EXAMPLES OF VALAK DLL FILES FROM JUNE 2020: NOTE 1: These file are run using regsvr32.exe -s [filename] NOTE 2: Waves of Valak activity generally have different file hashes for the Valak DLL each time it is retrieved even from the same URL. However, on June 30th, we only found one file hash for the Valak DLL from different URLs across multiple occasions. (READ: SHA256 hash file location, if known) 20 examples of Valak DLL files from June 3rd 2020: 1907cb31a7cf2b9d72a04bffc54f3c3e586185f52f34c55a9c2801e5f0a3ece9 1cd2ad16721b9608b80f6893c722954b5d8e5088d1d9597f0b15e2fb47e78332 2c75e5005993fff65b5b8310c3c50c2e0ac219ba7014f5c480736636e7c5dcd5 2f46fb6c13d55475b50adec14baf7ff86e8b7c8afeff4a7dc9ee765afc3f0fd7 C:\ProgramData\24708534.dat 37063d422dffc974d56d8ddfbf33fa0a9417a247993aa6f3c498cf53c1752b03 3769a84dbe7ba74ad7b0b355a864483d3562888a67806082ff094a56ce73bf7e C:\ProgramData\28215025.dat 3b7edc6b378860d916e7889ba553d1fd467c905672893a0fd51357cd1a1f2b8a 491358a64ed976f229857fe1e938859d3f361ecc42eedf7a46a3fac4169451c1 4a63ce4b53d0aa7c8b205c3b1bdd68e96cf9d4b12c67f68d2f4f3ab7bcc78349 C:\ProgramData\78564506.dat 6321437ec564bb60cb5c6f9a88c2976da27ad7c0839d64898e40271ad6569af6 762ac227d1e708d4595c0918745426aa38217be59beee15f876d67bbeb1604ba 7647a4851d0da7acd79c9390756cf60b3d014b4251aaa98eaf534a3b867d3b02 7f8cc1fb6efd3d72facc258cbc6a3e5e429bb1ed652c73b4943c9089666c7b07 8b25aa9582427a476c2e5b66cb00d59946e07021b9708571bb9187cb3d98917a C:\ProgramData\44312539.dat c2cbc1ed75983a98dd49a9b6bd9132abe5e614dab32d28d4e0a4fefae9652784 cd4081f43b7908482e490c6d87d64fadef5d2532afe06506c42e56fe0214c7c6 d2e68fe4c321e9a4d4582ec24ee07727ab1bf6cb77fe40132d014e03134c2da7 dd0faee2b8122db2e5b4310209d089fe18b925b9eb91d82c7317831c9116f76c C:\ProgramData\39009095.dat f5011ee6773554c8a385e041cb115b7d3629f02d659659e3e21055f8bdec09bc f694ab4e2b9ae36c78fbc5cbfcdf77f38a2c0aeb50034f89fa9c12588ab3066c 20 examples of Valak DLL files from June 9th 2020: 0a575ef26e2e82b3f06d104500e3af37df7c3100f1aaf6a28ac87053de8a5303 0bb90724c47d48b03515ee71b21d28f69d885d3df3a776730cabbf55a0020261 C:\ProgramData\88656930.dat 1524ae848a18cd18169c63a9eafc11d8dd208a511bd0457b6605b573026aaf87 C:\ProgramData\81993040.dat 2437ce914ddf76a9f6aadd87e5c5b90a273dcd8077f834d45c8df1ceabdda697 34c6b95667b06c80095517bec3272d078f1904149c02ca6be7ea6d00cb03ff7f C:\ProgramData\69244045.dat 66d17d6415cbc11e03eeeca5695b6ded4cae370002b62519c0bbf206d61eb577 72adccbbe7bdc03d9353de540c90ea645a3b04b3ea29a4bed034a5fa1f0d9ec7 7ac1d50683f2fba730bf3ce13c376580a01dfad026782d7b681cd0e616ee0693 C:\ProgramData\34554365.dat 818fbe0110fe5f3b35a6fa765883e5796e2d60ab6983dc00ddeafbdc66d14821 83f017eecfded2acf7d48b07b30ace3e1170e0a272e97e1f570179a604a72ee6 9bb9be7af6b4fbedb52cc47ac640e4b96f49dac76cdb7e28c4dd06a70139d7d0 a99de26946d7ba69b9dda5565750292d6306bbb9884c0d2d53d267c5bf152d29 ab3ef0ce0ec0629eceb31cc5c86420dce1530304496f75654eff266da3605d14 bf32ec19a286553b01065d4cf26fa23a133a5e02780307e66e3c94c1dacafea1 cf5a23b489c2b0ae6d46468670f279daf44d4361a6fb5befcda11adcea738c96 e0e43815d5dba4c98de109b0cd93fca9bc572707670eaa73c3b423f139423c3c e2e266008bc63875d2129a1b706023ec5a27cf6a5ff59f008a637a4f74e8a6df eb019aaf114582a4077371b6a371b15c5954d83f9194c6cc4980e99d4e184d59 C:\ProgramData\81993040.dat f90fc1cacef369b13fe487c8ab9ba6ff0c1361527c244608edaa6e9a86df86bd ff64ade4e90c8614b61403c60d24e5327a63075cad6f5f91e5f00692bf322074 20 examples of Valak DLL files from June 22nd 2020: 0f28653e65c4809cdfb4e5fff94dba511365805c52dd42e4e647a2a7267c3698 1d97636154597b1b2f4a88f42333d9a94b57d1bf925adc1223f84d16edb4cab0 4797f3bec7b31086fd2aa9e27ef9dd23834a2890db87c23d54b596fe00b5795e 6c8642a6860671318c9fd77ee8978d7af3d06d876c302f9d9c08c56c44a9199f C:\ProgramData\1.dat 7b08762254330e5ad10202ba41e6141b8dfb0bf3ed2ee7738bd5e55acc6186fc 86372e5cae722d19c2596b5baf15d0edb5e7b72055252aae0aad26a86fd5580b C:\ProgramData\1.dat 86372e5cae722d19c2596b5baf15d0edb5e7b72055252aae0aad26a86fd5580b C:\ProgramData\1.dat 87758a310e89c37ea157a0c30bb737e5e6d5f2481074be156f00a836782aebb8 88efee5ef80bb261c7f399e558e3f5b5d6b53c990d04762dc2d446249a7f74f5 90d8a7979d306223cf237b3b55c6c8bfc12e8785881846ba73bd26faf7e702af C:\ProgramData\1.dat 981cd8fdef5a222511d691bb5a79c52b2ba3131cbed546c8df83e73d60631ecf 9e45ef202b4dbf13ebdf8d86fd0ab1644b1ff77f92a83e4c7ac2dc304ad5d99f C:\ProgramData\1.dat 9e6dd8292aed04e8b8afe6c8df8615f14cfc5f818c6808d2c977be654d3b640a a4de3e2fe233d3ebd52b557ff02f88f8c0272bfb6eb59c9786a0ceda3f8991ef C:\ProgramData\1.dat bc8100624bcd1dfa9c72cc31c5970abd30b98d6a8be894761266603a137fcd6a c723e0f7918a1f35d0f4a0ca53c123d5f15af3ec370c9596d516251bb6e6afbb C:\ProgramData\1.dat d06593b7ae8887ff78da0f6dff7c3c3b3eaf57ca9138c201524d4f38296645ea C:\ProgramData\1.dat e6cc986eea57bb9fa43c2d7e2022e595a48c4337f9a84e9c1526ed3d2a4c0b93 f1635ca01d44a64573c20621a36dc33248c783f023dbd8108ed5295400cb179e fc6e12e30ad6261ca81b17b26d0d5fb46be253da312d84aa99a13e0e76d324d9 20 examples of Valak DLL files from June 23rd 2020: 0e99598ec60e8c64fee526fca5b3fa0562b07e566c37f500878919d78bcb9bd4 1990f9782ef6e8b522eb2408d88d44e50bea4e835603d2f9ef5c364f5f87a8d7 299d03ac452057470ae0c13cd20a32948320aa1867f580e38290522af343c302 32217c9d79352151d1f2ca4a9db647d7fdf66cd866db387a6d537f1c16311bc2 3444b9718db7fc74b4a02283d27e6dcc38f9880d6acf18fbb7122e12912ba963 54631a3371c09acf7bdeb6c74f899627d05da0c75b71e7d6bac2761269249352 6a5bf1bfccf3f36fce2124b710333b62f68fbc751d77fc9241021005aee85150 72107699b9a78db221c18ef69b9b9b8b160952a9f6f3b3ce62c4fcbf471b7aad 7d63e38a8e8607c244f19377e78702db60f62765bb256dd4747ec1eb087eca4f 7ef591a8508a659d07b854dc7b1c41b60f85344c3ea92eb3c1fa75a2e9569f73 82cc0a0ed5ebb1f2c39633166f06829d478bc5fd27af7189588ae9863f8e5764 88cad7a48e19736b1d8af04ef7f123ed5f474996d079e386be726f732002a1d2 8f322ebc904053007907521620d29801d88a001b637a169b23ab43e21c41f5d3 97eb9b6262fab33ce0b10d69415749faf69842a15df6c78342db423ea347decf 997099b25849798329f01362577d54552f8e1873d6dcdcb5c793a9b8ab03d49e a92db1a9d28e48cf08261569f2e1182bd2977119de7629c6b457ed8504c6bb10 C:\ProgramData\48492872.dat cc9e434bc25472d2c3e3fa505ee20620bf12c5f431d1e0cd6652ae3af64129f2 defe95da33663c83222c8babfaae1be9dead36307f0262f5e7ef1fdb7558f58b f0469a7ab901fdef63b3325e51bdbee90f84e04220d696cd3f05b0d45e7be1df f3b156a0c655135bbed201e6e4adad77b5a1206ee012cffe46878f987f59868e 20 examples of Valak DLL files from June 24th 2020: 0f0d870fcad3e935d191e4076bfdc3812c278c3bdb6ec2233d71d9cf14a04a17 C:\ProgramData\40060179.dat 0fec44ccb9c5d12e82a99360b5d4645a93f7f3454c3c9afebdc2a738cd5efebc 1bd323c57344a8b38ac22ceec92707ba3b6a30d29b66fc32e163649ea7de8a0f C:\ProgramData\29757.jpg 481659d344a246a19eb516b01ea71e074e893f6ab4ba9de11c24fba15a8ec9fc C:\ProgramData\48041329.dat 51719d53d07a2349567473d36b4391391939ba18aa43bd694616028f6407cf9b 56ab969aeb52cb246d0f5f74083e4f90beabdfe1d1a5296488cc8375f1f24ef7 59b5aaa1b9d1225610007636ef70dec8f0f1889661d12690d02494718f7df54b C:\ProgramData\33060.jpg 659812b78542044d9ebb46743ecda037762a71a49f05322d5fa9bd8b3337d0d4 C:\ProgramData\49988373.dat 73872d1c97da41772d51fec33613cc1de32b27b43ec5135d1a1c357de5fb9d77 C:\ProgramData\23196138.dat 7b89d81303da4901c9b75b37b6c7c4bfeeb2cde533b16b61c21e56d7823fb932 8421811ca6b95b3a4f3610184af94f4295a57cc7aaca20062dd42acd76186733 C:\ProgramData\83511024.dat 8ce9c42220de87bf0dedab305d7874d286726ac18bae834c80e0d6eba8438df7 C:\ProgramData\35604.jpg a788577e4e98a09f66dc4703be96b877126f3cc7577d85fdca64b9ba37d9d24a be14ed801453c78d6c80992705cfe0e7eb03f808d2b28704ffa2925cdc46fdc9 C:\ProgramData\77994156.dat c02b6f99182618d386a1e12f89f4c4e75b508e14b91da628c162a7b2b3560517 e229806eefc3c76ed0a917969928ddce461a4e3934f9cb331f12b4d9c1ad6826 C:\ProgramData\51508.jpg ee9e978452a2f6b5eadfd5e92d59e561c3440ea5fbac9e638d11e5b0200c918a db5a3e1f351bc6e3c5c3e13de35d0242bed83467b62a83539b51215e17a033da f123306f7718521454f230fe31f96f038aa185b84acc6f26e168f8e63551615e fab56d10baf64adee3562c32a900c309347ce3824390897f9106c48f3e265066 20 examples of Valak DLL files from June 26th 2020: 0f637241d85a6f23e6574c98266413f1726599767aca0ac0b36da92472a317cd 13d407014bb7315b2d6a85ae2218a85eed059f3b728e7eb21c6d6412228d6de6 272795713193bdba66ee7085a189539e52e695c9559986c0cfa625677328c47e 2e19ddce914683c309f8234640fc8f83d96c4c97dc2820b9dac26cb982bcd03e 38ee5c8b6fd45031ba441a0712246da65465d1f35a5f6a18998e32767bdcbdd4 4a85f60572fd2622bfd2c9fc98d4c9f8d37182fdd7bd586a2d08a235af75dfb2 58bfaf15fbf0c22595678defc34d2919c9651ce0969a67a94151684b4cc3059b 60268eac6f8b2eb702e88a22476ffc1e3fc59b367afbca7ca85c12e86144a00b 6ff6c08f016d1143b58e66ffc17acfbd93ef7259ce570d721c14aff971f1a92b C:\ProgramData\32192.jpg 6a8e1343b77e0cb99e935075390a91328dea8d0c54e5e217c4a2b2b198b011f8 7afdc0f73279790cf8cd1629719211cd3ca12242c58c3e4301926c562bc13d93 C:\ProgramData\16731.jpg 8cc34bfa9d25c6ebab7f782d68853d1eb8340d2aa0180ee40f81e934c8eca9af C:\ProgramData\45906.jpg 8f2878e1d601131f8ca665844c0b438896f4d0fa00adeb3ddaafe319bba95459 9bace3c7335908af58eb6c78b8e266d5793300d2ca347283b04594dc875b4c9c a643bd69ae55df6b45d107658dbb45ae7a715c130aace3d3190c21c0f3464321 C:\ProgramData\64961.jpg b0609b8eaa6e7be42278a9e65363e3d4099ed5e2cfa1e71d5368ca7c6f01c5b0 c54d8f4d0a8580f4afe2f520da5384bb2395b7ee5e947cefb6b125546993fac0 e0af8a0714ab0fc1a2e3ab288b2eafdd46191da2d6b334d7884a6669fbbcbbb2 C:\ProgramData\45906.jpg e24b3d337aa9b82da6a1b7f1af9212a8e2dd0dfec530e1529a4df2c85c68b2b7 C:\ProgramData\30788.jpg fdb49ecc8d88b3befb53c886769d96f80203a277a481e789555db8d93b769e71 Examples of Valak DLL file from June 30th 2020: bff33dc4020ac8eeb354eb4a20f241f0bef6e1f15c029ba33b2350d84e8de42a C:\ProgramData\1.dat