9c745f95a09b37bc0486bf0f92aad4a3d5548a939c086b93d6235d34648e683f

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skid_locker.exe
Size 1.4MB
Sample260418-2ffsssg12k
SHA256 9c745f95a09b37bc0486bf0f92aad4a3d5548a939c086b93d6235d34648e683f
MD5 46fa8d029d3c473125ef6ce5adff3c54
SHA1 be524f751cf4d1892f7637c527ca36c09955b145
SHA512 48ef74aacac10a007b96282b0678178e95a77f34fe79ba66fc0dbba9f3f12e27bd3acfacc5965094f67fe1e820cd7908d0d776e086097fd9cb581a67170ad34b
SSDEEP 24576:DuC9IrMxg3Ggy7iTrvxylIzZ08535e3jV0HRCM3m:DuC9+Mxg3Ggy7yvxy+zyelHRN
TLSH
T187653B1BE2A385ECC16FD07487579B72BE30B81905347D2E1BA4DB322F21E509B6EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\!!!_READ_ME_!!!.txt

Ransom Note

!!! README !!! =============================================================== ::: ::: :::::::::: :::::::: ::::::::::: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#++:++# +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+#+#+# #+# #+# #+# #+# ### ########## ######## ### =============================================================== Dear Management, all of your files have been encrypted with ChaCha20 which is an unbreakable encryption algorithm. Sadly, this is not the only bad news for you. We have also exfiltrated your sensitive data, consisting mostly of databases, backups and other personal information from your company and will be published on our website if you do not cooperate with us. The only way to recover your files is to get the decryption tool from us. To obtain the decryption tool, you need to: 1. Open Tor Browser and visit: http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f 2. Follow the instructions on the chat page 3. Receive a sample decryption of up to 4 small files 4. We will provide payment instructions 5. After payment, you will receive decryption tool WARNING: - Do not modify encrypted files - Do not use third party software to restore files - Do not reinstall system If you violate these rules, your files will be permanently damaged. Files encrypted: 0 Total size: 0 bytes Unique ID: 5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f Backup contact (Qtox): 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B

URLs

http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!!!_READ_ME_!!!.txt

Ransom Note

!!! README !!! =============================================================== ::: ::: :::::::::: :::::::: ::::::::::: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#++:++# +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+#+#+# #+# #+# #+# #+# ### ########## ######## ### =============================================================== Dear Management, all of your files have been encrypted with ChaCha20 which is an unbreakable encryption algorithm. Sadly, this is not the only bad news for you. We have also exfiltrated your sensitive data, consisting mostly of databases, backups and other personal information from your company and will be published on our website if you do not cooperate with us. The only way to recover your files is to get the decryption tool from us. To obtain the decryption tool, you need to: 1. Open Tor Browser and visit: http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f 2. Follow the instructions on the chat page 3. Receive a sample decryption of up to 4 small files 4. We will provide payment instructions 5. After payment, you will receive decryption tool WARNING: - Do not modify encrypted files - Do not use third party software to restore files - Do not reinstall system If you violate these rules, your files will be permanently damaged. Files encrypted: 0 Total size: 0 bytes Unique ID: 5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f Backup contact (Qtox): 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B

URLs

http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f

Extracted

Path

\Device\HarddiskVolume1\!!!_READ_ME_!!!.txt

Ransom Note

!!! README !!! =============================================================== ::: ::: :::::::::: :::::::: ::::::::::: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#++:++# +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+#+#+# #+# #+# #+# #+# ### ########## ######## ### =============================================================== Dear Management, all of your files have been encrypted with ChaCha20 which is an unbreakable encryption algorithm. Sadly, this is not the only bad news for you. We have also exfiltrated your sensitive data, consisting mostly of databases, backups and other personal information from your company and will be published on our website if you do not cooperate with us. The only way to recover your files is to get the decryption tool from us. To obtain the decryption tool, you need to: 1. Open Tor Browser and visit: http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f 2. Follow the instructions on the chat page 3. Receive a sample decryption of up to 4 small files 4. We will provide payment instructions 5. After payment, you will receive decryption tool WARNING: - Do not modify encrypted files - Do not use third party software to restore files - Do not reinstall system If you violate these rules, your files will be permanently damaged. Files encrypted: 3391 Total size: 213939540 bytes Unique ID: 5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f Backup contact (Qtox): 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B

URLs

http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f

Extracted

Path

C:\!!!_READ_ME_!!!.txt

Ransom Note

!!! README !!! =============================================================== ::: ::: :::::::::: :::::::: ::::::::::: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +#+ +:+ +#++:++# +#+ +#+ +#+ +#+ +#+ +#+ +#+ #+#+#+# #+# #+# #+# #+# ### ########## ######## ### =============================================================== Dear Management, all of your files have been encrypted with ChaCha20 which is an unbreakable encryption algorithm. Sadly, this is not the only bad news for you. We have also exfiltrated your sensitive data, consisting mostly of databases, backups and other personal information from your company and will be published on our website if you do not cooperate with us. The only way to recover your files is to get the decryption tool from us. To obtain the decryption tool, you need to: 1. Open Tor Browser and visit: http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f 2. Follow the instructions on the chat page 3. Receive a sample decryption of up to 4 small files 4. We will provide payment instructions 5. After payment, you will receive decryption tool WARNING: - Do not modify encrypted files - Do not use third party software to restore files - Do not reinstall system If you violate these rules, your files will be permanently damaged. Files encrypted: 1168 Total size: 618162372 bytes Unique ID: 5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f Backup contact (Qtox): 1A51DCBB33FBF603B385D223F599C6D64545E631F7C870FFEA320D84CE5DAF076C1F94100B5B

URLs

http://vectordntlcrlmfkcm4alni734tbcrnd5lk44v6sp4lqal6noqrgnbyd.onion/chat/5cb9f0f9-e171-403f-bed9-a3cd6ce36d1f

Signatures

Clears Windows event logs 1 TTPs 8 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2060	wevtutil.exe
840	wevtutil.exe
1724	wevtutil.exe
5204	wevtutil.exe
5548	wevtutil.exe
1612	wevtutil.exe
2468	wevtutil.exe
1980	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (2079) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5040	powershell.exe
3100	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!_READ_ME_!!!.txt	skid_locker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!_READ_ME_!!!.txt	skid_locker.exe

Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\skid_locker	skid_locker.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\skid_locker\ = "Service"	skid_locker.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\skid_locker	skid_locker.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\skid_locker\ = "Service"	skid_locker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skid_locker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skid_locker.exe"	skid_locker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skid_locker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\skid_locker.exe"	skid_locker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5040	powershell.exe
3100	powershell.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	skid_locker.exe
File opened (read-only)	\??\Q:	skid_locker.exe
File opened (read-only)	\??\V:	skid_locker.exe
File opened (read-only)	\??\E:	skid_locker.exe
File opened (read-only)	\??\H:	skid_locker.exe
File opened (read-only)	\??\Z:	skid_locker.exe
File opened (read-only)	\??\B:	skid_locker.exe
File opened (read-only)	\??\U:	skid_locker.exe
File opened (read-only)	\??\S:	skid_locker.exe
File opened (read-only)	\??\R:	skid_locker.exe
File opened (read-only)	\??\I:	skid_locker.exe
File opened (read-only)	\??\J:	skid_locker.exe
File opened (read-only)	\??\Z:	skid_locker.exe
File opened (read-only)	\??\W:	skid_locker.exe
File opened (read-only)	\??\J:	skid_locker.exe
File opened (read-only)	\??\X:	skid_locker.exe
File opened (read-only)	\??\N:	skid_locker.exe
File opened (read-only)	\??\G:	skid_locker.exe
File opened (read-only)	\??\Y:	skid_locker.exe
File opened (read-only)	\??\U:	skid_locker.exe
File opened (read-only)	\??\W:	skid_locker.exe
File opened (read-only)	\??\E:	skid_locker.exe
File opened (read-only)	\??\T:	skid_locker.exe
File opened (read-only)	\??\P:	skid_locker.exe
File opened (read-only)	\??\Q:	skid_locker.exe
File opened (read-only)	\??\R:	skid_locker.exe
File opened (read-only)	\??\I:	skid_locker.exe
File opened (read-only)	\??\O:	skid_locker.exe
File opened (read-only)	\??\L:	skid_locker.exe
File opened (read-only)	\??\V:	skid_locker.exe
File opened (read-only)	\??\A:	skid_locker.exe
File opened (read-only)	\??\X:	skid_locker.exe
File opened (read-only)	\??\P:	skid_locker.exe
File opened (read-only)	\??\G:	skid_locker.exe
File opened (read-only)	\??\K:	skid_locker.exe
File opened (read-only)	\??\H:	skid_locker.exe
File opened (read-only)	\??\L:	skid_locker.exe
File opened (read-only)	\??\A:	skid_locker.exe
File opened (read-only)	\??\M:	skid_locker.exe
File opened (read-only)	\??\Y:	skid_locker.exe
File opened (read-only)	\??\O:	skid_locker.exe
File opened (read-only)	\??\S:	skid_locker.exe
File opened (read-only)	\??\K:	skid_locker.exe
File opened (read-only)	\??\B:	skid_locker.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\!!!_READ_ME_!!!.txt	skid_locker.exe
File opened for modification	C:\Windows\System32\!!!_READ_ME_!!!.txt	skid_locker.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvm3_wall.bmp"	skid_locker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dvm3_wall.bmp"	skid_locker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1656	cmd.exe
792	PING.EXE
4904	cmd.exe
5152	PING.EXE

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
840	vssadmin.exe
2384	vssadmin.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
792	PING.EXE
5152	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
3100	powershell.exe
3100	powershell.exe
648	skid_locker.exe
648	skid_locker.exe
2284	skid_locker.exe
2284	skid_locker.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeBackupPrivilege	4296	vssvc.exe
Token: SeRestorePrivilege	4296	vssvc.exe
Token: SeAuditPrivilege	4296	vssvc.exe
Token: SeBackupPrivilege	2272	vssvc.exe
Token: SeRestorePrivilege	2272	vssvc.exe
Token: SeAuditPrivilege	2272	vssvc.exe
Token: SeSecurityPrivilege	1612	wevtutil.exe
Token: SeBackupPrivilege	1612	wevtutil.exe
Token: SeSecurityPrivilege	2468	wevtutil.exe
Token: SeBackupPrivilege	2468	wevtutil.exe
Token: SeSecurityPrivilege	1980	wevtutil.exe
Token: SeBackupPrivilege	1980	wevtutil.exe
Token: SeSecurityPrivilege	2060	wevtutil.exe
Token: SeBackupPrivilege	2060	wevtutil.exe
Token: SeSecurityPrivilege	840	wevtutil.exe
Token: SeBackupPrivilege	840	wevtutil.exe
Token: SeSecurityPrivilege	1724	wevtutil.exe
Token: SeBackupPrivilege	1724	wevtutil.exe
Token: SeSecurityPrivilege	5204	wevtutil.exe
Token: SeBackupPrivilege	5204	wevtutil.exe
Token: SeSecurityPrivilege	5548	wevtutil.exe
Token: SeBackupPrivilege	5548	wevtutil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 5040	648	skid_locker.exe	80
PID 2284 wrote to memory of 3100	2284	skid_locker.exe	84
PID 648 wrote to memory of 840	648	skid_locker.exe	86
PID 2284 wrote to memory of 2384	2284	skid_locker.exe	92
PID 648 wrote to memory of 1612	648	skid_locker.exe	96
PID 648 wrote to memory of 2468	648	skid_locker.exe	98
PID 648 wrote to memory of 1980	648	skid_locker.exe	100
PID 648 wrote to memory of 2060	648	skid_locker.exe	102
PID 648 wrote to memory of 1656	648	skid_locker.exe	104
PID 1656 wrote to memory of 792	1656	cmd.exe	106
PID 2284 wrote to memory of 840	2284	skid_locker.exe	107
PID 2284 wrote to memory of 1724	2284	skid_locker.exe	109
PID 2284 wrote to memory of 5204	2284	skid_locker.exe	111
PID 2284 wrote to memory of 5548	2284	skid_locker.exe	113
PID 2284 wrote to memory of 4904	2284	skid_locker.exe	115
PID 4904 wrote to memory of 5152	4904	cmd.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\skid_locker.exe
"C:\Users\Admin\AppData\Local\Temp\skid_locker.exe"
1⤵
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:840
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Security"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SYSTEM32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\skid_locker.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:792

C:\Users\Admin\AppData\Local\Temp\skid_locker.exe
C:\Users\Admin\AppData\Local\Temp\skid_locker.exe
1⤵
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableIOAVProtection $true -DisableScriptScanning $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2384
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Security"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5548
- C:\Windows\system32\cmd.exe
  cmd /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\skid_locker.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

!!!_READ_ME_!!!.txt

Path C:\!!!_READ_ME_!!!.txt
Size 1KB
SHA256 9cad74711cf4c9756f25c9ace981bb9c19d1082d239d150c0d99ea7409d34e8f
MD5 147e495f63e32556209ef7de6c896e79
SHA1 2528214862850acfbc65e0622d9d2eaaf1d18270
SHA512 533d2dab2183643c0151c347700724073a93bd9b51142cfac308371ee89f6db0aa5b46c5128e16cec758bf8fe986d3473beb09e8a1ef0cc8b137b8377349a3d6
TLSH
T13031231DAD286F4D1AB453E1FA69D5A1970EE5FC05B38234785EC0EC07217E33B91469
MD5 SHA1 SHA512 TLSH

Submit Download

!!!_READ_ME_!!!.txt

Path C:\ProgramData\!!!_READ_ME_!!!.txt
Size 1KB
SHA256 b9f4c4bad3a8262ade99cfb6785df34afe8aff9a2652026d2350238e265ed458
MD5 206992e2a914b5f1c35b31f5c4b0c092
SHA1 7d9fb67dd99614e2728b21a50b60f40d51c82493
SHA512 b1d26db5f849360a3c3f0032608e66fdc00282d105d13cd4a62526c2b8ea40a88bcd09ea17a37b9e915c02b53351a20b3047399d889ef8500b720d8f8ed45dec
TLSH
T15D31621DBE383F0D1AA052E1FA69D1B04B0FE1BC15B29238385ED0E913217E33A52465
MD5 SHA1 SHA512 TLSH

Submit Download

DeploymentConfig.2.xml.vect

Path C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.vect
Size 1KB
SHA256 8f1fd4b0de53e4464e04cb337ea30291d363683bdd77e34f941d5d795c6491b6
MD5 132ac9255de6f92d394f4a28dde7543f
SHA1 e1683300002efd8509bb17aa8738b8b977cd19e3
SHA512 beda176f18bfb54f60454ce799d26ce96b97523b797f0458b4767d8101ce912d98b3d1a8f8ff4658c3ca871c1577a961a1e9a6f8aa57e62c74a543270ccf6344
TLSH
T1EF211B080884C6667035374DFA1631AAE0FC32D53EB00FAE1463D994150A357636A675
MD5 SHA1 SHA512 TLSH

Submit Download

7096db7aeb75c0d3497ecd56d355a695_b06d8a60-c1ae-4b77-980b-23dce8539cb9.vect

Path C:\ProgramData\Microsoft\Crypto\SystemKeys\7096db7aeb75c0d3497ecd56d355a695_b06d8a60-c1ae-4b77-980b-23dce8539cb9.vect
Size 111KB
SHA256 fdeeca85de3e7e2caf227dcd170c1de73937c4a303bbd36bc4d63b4386a9e7b6
MD5 936a81d6a03180bda12e782415088780
SHA1 7d137b22ff1f6a6de4c5d1fdc1d6f9a2681f1c72
SHA512 0a0137eaa52b46b1dc577bb99451d4aacc4a4b76849247f0c961dc04a7b8f9ce2b9064439ad9b3545cf8037d5718a2e201ba2f7f4c272d58fd8ebd43234fa79e
SSDEEP 384:pnLe5ZI3A+SC8avMGwM/F8Sh14VbljSLXG8dSkC9CxCDqmG9CaoM+GFYvO/UYQNn:CH+SqEmYsL01o33tM
TLSH
T1D4B324C1F8A07D1046342617AAED5808EABC72D303D460DA7CCD67679F3BA857AB7721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.vect

Path C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\index.vect
Size 512KB
SHA256 53cc4cb252fd42736bba9afe0ee5ef0a8e463eea22a57fa490e010b6c45dc230
MD5 ed1a1f10373f0458c4fcc3b1f2edc532
SHA1 d01f3764181994ef61aec3acb5cbbf7b148847ee
SHA512 bcf716f001dc9a439a245e4b54fd62b3a738e8c630d31509372563fe905d4ea84005eb4a1ac9b22347d0d9e989fca87b041debceef19d2655c9e90f94a83ea1b
SSDEEP 1536:WpiWR71fGARDmaRz+MHX8bof9qB9MlMY+NAY/PwV1WuwLwRypQJcTIxdTmQ8o61U:+iWhAAZX+M3xfIfkY/FuA6+fKdpL/HB
TLSH
T130B412EBC3227192C17D1B79D8FA5633BB2D911C56AA9D8F47F784FE5A02529C020C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

L.Admin.cdprvect

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin.cdprvect
Size 978B
SHA256 e38a34db93835376873a5caa1c663abc2d075748d862b41d4e39d52204334e75
MD5 976cdb01b6ac398f4cb21fddce05015e
SHA1 5cbf1b9bf7683369c897491a86fecaff639d3e0c
SHA512 69807ef124a80257676d9d206ced547095526a22ea633089eaba792b2eaa42f7e7b8b1a15d0ac4e35cf65b0459833e22134d9f3dd62c003e16e1836e7d9756d6
TLSH
T1A911C800EE82FA9A125E47D435F2BF9718460349DE26D1D012DC882B936626C4220427
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json.vect

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\_locales\en_CA\messages.json.vect
Size 911B
SHA256 bf5a81be18f3c6da9ef9897e6eb958097bfd28533af6d16e2314dc2fd91ee355
MD5 6a6db702335a681443fbde4be03332fe
SHA1 e7171b0cb85549e959e7e5292e5f0cb91a2ffc2d
SHA512 7664bd2dace913cf2a6e08d898830a9446f0da455d41c8a96ceac5d5a90787f8f5fe9352de0adf56bf1cca7149d0d39edcabf64e6edaf790f505ffb9e7a6e839
TLSH
T1DE11F7AE6EB4057322A43C3DD84AD3221835C85471DDB250082FB020E6816FAE3224D8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json.vect

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\_locales\hu\messages.json.vect
Size 1KB
SHA256 8369617c5c28aaa11148f7ccf297bcde3159c12ca6613c8571d1d2478462716b
MD5 c723e0679c387396de6579b1e7a20897
SHA1 f609f2678c8d1d0795eae1c2541426706186ec01
SHA512 775e3d44bbbfb3cd3a9bd5ac7d24ae5366df29b6025e668800a97c44e62f4ea42d1d8a580af5532b2560dd7907c33db9085064e0aa707db91aa0fdb3fe0b1c29
TLSH
T10521C6C55D64FA19FA82224428977C0C115C32B545089D2720394434B17CCA1F3EA91C
MD5 SHA1 SHA512 TLSH

Submit Download

64.png.vect

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.vect
Size 3KB
SHA256 4aeac82038dd223ca4187e09547e670f6dd9fe13064ca1272b3907c472c2ca4d
MD5 eeca32ba8493d6fccc3b6a8069755581
SHA1 5d33677162df69d2739fe8ed3b509bd6ef23cf14
SHA512 224ea16df1f49c30ebc5b8b3561247a18139526d6bcc416de3042ad3c6f263ae4b873e9526d40afa0f89bfdd01088f18b0ae42458f5a5794e138ba00c604587d
TLSH
T1E1816CDD6E7C44E1D9149C9DA9450BB2A3285FFE94D0030E466248BF012E30664AF084
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old.vect

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old.vect
Size 424B
SHA256 acc33ee3654fba9914928b5d1742ab92d6aaf287322d40b605fc3237c0110e88
MD5 9bc3aa6ecf41a70c95e990a4c63d3f70
SHA1 e05f11ea0b4dfa54fc98bffb3fa331d033dd8655
SHA512 686b676a9250bd2346044c742062b20cb1c10eefa0bf3b228a2cdd9a8cbe4e2adc0b3ac5bc4ba1c8d895a07faeb37ceaccca2c50a90cb3b5f37fbf32568cf7b0
TLSH
T107E02B0AA9A00CB008ADBC664D2F28542A2901A72973CD85E3020AA87492E97C4C1E38
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DFBE70A7E5CC19A398EBF1B96859CE5D.vect

Path C:\Users\Admin\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.vect
Size 10KB
SHA256 c353345313a6f4a6e2d87dff65819ba08f27bca8948ad5ada0a36a4d6a729881
MD5 774ece5ec36d0b6c085b4f0839486b89
SHA1 e6ceecec604479acce4a3ab1a6943f8b2d411195
SHA512 65c69f9b21a7d78db978743cbc0a95b04559e388365e4d73ba2efae7d4459b61e94b10e4e315f96c1462ee269052e42d1730b5e9f122c74ba2a0b942e36733d8
SSDEEP 192:j1X1Fjrvn6bM0SsVXZNQDP/zOFkrqzc5YMTUuaqSlun8dLnbk+SrR7UGYETVckT/:jl1F/vn6A0SqN6P/KrzcCMeFa8dLnWln
TLSH
T1AE32CF22B209513548A3CF1CF1F2136E0E3A67B709D552301E837E631CAA6B8A94FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT.vect

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT.vect
Size 76B
SHA256 5b204450c14ab778bc8edb379985bb75a4da29acfab129321a7320639921f884
MD5 f33627bb2c1bae793fa21a1c2e8cd359
SHA1 4c6ab5915243c290d2ed2cbcd892ae637cea6c27
SHA512 4c580054b9f18d6b9a2a711bfed86f478918ed3fb74467a8d0281cc465d3ee4b1fb64434988988d47c3ee3ada3be33a13a4ffe934f1e9dc6ed9e174b8d2db6b2
TLSH
T119A022322C8A0E08F30C000BA8F00B0300CBBA88B000E00B30C000CB800888B000CFE3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001.vect

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001.vect
Size 454B
SHA256 6daed409292ad731e18e6134b420b3c5e281633efc0675e8350efadee251cc3d
MD5 e34cbf968c7e4fd911dce19274c8975f
SHA1 8b87e934f3f9a20961f8a1aefb3b88a50234fba1
SHA512 89cd17e186281a7818b88939da4a6671a669eaa37e4afbc7acc7286618fef3f00ed3b734d823aa6d13f291fd17e2fcb32ac32a6000e571498502b1aecfbf962a
TLSH
T1F6F0D4E4629028C4C72C6654A5E035F05739743C84784088317C593736167E314735C0
MD5 SHA1 SHA512 TLSH

Submit Download

WebAssistDatabase-journal.vect

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase-journal.vect
Size 224KB
SHA256 7369bcb496b71fd48d755956663e096a14e958815ddf28b2691985eeecf5e485
MD5 868a3d89482cd50ebf99028e96715e17
SHA1 efef38066d950146359616ea0554f383c1959330
SHA512 4d33e8a9774d837e6b6f5202e56e09a7757a173a65fa08abe3a0dcf71785887f4108f49e02eb2356edb26d2df4f72760e602511b70541d3570a27cd448b3c7b0
SSDEEP 3072:oKjn+E5WVrnn9ZKBlX8xxEAMuHlxb0FyO8FHXBglQy5mlSd:oKarn6BlWxEADT48FRglQbUd
TLSH
T1AB241292E83E5100CCF7DD3A2EE1F46B9678863BCE3456A061A7846B890A427D17743F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.adml.vect

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\de\OneDrive.adml.vect
Size 35KB
SHA256 8e47b99530be1fe3451fa095541212a945ded963d4477940347de3e05c2ee592
MD5 2203a04bacfe05ed6c8cde981da94a45
SHA1 192c5dfdaf7279408f641fb6d3db85f3c6c6a4dc
SHA512 6d3fb2d6b30640a6a780025d884dd930561f9396b4ebb6500c5c046ec6a3ec68f4b111653d09893cd38a1b74db61afe64e8dd1af5d2927ab7171c0e5945cee75
SSDEEP 768:V6kNihlVJMkdZZHmiIAUvQgyMptRr4e40M:ViIkdZZHBwQgtpt39M
TLSH
T1C2F2E71249CA691AB8153396B3D24E3BF638B36FC30A3173B0ADC0161B791B551FF46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5475cb191e478c39370a215b2da98a37e9dc813d.tbres.vect

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.vect
Size 2KB
SHA256 0ac19573224327564dbfbd727609387bbcfb0e4c2e52c2686cc73d1ea2a8bee7
MD5 0ff86694fac1de091032835b1f95dbdd
SHA1 3a690eae27eae00397e8de8a024e83b1590f219a
SHA512 e35d359be616d2fff5162a7a8e9c52529f8ac3400b647e337920181ce355feac937e8cf920b961cd7aa1511aef46d13b7511259855d61b2e738c7845a3dfe390
TLSH
T150514E592E35ABB5B23D26537007F6038386A15D028C558DB7745AB37DC1338EC1C28D
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json.vect

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85vpkkl6.default-release\activity-stream.contile.json.vect
Size 5KB
SHA256 26862d5eba93c0d1c741a51534d710bd810fd9053a7eb8e9346b3accb637df06
MD5 ce1e58528b28f1a700a7481c4e60c8f8
SHA1 e9bd2127dfd8821268a443352cd8a28fdfcd55c7
SHA512 8bd71c298099628159e47898728babecc6ba298d96d158c94c1835f4081437e4f3eb7af8c0f6b9d2c492f42ce77d6a45b95bfb82f50e5fa45c363bcc263bd704
SSDEEP 96:ZjWSJfezI5biQWwxVHdfXsxvdYqLGbpW2BqgLOT68Sr/:RpfxWQxTXsxGqLSpW2Qg/
TLSH
T1CEB15B1408847A8FA9961EA674904B4A5A2A963E86A6253CA8343F30DF61F4413769DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat.vect

Path C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.vect
Size 8KB
SHA256 8a455c976567e7f8cb86ad1cb98a3ecead614ccb282c1f18a6f96a2310f81cc6
MD5 cf0071a72ab5abe01c6c968b0b665057
SHA1 822d98016bd1235ecdf6357eb58c673fe7d2445e
SHA512 98122dc04bdd757ffe5f24b1578386206943bb208ed840e0bfd127978c1da5c0d774687f55033bcd88e41b8b01dfa9169a18a7c15bf723544ec74ac2646db59e
SSDEEP 192:D2/uYHDPBv9wru10bP2F4sk5cMmyZ9i/ekg0c5vGEZ:gu4bdQxSF4skhpJkg0/m
TLSH
T13302AE4398DD4A15648429DAEA6BC1D8C9DF02B6334063A0C676C94DB4F6F208D8C836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Todos_8wekyb3d8bbwe\Settings\settings.dat
Size 8KB
SHA256 5af7dd2ffa17fac5c4f9aece885b5feb8f67f14074e458a6d0574ac38e9794a8
MD5 0b0620cd179d935f6dc34ecb62110c53
SHA1 5842601159ec79392686f41ec7a67415d3f174fa
SHA512 490cb0339289b1570b3e80d6460d7f2b2836b1146e7fb7c761ce955292615b84f3284c5645a488fa0a911a273cfef86b032972afe0b7db7b564d095cb8523114
SSDEEP 192:eLLAH+vIoHk3x0q9wj14MeyCbxSTtG5JRfDN4mc8:QL0+vE1yCV9LN4u
TLSH
T17402BF04DC68697C74E455D93D8679A8EECF0CB1AEB7F176F603C845A8A4125F1C84B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZLVKSBBGK2_21.vect

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\KFOGUK6I_3\1E32NWLF_4\ZLVKSBBGK2_21.vect
Size 139KB
SHA256 65d4d76a06192694c8170e44e1d8c460b60a008990312efa330299139aa10703
MD5 ba927078e1a9644df8290b799053b736
SHA1 3d9ff4636a74610ba08e81ce607a4dd01ee37381
SHA512 1298672493c93fe3c1dff3f26e5de6f7a448c05b37a4fd6a0a31f49fbccfe27eda4b865ba5899e5182b5d4a373f862295f8822dc86bca6974e45b9226e245040
SSDEEP 3072:cDN4p25AAc0CVZ80/O7c5oyMNdZEKyoVI9KzX/HJAUijQD:y4pvAYHF/FqdqvoVI9KD/HJA18D
TLSH
T1A9D3122DA0692C355BC248E7F47AA853D73D202604CC46EC712785AE636DA189E7FF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!!!_READ_ME_!!!.txt

Path C:\Users\Admin\AppData\Local\Temp\!!!_READ_ME_!!!.txt
Size 1KB
SHA256 7885924f1cf47a80b77a1b232e00225ac1de9879b36a2a5fae6d318d1006f82d
MD5 048fa781ed6bd8ab999818632414fef5
SHA1 76fafec821248b12bdf34e506163ce846e5434cd
SHA512 1c25a30c55e326ab7e97dd53510c5b85cf174c945d769581bc44bd912d9a8abead31ec208eaa7cc33da31f7cab0f7c1c7f32c45060d7adc706dafc2257abcfae
TLSH
T12731421DAD286E4D1AB453E1FA68D1A19B0EE5FC05B38238785EC0EC03307E33B9146D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wo34rraq.2qa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wo34rraq.2qa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dvm3_wall.bmp

Path C:\Users\Admin\AppData\Local\Temp\dvm3_wall.bmp
Size 5.9MB
SHA256 e330fbaf2a1b1fbd3f9bc073a537c9d20bf918de6e62e3ff1c60d67802ad07c5
MD5 efe53a4bbe85035ff03bfebed5aab222
SHA1 21a0f27bf1fde8fd3274a5163b53b3bc045f57e6
SHA512 f69d3833f5b93e88c8d948b49f37a85fb90cc179622cf592070f6ef4a0f5129404583a68bb0fd242ef1db998f1e84dfbddc873ea24640b4590a120e66099e0ab
SSDEEP 3072:2pwyc8aT8N+qPhOSXj9R6CmiGwaQf6D22c5vKt9AlSFcw:2pwyc8aT8N+qP
TLSH
T1DA56BC393A8D43E6E3377430D9EA809ECA693C59D806E9B7F135B0565036D6C3A9730E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.vect

Path C:\Users\All Users\.vect
Size 13B
SHA256 5718f425f427de526ac0c5359d1cf2b4e1c5bec6afb9dbd0d53efb8fc0c18214
MD5 6a27f9aa9d6d3018ba98e51065853051
SHA1 f67cb1193582582c097eeb81f5221c8dbcb7c176
SHA512 8db8379af50dc252f7838ff7193d36f7022efe57d11b4f30c5fe5f1bed261e16e98f5b8d5897fcf8fa42f45147d51b6ff9a98c109b3619f16588c4773033ef79
MD5 SHA1 SHA512

Submit Download

!!!_READ_ME_!!!.txt

Path \Device\HarddiskVolume1\!!!_READ_ME_!!!.txt
Size 1KB
SHA256 a534f47ebc4020cc8a7f1f5e17ec61a74ae25a150eb49dbbc848741ed89f92b1
MD5 c0a88a5ad5f0767adc03f9a68fcdaa5c
SHA1 e9cb7facc272fc5f393fe2753eab57a86eaf83d9
SHA512 b5eff063bd251ce17db1cac7538bfeec815ed288543eebf78d239d69a20d61c7780555277e61880975fa8eb58157bd916b9b94f9392e23a7246bab20323c6ac2
TLSH
T17231231DA9286E4D1AB453F1FA68D1B1970ED5FC09B38234785EC0E803207E33B91469
MD5 SHA1 SHA512 TLSH

Submit Download

memory/648-52-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/648-8379-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/648-50-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/648-3614-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/2284-13720-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/2284-51-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/2284-9273-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/2284-55-0x00007FF7AAAA0000-0x00007FF7AAC0B000-memory.dmp

Download

memory/3100-49-0x000001DCF5C80000-0x000001DCF5C92000-memory.dmp

Download

memory/3100-48-0x000001DCF4070000-0x000001DCF407C000-memory.dmp

Download

memory/3100-26-0x000001DCF5F20000-0x000001DCF5F30000-memory.dmp

Download

memory/3100-25-0x000001DCF5F20000-0x000001DCF5F30000-memory.dmp

Download

memory/5040-37-0x00000233D1690000-0x00000233D169C000-memory.dmp

Download

memory/5040-19-0x00000233E9D10000-0x00000233E9D1A000-memory.dmp

Download

memory/5040-27-0x00000233EA090000-0x00000233EA09A000-memory.dmp

Download

memory/5040-23-0x00000233E9F50000-0x00000233E9F58000-memory.dmp

Download

memory/5040-0-0x00000233E9960000-0x00000233E9970000-memory.dmp

Download

memory/5040-22-0x00000233EA0A0000-0x00000233EA0BA000-memory.dmp

Download

memory/5040-34-0x00000233E9960000-0x00000233E9970000-memory.dmp

Download

memory/5040-21-0x00000233E9F40000-0x00000233E9F4A000-memory.dmp

Download

memory/5040-20-0x00000233E9F60000-0x00000233E9F7C000-memory.dmp

Download

memory/5040-24-0x00000233EA080000-0x00000233EA086000-memory.dmp

Download

memory/5040-18-0x00000233E9D30000-0x00000233E9DE3000-memory.dmp

Download

memory/5040-17-0x00000233E9CF0000-0x00000233E9D0C000-memory.dmp

Download

memory/5040-10-0x00007FF49A7D0000-0x00007FF49A7E0000-memory.dmp

Download

memory/5040-9-0x00000233E9960000-0x00000233E9970000-memory.dmp

Download

memory/5040-2-0x00000233E9930000-0x00000233E9952000-memory.dmp

Download

memory/5040-1-0x00000233E9960000-0x00000233E9970000-memory.dmp

Download

memory/5040-38-0x00000233D1740000-0x00000233D1752000-memory.dmp

Download