chaos | a7453470f9d99e93cc51b7a8481ee27a87f9f0600eb4593a3336e7064687bbe1

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09-01-2025 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SatanCDD.exe
Size

5.1MB
MD5

1f412d7ed012129b47265ac1512a9263
SHA1

2fbec7ec4f095162c56d9c2e1d683dbd628e2677
SHA256

a7453470f9d99e93cc51b7a8481ee27a87f9f0600eb4593a3336e7064687bbe1
SHA512

8392abf0cf10b1279364bdfa2eed542523e3a79d0b173745dcc9ec2f64845f5001ca902f4d0bc0e7088ec392e81d0a05501c81bb4a901136e167868deb096307
SSDEEP

98304:19YWrObgEeQYyQaXf1X9RcSg2lcouStL2xW7F5Q7b5sAYrlpthc7:19fAeQXQaV9RcHucouSt/jQv5sAql7hO

Score

10^/10

chaos defense_evasion evasion execution impact pyinstaller ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\Warning.txt

Ransom Note

Your files has been encrypted By SatanCD and you won't be able to decrypt them without our help What can I do to get my files back You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer The price for the software is $5,063 can be made in bitcoin only Please Contact Us At Gmail: [email protected] Or Join us in Private Chat http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room PIN: 366 But First off Please Install Tor browser: https://www.torproject.org/download/ Payment information Amount: 0.053 BTC Bitcoin Address: bc1qcvgj0hxslrxpf6e969ay577t9g72dd663fus92

Emails

[email protected]

URLs

http://mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion/satancd-room

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 2 IoCs

resource	yara_rule
behavioral1/files/0x001e00000002aa76-7.dat	family_chaos
behavioral1/memory/3156-14-0x00000000007C0000-0x00000000007E8000-memory.dmp	family_chaos

Chaos family
chaos
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2216	bcdedit.exe
760	bcdedit.exe

Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4020	wbadmin.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SatanCD.url	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	SatanCD.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Warning.txt	SatanCD.exe

Executes dropped EXE 4 IoCs

pid	Process
3156	SatanCD.exe
1440	rat.exe
4880	rat.exe
396	SatanCD.exe

Loads dropped DLL 4 IoCs

pid	Process
4880	rat.exe
4880	rat.exe
4880	rat.exe
4880	rat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	SatanCD.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4249425805-3408538557-1766626484-1000\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	SatanCD.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	SatanCD.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f4bposgoy.jpg"	SatanCD.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001b00000002aa77-19.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4688	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	SatanCD.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3748	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
396	SatanCD.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
3156	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe
396	SatanCD.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	SatanCD.exe
Token: SeDebugPrivilege	396	SatanCD.exe
Token: SeBackupPrivilege	1368	vssvc.exe
Token: SeRestorePrivilege	1368	vssvc.exe
Token: SeAuditPrivilege	1368	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3024	WMIC.exe
Token: SeSecurityPrivilege	3024	WMIC.exe
Token: SeTakeOwnershipPrivilege	3024	WMIC.exe
Token: SeLoadDriverPrivilege	3024	WMIC.exe
Token: SeSystemProfilePrivilege	3024	WMIC.exe
Token: SeSystemtimePrivilege	3024	WMIC.exe
Token: SeProfSingleProcessPrivilege	3024	WMIC.exe
Token: SeIncBasePriorityPrivilege	3024	WMIC.exe
Token: SeCreatePagefilePrivilege	3024	WMIC.exe
Token: SeBackupPrivilege	3024	WMIC.exe
Token: SeRestorePrivilege	3024	WMIC.exe
Token: SeShutdownPrivilege	3024	WMIC.exe
Token: SeDebugPrivilege	3024	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3024	WMIC.exe
Token: SeRemoteShutdownPrivilege	3024	WMIC.exe
Token: SeUndockPrivilege	3024	WMIC.exe
Token: SeManageVolumePrivilege	3024	WMIC.exe
Token: 33	3024	WMIC.exe
Token: 34	3024	WMIC.exe
Token: 35	3024	WMIC.exe
Token: 36	3024	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3024	WMIC.exe
Token: SeSecurityPrivilege	3024	WMIC.exe
Token: SeTakeOwnershipPrivilege	3024	WMIC.exe
Token: SeLoadDriverPrivilege	3024	WMIC.exe
Token: SeSystemProfilePrivilege	3024	WMIC.exe
Token: SeSystemtimePrivilege	3024	WMIC.exe
Token: SeProfSingleProcessPrivilege	3024	WMIC.exe
Token: SeIncBasePriorityPrivilege	3024	WMIC.exe
Token: SeCreatePagefilePrivilege	3024	WMIC.exe
Token: SeBackupPrivilege	3024	WMIC.exe
Token: SeRestorePrivilege	3024	WMIC.exe
Token: SeShutdownPrivilege	3024	WMIC.exe
Token: SeDebugPrivilege	3024	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3024	WMIC.exe
Token: SeRemoteShutdownPrivilege	3024	WMIC.exe
Token: SeUndockPrivilege	3024	WMIC.exe
Token: SeManageVolumePrivilege	3024	WMIC.exe
Token: 33	3024	WMIC.exe
Token: 34	3024	WMIC.exe
Token: 35	3024	WMIC.exe
Token: 36	3024	WMIC.exe
Token: SeBackupPrivilege	352	wbengine.exe
Token: SeRestorePrivilege	352	wbengine.exe
Token: SeSecurityPrivilege	352	wbengine.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3156	4588	SatanCDD.exe	77
PID 4588 wrote to memory of 3156	4588	SatanCDD.exe	77
PID 4588 wrote to memory of 1440	4588	SatanCDD.exe	78
PID 4588 wrote to memory of 1440	4588	SatanCDD.exe	78
PID 1440 wrote to memory of 4880	1440	rat.exe	79
PID 1440 wrote to memory of 4880	1440	rat.exe	79
PID 3156 wrote to memory of 396	3156	SatanCD.exe	80
PID 3156 wrote to memory of 396	3156	SatanCD.exe	80
PID 396 wrote to memory of 4404	396	SatanCD.exe	82
PID 396 wrote to memory of 4404	396	SatanCD.exe	82
PID 4404 wrote to memory of 4688	4404	cmd.exe	84
PID 4404 wrote to memory of 4688	4404	cmd.exe	84
PID 4404 wrote to memory of 3024	4404	cmd.exe	87
PID 4404 wrote to memory of 3024	4404	cmd.exe	87
PID 396 wrote to memory of 2992	396	SatanCD.exe	89
PID 396 wrote to memory of 2992	396	SatanCD.exe	89
PID 2992 wrote to memory of 2216	2992	cmd.exe	91
PID 2992 wrote to memory of 2216	2992	cmd.exe	91
PID 2992 wrote to memory of 760	2992	cmd.exe	92
PID 2992 wrote to memory of 760	2992	cmd.exe	92
PID 396 wrote to memory of 3900	396	SatanCD.exe	93
PID 396 wrote to memory of 3900	396	SatanCD.exe	93
PID 3900 wrote to memory of 4020	3900	cmd.exe	95
PID 3900 wrote to memory of 4020	3900	cmd.exe	95
PID 396 wrote to memory of 3748	396	SatanCD.exe	99
PID 396 wrote to memory of 3748	396	SatanCD.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SatanCDD.exe
"C:\Users\Admin\AppData\Local\Temp\SatanCDD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\SatanCD.exe
  "C:\Users\Admin\AppData\Local\Temp\SatanCD.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Users\Admin\AppData\Roaming\SatanCD.exe
    "C:\Users\Admin\AppData\Roaming\SatanCD.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Sets desktop wallpaper using registry
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:396
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4404
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4688
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2216
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:760
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:4020
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Warning.txt
      4⤵
      Opens file in notepad (likely ransom note)
      PID:3748
- C:\Users\Admin\AppData\Local\Temp\rat.exe
  "C:\Users\Admin\AppData\Local\Temp\rat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\rat.exe
    "C:\Users\Admin\AppData\Local\Temp\rat.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:352

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1452

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SatanCD.exe.log

Filesize
226B

MD5
4ae344179932dc8e2c6fe2079f9753ef

SHA1
60eacc624412b1f34809780769e3b212f138ea9c

SHA256
3063de3898a9b34e19f8cf0beeec2b8bd6bd05896b52abd73f4703d07b8a7cd4

SHA512
fadfe2b83f1af8fdc50430325f69d6172d2c1e889ca3800b3b83e5535d5970c32e9a176b48563275a0630d56c96d9f88df148fd6b2d281f0fc58129e5f4dba19

Download Submit
C:\Users\Admin\AppData\Local\Temp\SatanCD.exe

Filesize
132KB

MD5
9c5ade58e1670dacf3a8ec7f695ce1f9

SHA1
fe99bc290ae1f0eadb34c558bcf313077f154d57

SHA256
1f6c05feabe71f2d0236fd74faf1243bcaac0c9b70e51a0e718988f088b138fb

SHA512
90fbc2b7b8a1a8347e1a6fd23649e113ed4ed9e95c5d2fae9ca5895615dd8f6621546a2a8a5a3b1cdba6e6ecd8fb48337250d281ea5b5bf12c5b2ff8ec9c23d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\VCRUNTIME140.dll

Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\_bz2.pyd

Filesize
78KB

MD5
e877e39cc3c42ed1f5461e2d5e62fc0f

SHA1
156f62a163aca4c5c5f6e8f846a1edd9b073ed7e

SHA256
4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f

SHA512
d6579d07ede093676cdca0fb15aa2de9fcd10ff4675919ab689d961de113f6543edbceecf29430da3f7121549f5450f4fe43d67b9eab117e2a7d403f88501d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\_decimal.pyd

Filesize
241KB

MD5
95f1be8c2d46aa4b5ad13f4fbb228c31

SHA1
0b520b00e4fc9347094fcb687c812d01b903e70c

SHA256
f7864b8b37715a87f4f11d5cbfefd5f1489399e064f7662fa0e0d7c5df59d5e4

SHA512
b3f6e94b7b4646954af51da36a80e0de3e40c0b674c1abfe735177635582a33492daf14f39383644751618c2b1ecf05ff0877eb86bf6c9d5f197a951d596fddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\_hashlib.pyd

Filesize
57KB

MD5
4fb84e5d3f58453d7ccbf7bcc06266a0

SHA1
15fd2d345ec3a7f4d337450d4f55d1997fae0694

SHA256
df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c

SHA512
1ca574e9e58ced8d4b2a87a119a2db9874cd1f6cedef5d7cbf49abf324fb0d9fb89d8aac7e7dfefbeb00f6834719ed55110bcb36056e0df08b36576ffd4db84c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\_lzma.pyd

Filesize
149KB

MD5
80da699f55ca8ed4df2d154f17a08583

SHA1
fbd6c7f3c72a6ba4185394209e80373177c2f8d7

SHA256
2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20

SHA512
15ea7cd4075940096a4ab66778a0320964562aa4ae2f6e1acbe173cd5da8855977c66f019fd343cfe8dacc3e410edf933bce117a4e9b542182bad3023805fd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\_socket.pyd

Filesize
72KB

MD5
7f25ab4019e6c759fc77383f523ef9af

SHA1
5e6748ce7f6753195117fdc2820996b49fd8d3af

SHA256
d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95

SHA512
a179b22c61f661e4d9b17f56b6a7f66f2d8d8e1d2a9a8aca3c4d6a9cb7755ce6d223bfbca817c1098692a39b6fc20ffbdacefd9bfb47ff02ffa47badca437514

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\base_library.zip

Filesize
858KB

MD5
83f4197270ea38686da39ee92aaa2c77

SHA1
e1a54a451528e6bc61ced24bb532228d1e629673

SHA256
7e5782216bedc50a76329efe775459e5f08f366f1b12ff83902a5b6e402934e2

SHA512
a723dccb0562787609643376329104478b3ae911950bf05adad302b724131d42bdd428bd95953196c6323a20563ff5bd89d803cbf4af5f05146f546b889b030d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\libcrypto-1_1.dll

Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\python310.dll

Filesize
4.3MB

MD5
316ce972b0104d68847ab38aba3de06a

SHA1
ca1e227fd7f1cfb1382102320dadef683213024b

SHA256
34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e

SHA512
a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\select.pyd

Filesize
24KB

MD5
589f030c0baa8c47f7f8082a92b834f5

SHA1
6c0f575c0556b41e35e7272f0f858dcf90c192a7

SHA256
b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010

SHA512
6761c0e191795f504fc2d63fd866654869d8819c101de51df78ff071a8985541eec9a9659626dfcb31024d25fd47eff42caa2ae85cc0deb8a11113675fac8500

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14402\unicodedata.pyd

Filesize
1.1MB

MD5
ababf276d726328ca9a289f612f6904c

SHA1
32e6fc81f1d0cd3b7d2459e0aa053c0711466f84

SHA256
89c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631

SHA512
6d18b28fb53ffe2eebd2c5487b61f5586d693d69dd1693d3b14fb47ca0cd830e2bd60f8118693c2ff2dcb3995bbfcc703b6e3067e6b80e82b6f4666ca2a9c2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\rat.exe

Filesize
5.2MB

MD5
95d5d7e014fff5334590aaf922ed22ee

SHA1
171bd3c05e7cf12e2f255886aea56d2ce5286395

SHA256
53dbef0b7cb1cd7984c51db29368031b5ef6c36d0f8a39b17f88486e41b95312

SHA512
eea7d314ce4efa5889a0396c4c5772b180461143296ee5c364a723b72d630e2aa8530edd79520013665e954708edba8a43b2c482b91e5f13f97dab9f1b53a0b6

Download Submit
C:\Users\Admin\Documents\Warning.txt

Filesize
706B

MD5
300586f0cf0ad8e334b1e73055801333

SHA1
83c3735f38be9374a634dc20cb2d20ac8016b75a

SHA256
b96613eb6c6f2b5ef14fab4344c65863f0272d43f4f4f167204da10e1665b8c0

SHA512
939b8c781a4dc40daf25c41d9a9da3a24f61998e8bd55af2347e47ffce14aa8fa82f22e69c7a22d9788d7b57660dcbc838781290497876db03d9f5899ae84115

Download Submit
memory/3156-20-0x00007FF8ECA50000-0x00007FF8ED512000-memory.dmp

Filesize
10.8MB

Download
memory/3156-14-0x00000000007C0000-0x00000000007E8000-memory.dmp

Filesize
160KB

Download
memory/3156-53-0x00007FF8ECA50000-0x00007FF8ED512000-memory.dmp

Filesize
10.8MB

Download
memory/3156-67-0x00007FF8ECA50000-0x00007FF8ED512000-memory.dmp

Filesize
10.8MB

Download
memory/4588-37-0x00007FF8ECA50000-0x00007FF8ED512000-memory.dmp

Filesize
10.8MB

Download
memory/4588-3-0x00007FF8ECA50000-0x00007FF8ED512000-memory.dmp

Filesize
10.8MB

Download
memory/4588-0-0x00007FF8ECA53000-0x00007FF8ECA55000-memory.dmp

Filesize
8KB

Download
memory/4588-1-0x0000000000C80000-0x00000000011A2000-memory.dmp

Filesize
5.1MB

Download