
1⤵
- Executes dropped EXE
PID:4184

C:\ProgramData\MicroPoint\WinCombo.exe
"C:\ProgramData\MicroPoint\WinCombo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Security_Module.dat

Path C:\ProgramData\MicroPoint\Security_Module.dat
Size 66KB
SHA256 83dc55570a84dd66c771885549ba1b8480c4d35f42b1547ceebd80be0bd79f00
MD5 a853da1f46c701b7821480907fd4fb64
SHA1 bf276592837eec279a940dafe52ef808823fd807
SHA512 9975f45ae5d2953b7f8abb81d19ca98291b518df54b4d9859b4d721c7e6396851018149770178489cab5ce69296cfecf841eb065dad48e6137cd048c50e7310c
SSDEEP 768:5j8fNEScXBCQtnj5SdsVgFLi2mcIQqKk+LAaRwl0FH54UzNNecewnBpvwzLOdNq2:Vyk9/npQLBUcewnrwOWc8ocNecW8W
TLSH
T16D633C8367D414C5FAA285B5E5B4C623BFB6F9521F0082DF069081A94F32BD0AE3D6D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinCombo.exe

Path C:\ProgramData\MicroPoint\WinCombo.exe
Size 343KB
SHA256 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596
MD5 a8c9c91d9f556ddc4c3dee2e7af7c140
SHA1 05cd34af731e5f29a9fe5b7950c25450a893b20e
SHA512 3aace6b6ac91b50bff730a2a01c1c1fc7ee50b932d1464b82ff2b3ea265b033c5b67067a92f1968dd56f619a22f0ab75ad28311a6c0ce73a352a03f3120472fc
SSDEEP 6144:yheV9dmppO7+6q4XZ5iNmlRO2Wst9t+jX:yh6h+KTDRWsntu
TLSH
T1CF743C933B5A1C96F897C0394657BE02EB727C990312C6DBA360B55A5F3B6E03D78E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appshare.dll

Path C:\ProgramData\MicroPoint\appshare.dll
Size 3.3MB
SHA256 7c16cd83296daa3daeaabd495bfcdac82fe1b6d4a91bf1285291107b0bf5fd94
MD5 6cfeb0da1b0528588644172f1e58b71e
SHA1 bdffc973017fce17636196403dfc9dd7ac41dd9b
SHA512 cd110e41ab6a2468cd2d4a4a2a7932dcfaed28927dabc04494dcdbffabf42a39cae9e026859863f1ad127971d06a1510b6ba178b21677f238284991efd3da6bb
SSDEEP 12288:1R4kb9UnQDBDvy2uV8JzMXmMDsZecYWwK3Lf15l6f+1jWZ+/Pah9R3DimFHIe/6M:KMBfd16f+1jWZ+/PazjUs4dk
TLSH
T160F5DC1039EFD07AA377AAA56FD8B99AD89FE132654B74D730421F078233CC4DA11879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mediastores.dll

Path C:\ProgramData\MicroPoint\mediastores.dll
Size 248KB
SHA256 02f7f062d9065e15b064afd94137da0723ac19db953733800ea3a04394ba44b5
MD5 30d90bec43a43d238788d2ecd4b0d2b8
SHA1 04d2ee43de24b328cece7a530472b19e19a39319
SHA512 d1155b4278a2ffa4d49b8698c7e89ae638ec82fffe08e901c87b37b1527a3ec5507261183ba85492721dfe432f215701f53d33fb201de8087bf0332c88c8f054
SSDEEP 3072:P4rdtoPiLB+aInY5cGqKZKi1Ncho0fUf+M6uINQkd1q2M3vETo/jK5oIQ28xwR:tqLAaInilT4zUfv6uqt1q2WET+fxy
TLSH
T1BA44294B665408F7D8ABD17C89878A07EBB2391A4351D7CF07D0965A0F0B7E1BE3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\MicroPoint\msvcp140.dll
Size 553KB
SHA256 3048df1cf8d476e998dde28ed6b67856b47ec5ae2b2c221fb1733f43c550c701
MD5 e3791c5b54bd3f1d2a61b1beff9ef5f2
SHA1 f55535eff838a93bcab300673e93447c3d0a54ef
SHA512 14931c8e05484989bdbea942f797b0e3d1ef6fb1e60a47b30f3f84b56adc35e18a3c7943004f75e96fbf1a2d5df0452b2511a18418705b3c84c57f2d11b11c04
SSDEEP 12288:0Tv2OuTt6DRh4l0PU+tDLjfhQEKZm+jWodEEVT6um:0FU+1hQEKZm+jWodEExZm
TLSH
T186C41923B75905A0E195E3B891838705D7F07C4A8322A3C792FBD5AE2F5B7D1A73B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

util.dll

Path C:\ProgramData\MicroPoint\util.dll
Size 1.4MB
SHA256 889c8747e20356a83f7e81c1206de869beeed3707408716656ab5b5a14451044
MD5 1d37b895bdba65c274df607b212774eb
SHA1 0b4ceb589c01cb9ce4a59194d2f1cec969f93f1c
SHA512 44f25f52921ecae4256c63fe45c496c419ec509220a9dcc4bd9cea2bd2c2b3485aae581771f94cbaa3ddb38eeee7e9d18a3fb446d7b5b0f465476f3875a28f79
SSDEEP 24576:/lYdN1TFOxYFzgq1vmz1K+M4bNclnCKqYh:9YdNdFOxnqST1bNclnj
TLSH
T1BB654B890246A6CAC855F53CEE42A413F3F6B911035DCEE7943184BA0F772E69A7EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\ProgramData\MicroPoint\vcruntime140.dll
Size 108KB
SHA256 9593801b89cf3c0a46056f4d923d67b5c685fb8760f007b4d194e4a6a6ed9396
MD5 41e66b1c590019dc99f544513c0693bc
SHA1 d882329c786bd1038bbeeecc58c2f3b2a085ac22
SHA512 8296f7e4113d4e6dbee72a7d29358a67b4ffd1e284a01a3b7fbf4e85878a07444777df6d3c2e6efdea7e7d7a1f167d7fad755f78a655cdb2b89d0330265ed611
SSDEEP 1536:gQOierMULrYaTw+xkU4X3X6pjxP9vPOiDxvkcYYbBD4ZecbuHcTa3xzZY:g/trT2XH6POiDxMcYoKZecbuHcTUxtY
TLSH
T193B36B8A72A003F7D16AC239C1A32A16F771F8548760A7CF03A54A7A1F53BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\ProgramData\MicroPoint\vcruntime140_1.dll
Size 38KB
SHA256 b49a9b9c334e66bb14e0bd784be2e0a86edc7d24a9ebf90d1b2bbd71451695c9
MD5 15e66163e8bdaaaf8bb775b29d9f98b0
SHA1 48a854b69efa1ab9ef2ebae9b465e4b8ea415ffb
SHA512 e9f3cd24957045ecd2fe9e175de2909474ce9c69b2c81e4575e965ab4e7b34d7ea7eef3071079b0a176ed67ca2324423b57189713b8d9312804f24dabf1a4ca8
SSDEEP 384:QHbrv6WeyJSGeWuh1fD/Hk+GlbjWyIhHz6Yf2Q1mPOw6U8z3WrfKWdtT7nHRN76L:zWeMk/D/HunfmHz6SC8MD1Q9zVp
TLSH
T14E034B9467B84086E0AF91B4C4D76F17BA7CF9650B50938F0BA1919C2F637D0AB3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-25-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1300-27-0x00000173DBDD0000-0x00000173DBF42000-memory.dmp

Download

memory/1328-12-0x000001C7B4A80000-0x000001C7B4AA3000-memory.dmp

Download

memory/1328-13-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1328-15-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1328-14-0x000001C7B4AB0000-0x000001C7B4AB1000-memory.dmp

Download

memory/1328-26-0x000001C7B3050000-0x000001C7B31C2000-memory.dmp

Download