2cfb363bfa569711844aa32f5f71fdfec0b7eb55cdc445d3283ffcd501b4b087

Analysis

max time kernel
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransom_midium.exe
Size 17.0MB
Sample260906-vmjppsdp5s
SHA256 2cfb363bfa569711844aa32f5f71fdfec0b7eb55cdc445d3283ffcd501b4b087
MD5 c3a139810a20c648d99ec29fd338774e
SHA1 37fe51797f705a3b3c1f759a15294463e3c3915a
SHA512 8653c2bb14beb193fcc8ca4e0e731d26357e0425d4aade97cb845ea840e426b61f53a4d86a735efab1072b6b62e6eb0690f4bf1cc101ea7ce5724a1d8b34d024
SSDEEP 393216:t5Xd/+OiW8dko5aEztGDvV+53SM8+hxpjGd8LwqeweZs53ygU:tldWVW8NLzOvV/M8+bMdaVepZcyg
TLSH
T1AF07338F7BB00876DB98F179C4E8C806A3A5B4566774C6A72BED0A611EF71D8DD30318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion ransomware

Malware Config

Signatures

Loads dropped DLL 41 IoCs

pid	Process
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
4920	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe
2132	ransom_midium.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI29042\\assets\\red_wallpaper.bmp"	ransom_midium.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Colors\Background = "118 0 0"	ransom_midium.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\WallpaperStyle = "2"	ransom_midium.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\TileWallpaper = "0"	ransom_midium.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1860	powershell.exe
1860	powershell.exe
5884	powershell.exe
5884	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4920	2904	ransom_midium.exe	89
PID 4920 wrote to memory of 2132	4920	ransom_midium.exe	90
PID 4920 wrote to memory of 1860	4920	ransom_midium.exe	91
PID 4920 wrote to memory of 5884	4920	ransom_midium.exe	93

C:\Users\Admin\AppData\Local\Temp\ransom_midium.exe
"C:\Users\Admin\AppData\Local\Temp\ransom_midium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\ransom_midium.exe
  "C:\Users\Admin\AppData\Local\Temp\ransom_midium.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\ransom_midium.exe
    C:\Users\Admin\AppData\Local\Temp\ransom_midium.exe --recovery-watchdog --parent-pid 4920 --recovery-path C:\Users\Admin\AppData\Local\DoorsRansomSafeSimulator\recovery.json
    3⤵
    - Loads dropped DLL
    PID:2132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -EncodedCommand CgBbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwB1AHQAcAB1AHQARQBuAGMAbwBkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AVQBUAEYAOABFAG4AYwBvAGQAaQBuAGcAXQA6ADoAbgBlAHcAKAApAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAcwBoAGUAbABsACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAVwBTAGMAcgBpAHAAdAAuAFMAaABlAGwAbAAKACQAZABpAHIAcwAgAD0AIABAACgACgAgACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0ACsAUwBwAGUAYwBpAGEAbABGAG8AbABkAGUAcgBdADoAOgBEAGUAcwBrAHQAbwBwAEQAaQByAGUAYwB0AG8AcgB5ACkALAAKACAAIABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABGAG8AbABkAGUAcgBQAGEAdABoACgAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAKwBTAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAF0AOgA6AEMAbwBtAG0AbwBuAEQAZQBzAGsAdABvAHAARABpAHIAZQBjAHQAbwByAHkAKQAKACkAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfACAAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBVAG4AaQBxAHUAZQAKACQAaQB0AGUAbQBzACAAPQAgAEAAKAApAAoAZgBvAHIAZQBhAGMAaAAgACgAJABkAGkAcgAgAGkAbgAgACQAZABpAHIAcwApACAAewAKACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGYAaQBsAGUAIABpAG4AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGQAaQByACAALQBGAGkAbAB0AGUAcgAgACcAKgAuAGwAbgBrACcAIAAtAEYAaQBsAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsACgAgACAAIAAgACQAcwBoAG8AcgB0AGMAdQB0ACAAPQAgACQAcwBoAGUAbABsAC4AQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0ACgAJABmAGkAbABlAC4ARgB1AGwAbABOAGEAbQBlACkACgAgACAAIAAgACQAaQB0AGUAbQBzACAAKwA9ACAAWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAIABwAGEAdABoACAAPQAgACQAZgBpAGwAZQAuAEYAdQBsAGwATgBhAG0AZQA7ACAAaQBjAG8AbgAgAD0AIABbAHMAdAByAGkAbgBnAF0AJABzAGgAbwByAHQAYwB1AHQALgBJAGMAbwBuAEwAbwBjAGEAdABpAG8AbgAgAH0ACgAgACAAfQAKAH0ACgBDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgAEAAKAAkAGkAdABlAG0AcwApACAALQBDAG8AbQBwAHIAZQBzAHMACgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -EncodedCommand CgBbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwB1AHQAcAB1AHQARQBuAGMAbwBkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AVQBUAEYAOABFAG4AYwBvAGQAaQBuAGcAXQA6ADoAbgBlAHcAKAApAAoAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACQAagBzAG8AbgAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAFcAMwBzAGkAYwBHAEYAMABhAEMASQA2AEkAQwBKAEQATwBsAHgAYwBWAFgATgBsAGMAbgBOAGMAWABGAEIAMQBZAG0AeABwAFkAMQB4AGMAUgBHAFYAegBhADMAUgB2AGMARgB4AGMAUQBXAE4AeQBiADIASgBoAGQAQwBCAFMAWgBXAEYAawBaAFgASQBnAFIARQBNAHUAYgBHADUAcgBJAGkAdwBnAEkAbQBsAGoAYgAyADQAaQBPAGkAQQBpAFEAegBwAGMAWABGAGQAcABiAG0AUgB2AGQAMwBOAGMAWABFAGwAdQBjADMAUgBoAGIARwB4AGwAYwBsAHgAYwBlADAARgBEAE4AegBaAEMAUQBUAGcAMgBMAFQAZABCAFIARABjAHQATQBUAEEAegBNAHkAMAAzAFEAagBRADAATABVAEYARABNAEUAWQB3AE4AegBSAEYATgBEAEUAdwBNAEgAMQBjAFgARgBOAEQAWAAxAEoAbABZAFcAUgBsAGMAaQA1AHAAWQAyADgAcwBNAEMASgA5AEwAQwBCADcASQBuAEIAaABkAEcAZwBpAE8AaQBBAGkAUQB6AHAAYwBYAEYAVgB6AFoAWABKAHoAWABGAHgAUQBkAFcASgBzAGEAVwBOAGMAWABFAFIAbABjADIAdAAwAGIAMwBCAGMAWABFAFoAcABjAG0AVgBtAGIAMwBnAHUAYgBHADUAcgBJAGkAdwBnAEkAbQBsAGoAYgAyADQAaQBPAGkAQQBpAEwARABBAGkAZgBTAHcAZwBlAHkASgB3AFkAWABSAG8ASQBqAG8AZwBJAGsATQA2AFgARgB4AFYAYwAyAFYAeQBjADEAeABjAFUASABWAGkAYgBHAGwAagBYAEYAeABFAFoAWABOAHIAZABHADkAdwBYAEYAeABIAGIAMgA5AG4AYgBHAFUAZwBRADIAaAB5AGIAMgAxAGwATABtAHgAdQBhAHkASQBzAEkAQwBKAHAAWQAyADkAdQBJAGoAbwBnAEkAawBNADYAWABGAHgAUQBjAG0AOQBuAGMAbQBGAHQASQBFAFoAcABiAEcAVgB6AFgARgB4AEgAYgAyADkAbgBiAEcAVgBjAFgARQBOAG8AYwBtADkAdABaAFYAeABjAFEAWABCAHcAYgBHAGwAagBZAFgAUgBwAGIAMgA1AGMAWABHAE4AbwBjAG0AOQB0AFoAUwA1AGwAZQBHAFUAcwBNAEMASgA5AEwAQwBCADcASQBuAEIAaABkAEcAZwBpAE8AaQBBAGkAUQB6AHAAYwBYAEYAVgB6AFoAWABKAHoAWABGAHgAUQBkAFcASgBzAGEAVwBOAGMAWABFAFIAbABjADIAdAAwAGIAMwBCAGMAWABGAFoATQBRAHkAQgB0AFoAVwBSAHAAWQBTAEIAdwBiAEcARgA1AFoAWABJAHUAYgBHADUAcgBJAGkAdwBnAEkAbQBsAGoAYgAyADQAaQBPAGkAQQBpAEwARABBAGkAZgBWADAAPQAnACkAKQAKACQAaQB0AGUAbQBzACAAPQAgACQAagBzAG8AbgAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuAAoAJABzAGgAZQBsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAoAZgBvAHIAZQBhAGMAaAAgACgAJABpAHQAZQBtACAAaQBuACAAQAAoACQAaQB0AGUAbQBzACkAKQAgAHsACgAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABpAHQAZQBtAC4AcABhAHQAaAAgAC0AUABhAHQAaABUAHkAcABlACAATABlAGEAZgApACAAewAKACAAIAAgACAAJABzAGgAbwByAHQAYwB1AHQAIAA9ACAAJABzAGgAZQBsAGwALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKABbAHMAdAByAGkAbgBnAF0AJABpAHQAZQBtAC4AcABhAHQAaAApAAoAIAAgACAAIAAkAHMAaABvAHIAdABjAHUAdAAuAEkAYwBvAG4ATABvAGMAYQB0AGkAbwBuACAAPQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABfAE0ARQBJADIAOQAwADQAMgBcAGEAcwBzAGUAdABzAFwAcwB5AHMAdABlAG0AXwBzAHQAbwBwAC4AaQBjAG8ALAAwACcACgAgACAAIAAgACQAcwBoAG8AcgB0AGMAdQB0AC4AUwBhAHYAZQAoACkACgAgACAAfQAKAH0ACgBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewAgAGMAaABhAG4AZwBlAGQAIAA9ACAAQAAoACQAaQB0AGUAbQBzACkALgBDAG8AdQBuAHQAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0AQwBvAG0AcAByAGUAcwBzAAoA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\PIL\_imaging.cp313-win_amd64.pyd
Size 2.5MB
SHA256 88756e8e0e3f6180e518da25d379597c861e2d20d716ef001894789b515c1777
MD5 2a2cc91e89b4c2ffd8a3b7c9ff1ba501
SHA1 1b8f537b9c43be807913326947d363d3666ef081
SHA512 a84257af721b6c402fea294ac9e5250423917535dcc17d6e18a860e7e489a463911467d67dc473f8d79881a09679e180a845931285d23d6cbb8287dcf4c2b3bb
SSDEEP 49152:XgfxvpYq3LG6bjJ9HQUfBA9f21kExA+RERbF3:apY+G6bgU5AuAD
TLSH
T128C57C02F591589ADA724034CDAAD626E371780D1BF186F7B684A7F93A33BD03937385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_bz2.pyd
Size 83KB
SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
MD5 ed9f4c1cf33db08cac3c7ba7a973e61b
SHA1 b0db47ca7be3df00d1585fdabe13fb983cfed04d
SHA512 dc5f79944f9acf910d4af892d8a7c2368d2de29bf8ade2feecb056b2b3416d55bd22aacd16a7dc4488c4a1a5682409430f6f210e7396af4f14fd5f307ba1926c
SSDEEP 1536:OZ5Az7KPZG1uDiYhGlHjecH7rYiUO18aBso6lIyLVryrcz89SfIie:mWzdMiYQzrAO6aCo6lIyLV1cZ
TLSH
T115839E82F39967F2F49B81B546C10757F770BA51075093AFF288C2952F03B91AE6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_ctypes.pyd
Size 129KB
SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
MD5 ab19e3dd4731ed075589abadcde68991
SHA1 b51ed4059d7d0ec7cbd5b34767e310bdee9cb4d4
SHA512 6aa9cb0e5cc9514d71bf7a2ab21d24a3fd5ef0eb0f0e7bf26a4a807914c7a3cadf73e1bd6cdd9f31d8594b72272eaccc79632f9dfd9534da5c8217d0eb0e9cda
SSDEEP 3072:oNxNJni/7u3vSKflXTf/FIBIQ0Jr3rc1mAj5IyyPhnIH:a7ni/7IvBjf/FIWQ2r3I1mqvH
TLSH
T115D38D0B775800AADAA79178C573AF47DBF1B453161187CF02A4C69A2F637936E7E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_decimal.pyd
Size 273KB
SHA256 90045140e45edcfe4f4859b3190184faff1249220011330a9d01319745766607
MD5 90071379b9e53b2d1834d49f4fd804ec
SHA1 c4cde25cff9cbf90c55bf908bdaa8a14a82311ad
SHA512 a67feade76fda58faa8a9842f6a07d8b12eb477c5baaf51f323de90fdcc8c5f62f2a756f30e1ea494b95eaaededbbe95f2aaf6659175e6e141057af0aac6f514
SSDEEP 6144:nkzuKqPj7/lk9VLCLko0Xoy9qWM53pLW1AyH3V+METaei6g:nxLlk9VmLko0Y7ePXV
TLSH
T127546C97A2090CA4EA738474D95B9B47F7F278960321C78F43A48AA73F93393636D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_lzma.pyd
Size 156KB
SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
MD5 d165b7b9a127f66704ceaa196be319e5
SHA1 ee3de55b32d1357599cef86df35e307477038a15
SHA512 b99214ce14899656f9c0fd23b219d06de383aff95b344def145a9304c47e41b1645bd3544f4fb83ac070d42951de228873a99feb98948910fdd0e7fcc54a3122
SSDEEP 3072:r0Vfr5vC9v2J2dE2AowznfB9mNouhD28ztJLlIy01nF7qV:rSr5YBW5YOufpJL49y
TLSH
T142F35C86B794F0E6F7728C38D6624F57E7F5781A0310929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_socket.pyd
Size 84KB
SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
MD5 c2938dbdcdaba1ccbefee37f6a06cd0c
SHA1 944cb024144f327ba517ccf72af9bb9a79b8b23e
SHA512 79e9f40665b7049c9feb04742a91c8c88749c1998794f1a51ac7b47a5f5ac3c1a2b441dcb9cd126e395581d9553305c24356b54d81d0a9fbecb41a4341af776f
SSDEEP 1536:axl/h+6SDo3OkB+ecI4xyJwoQlyJ+9+nzpjTOKxtS44O05IyywFyrcz89jfIW44a:axko35X4yJwoQlyJs+nzlqKxBw5IyywZ
TLSH
T154836B10A69041FAEB63D1B5C2639E63FBB4B5C11391A35F0066C55A1F333C2BF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\auto.tcl
Size 21KB
SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
MD5 97efa9ebe840ea051f9706504c8bd783
SHA1 287dea14d47977dcd8edc525fe750c836264db5c
SHA512 ab9fc210f3bfd181cc2b93dd348415f67f763b2c7961179a88eba3f7f87e44b21a66ea4ea53715fb88784288c75b8270640f3bc6beafb0e8cc21966068a79bf2
SSDEEP 384:UqT9XC9VZvWQjCTzsCTV7672ORgS0myvxFRTX7Xvt3wBTnbXhCUquyvz:LT9XC9VZvhjCPsCp7JlmyvTxvt3gTnbW
TLSH
T1EFA2B7635F9542A630B1C22B553DB9A4EF2F81B70675801D38F8912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\http1.0\pkgIndex.tcl
Size 746B
SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
MD5 a387908e2fe9d84704c2e47a7f6e9bc5
SHA1 f3c08b3540033a54a59cb3b207e351303c9e29c6
SHA512 7ac804d23e72e40e7b5532332b4a8d8446c6447bb79b4fe32402b13836079d348998ea0659802ab0065896d4f3c06f5866c6b0d90bf448f53e803d8c243bbc63
TLSH
T1720110C7AEF563A02C318B82364BE791DF1DE218F37256FA7450541C80A3866AB4A934
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\init.tcl
Size 25KB
SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
TLSH
T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\opt0.4\pkgIndex.tcl
Size 636B
SHA256 68accee3eb8d0f134f9472c95425190ec08e7793df20a58d7d35325f42804695
MD5 93a0e83ab0a3545c206dc54e1206e368
SHA1 45fd706f83c43a7318358033e553d8c9b3210e4e
SHA512 6e18c1bc98bd2d838570fcc68333aeee7fedc746547484fb09f3b7105bd198bd5201a0ce4e647d16655125fa764c676b7ba4bec9c992e37b438e199c708e643a
TLSH
T17BF00266EFE183A495618CC33644F7916F2EF078726010F57414E49CE2A00A75F9F471
MD5 SHA1 SHA512 TLSH

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\package.tcl
Size 23KB
SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
MD5 6a7b6485d3b290fc5d412ed1d62a170d
SHA1 50475e80e3969de279edfb1bf8d9c19694c36c0b
SHA512 36ced797ec18d4aa68fcce57f6eb510e78508d14646cf43ea2effb6f2cf88529d0cb5a4a136fb1252edbb95cba646bdcd19a8cd90a86b19fc28bb9611e2ccb73
SSDEEP 384:8xgrmNIpEHsDAW2UfnImRqXqQx6XmchmCWhzPLrXJjJh6PLfzd7lG:8xgrmNIwsDnvIm86QGRhLWhzDzJ9h6DS
TLSH
T14BB2C821B389915A34B153639B352D8CCF3EC0FF51A951BC78D482BC776092A0ADE7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\tclIndex
Size 7KB
SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
MD5 42ec37eee38d6dd33a9fdecd7f1cd0aa
SHA1 6c8c93e5e5350d93f63f3f99d587ab8fb5aa496b
SHA512 37d61f27da79c494d225543828c9a29f1397c57506d609481036bfa2a336ec3110e6d10670edcf211a5714629eeb7e16dbf04a8388bc6bb420584edc06dc534d
SSDEEP 192:eeV1ffxNFxI5XgipSSMw+5p3fphBr2tm87RtmAjm2G03BgPlKif8Qyly5mg2lkYf:eeV1ffxNFxI5XgipSSMw+5p3fphBr2t/
TLSH
T1C8E12C1AE354C51883E485174959DE983AFEE298D32CCC7EDAB491ED10B20176FEE4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tcl_data\tm.tcl
Size 11KB
SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
MD5 5746f2c35a7c434a78cc127f8d522e8c
SHA1 0b438de8ddc24b2d805a5db2c8c9432a52c6e53a
SHA512 0a9038474b7bdb9469b7684b5b3867982a29bebbdf017d2dd21edcdd79dd3f67f4d99cdc0a11b3aa7b170b25644ead896489edb9a9a692ca654c0e7bed95ff42
SSDEEP 192:55CjnlRfMf8aOH5bEcKBNkkrgpCmqkkuoBoh9PTYMsvSO+Hy1h/1uKisM68E:5q3MfmH5bEHBNkkrgomq/u5PTYMC+S1Z
TLSH
T15F42B512B3CA536A62B313155EBAF294DB2DD1FE17E5506C744D81A837208280B7F7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tk_data\pkgIndex.tcl
Size 376B
SHA256 6127926b94db2992ab450fc6cc2ec3d071f7bbc856656d0ae20cc3fd4036f547
MD5 62a8e4b5aeb35286e3b1d54973139a13
SHA1 1064e7e2765f9aea5d06ebdd932c689a877613d5
SHA512 919e9a1c7d02cc886bb3901fd0d2966df0f5456f4646310d5762cd74c5b78f2b1b542b3be78e22dc9b070ea1bbf401dda7ecba223b1b1851feea028047bcbe8d
TLSH
T1DCE068C84321AB1A4AA26543A894EE4C3FEE90BFD90CC18D301521DCEF12080A9DD8F5
MD5 SHA1 SHA512 TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tk_data\tk.tcl
Size 23KB
SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
MD5 7e46d32c3e70dbf17663f57e17d18dfe
SHA1 394dd3cde6a7e41855917060f4388478a0a84668
SHA512 6125e9b6c213e48e4a7a47acc0be3b930ddd9aca2132817f1906a2453e0d0b8292e7b2090bab8712856d12d2cf4d119238f16fae0fb57dd66da4db8fb3d92b0d
SSDEEP 384:Nbyxt+WaB9USY15gSgC3DbTbXLXKr3aIIXyDAbK2LMGgtewT+3oFQRyH5bAy59HU:NbItNe9USZbeXysm7GgteoFQRYMESL
TLSH
T11DB2D5195DC062B3513BC12F53BB2A00D87558FB2B76A84978DC48B93F6483B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\_tkinter.pyd
Size 67KB
SHA256 574549683a4298335bdb8761ec6eaa11d56e366b618b5ab0b701b5fe2dda48aa
MD5 3aa9cd197097575a1cd85c4b60b1489c
SHA1 973644b7c6c66e0c0ac0bb6f82600c1e62669ab8
SHA512 b616be273ac160f3c344fee6506f3f90948aa2fb12ac09da5a02e3ef8292614d7257a91b5607978675905ee377aef0640e75d43b5ed70d3799313a6793f17607
SSDEEP 1536:mxIxVo3bb7sOOkQ48jV3RNEFlU9ow9oVZfd2TkR9IyvSLyrcz893fITZ+7:maerFQfulPdVZF/9IyvSVvk
TLSH
T1AD638E9BA7A4008BEEE3D539C4739B13E575B6924A14924F01E4D34A2F333D3E7AA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coin_token.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\coin_token.png
Size 118KB
SHA256 47b16bed1e6de0256192fa593103eda40006288f7a8247b14643793db9680750
MD5 05b78beaed4e36d686989f924aa30d85
SHA1 c02e95cd0bff3351c4b317977a531147ee4674d3
SHA512 d6cd4c783402bb5cb4979023b47be32db90c7329c7029a5c9e5580a79bec230bd934d9609634c01d86819cc8f3436094fb873b742ed180b71d98e743cf531d7e
SSDEEP 3072:yKzzQxYyJH97G1taqIkVTClKBrOqFjsbAZ4sWCq2bCML8NNJ2O:DziH/7aaqIkBrCo+wz288kO
TLSH
T180C31283ED9AFEB4922978E405AC0A604F75747013396DA751F606817F9FD03C3AED82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

final_face.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\final_face.png
Size 15KB
SHA256 da4383438603deaec36809cff6d7de8868e9b80b9e064e5b7fe6c3e9730b3755
MD5 9ea935ac36ccca3bffd136d280e146d8
SHA1 fefd8156fa00bb6aeaacc2503697c91bc25b54c1
SHA512 52050a243e9333f71bd6389927ad866c9894f09d27d241d8ece0c8c1c9c6fc07256ec31b2da1170b37148d8e6a4535ac06839e066e2232b5a6a8bafbdc7a0375
SSDEEP 384:bBlojug/nlJgCyerhE937g0lbvzauB7wijdsFiB:bHoNDgCZrhE937dCodl
TLSH
T1E272C0A7A92ABDE9A7D0B7636724747E45C6F00098972D348E61441D1EB77E480FAF08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flash_face.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\flash_face.png
Size 36KB
SHA256 b87365b393497487e2a2abd0bbc91db46ba66af41d1a7066168ad778a3eff976
MD5 49409b4533af1101273112bda8b6c8f6
SHA1 db537006621d07a0cbffc7db9299dc390994670c
SHA512 81ab1fb12e396fd816f102bfc3492a19901638d99f58ab7d52ec1d0068f19032991d9df3c794754f20725251ba489f57a4a9bc3ad5bdfaacca1fc3b36638381b
SSDEEP 768:R/BkuZNXOaAWJo2njjxNRPH/hp5Yue0U7rqgrhpIN+oC6lHaXKTRM4:7XZAaDnjjxNRzmu0uF+iRj
TLSH
T1D403F2DFA58026B38769C00AA4BF1ED380B321E45059DB96B8893D5DF5C7BFC4518AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch_1.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\glitch_1.png
Size 23KB
SHA256 14c8676693cc09a2135ec3e9aa61318494af455b4cd32f3c61bf13f4cafdc965
MD5 9a104e8181cffdb5a24476ea6e069e40
SHA1 4a4d0336696bae189af24c98e08ef57d117abf82
SHA512 752e47d0e4a883596a4e32613e90b082f54d365a6a64467f1c28078d3ceb3ba5fe285884a9849807f4612c8abcc67f5bbd0b55ed6d9fd1acac2154fd45fdac7c
SSDEEP 384:2AXGWPZX+wJaagUQFiPp3ee/BjyXRQoab0YRF4L/6DTcxyGxGM8lB5a73EA/QhDJ:F2YpJaabQQR31dRF+BpxGSbEAIpuZTKZ
TLSH
T1A5B2E1A181CD4E9243DE037D8689F2791811C8668CBD610F4D3ECA6C6789BFB0CD1C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch_2.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\glitch_2.png
Size 4KB
SHA256 862add7ee0b7299d3a7de336e328fdb3693b271973c55cbde3d44c53f149437e
MD5 5ef2cc42056ad8aa10bb90d85be60c79
SHA1 ee4044467d849a1b115f1f10316cc7385995021e
SHA512 c1d89c564bd077dab7dd5b9731b3ed06650564b234b6e0a48111fcbaaa62aa605327265ab8ae46bb50e74db75a787f590b0e9876f94f2dc78ee331597e2cfb97
SSDEEP 96:E/yfFcWXYrW//2D6i0UwFEPtSZjCWBdBQxbVAo/uAKrfnv:EqCuYk290U0ItNVAo/crfnv
TLSH
T1DB918EF1B642ECF8985E64E55F00A0B1452CEB1107C23A258C9691FEDFA2D381CE08D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch_3.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\glitch_3.png
Size 25KB
SHA256 ca7b63ca12679d48845fad021e917f60a7e666fd8bb6dcb5ba3938950611b7ef
MD5 e30f55f7da8e6f6263ce950ef5aa6107
SHA1 c896bc304009c9cf84faf3f4ea18f4028cf7192d
SHA512 a8463c819141097bdd935908246d836fd5e775b88c48e8390c752594688e8a799bd8ebe87c4041dd3c61e35fc28b4980a9947f798aacc615691f3e874034ff3b
SSDEEP 384:Lm7XTsQdoHOEvyUuPrGESJ08abxztHMoXtmJddPxMfWU/zrWYGXTsCUO5zu2hoNC:a1+Ok8lS+JhtlipMfW+lGTUO5i2hoOHz
TLSH
T19DC2E1989138516479BE402F49A420A5F43E02EE57A2DEC11D438AF834D7F4FF7D6D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch_4.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\glitch_4.png
Size 30KB
SHA256 ef0ff75097fe0f156bdb430f744b2cd684897da39d2315ff21fbf2d100e621e5
MD5 b5336d0f5dacb202562dab8d8b928deb
SHA1 be7a0291c7cb98354b1213ca0984fd502d3dcdcf
SHA512 9803e2c550b7cf463c8381e2de3a656ecac7284a6eb24187748d86c210f5a0907bd48ee6ef1d1d71e3f1d3e315f91810d7f613a716071cb30c4115b5aaa4eec9
SSDEEP 768:6V84HltGhouk1KV9H9KYnoSx6xgoAiCmbnZbupZ0BqXkPxky2cR:6mEuop4dKAx8omL3wX7E
TLSH
T1D0E2E1A739C80735AE1B23107BE9A1A758F881913214622F1BF4F47BCD693514E69E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch_5.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\glitch_5.png
Size 6KB
SHA256 1a791f318b2df71671db604f2d99a486f70f06fafe66f0e33b6c356c1084c1fb
MD5 2d615bde72bcd487eb72852d991b9d5d
SHA1 9d29878b2320288937b405c09b0519200c1ee29d
SHA512 9ca630afb698c9d74da746eb4b37611acb99960698b58bc19b4ac620e750399a5439a5346ca38d55fedb9770243c63e9aea51a5777257ea65627c41ca56b1401
SSDEEP 96:TB6ZedvnoNeLUsJAc8AUgf0VmE3uImk89yCU6aAI+q1KHxcGG4UAkH4vTBl9dyCm:oZovnoINyAIusolYtKK4S2BdPm
TLSH
T183E1B01174BCCD7FB3BE8AF3F69410A5326468586CCEDB4F70978E4E4059E0314946E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glitch_6.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\glitch_6.png
Size 30KB
SHA256 d1039ec7446749627288b062a3ffb69072d0a0c3b8f714d4c92e7fca5a3f07ae
MD5 21c62ff1557abc86e24c8226044d66aa
SHA1 ce754544550c702fd84e5672f315fb817cead62e
SHA512 1625a5ff80510c47de65f4f13f11f63c0acf7f71c71139978834a27677bb06a4aeffbfdab21cb8307c2957b48f4cd192594a9937f210c80c8b3b03b86ec16c5f
SSDEEP 768:s3H/yKA/DP1EZDvP6qGDfTjZSq4+1Getp30MDxwQgjEOv9:8yKszGZTPjmfTsx+s4p3jxwQBw
TLSH
T1A5D202AD9B9E8AEB338A089D273C1063347CD1E8576227D438AA34E59544BA0DF6E50D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ransom_face.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\ransom_face.png
Size 118KB
SHA256 f8b635b98aca9a57376258aecd93401e67de26996de9976aa44b5a62d0ea67b4
MD5 e0105748472388dcebfb1a2348b41010
SHA1 5fe83f852c08689020be443982910670f4627f63
SHA512 c94cae9082c0d79a24fcb2f303ec2f9267126b085c56ac056b9b06239ad0f4c0eb208ee7b4cd45cb08171238d3a343ddde0f72599443d6a8913d50f7bd2eee21
SSDEEP 3072:ZsaubG9gY2YTZGdT0MA/RTzmZHZwWgfU7aGS40JB1:SZbSB007Q5ZwLj1
TLSH
T1C7C3127D60F8335A89AB2F580D42C2C2354BB1854FFA1901986ED198325276BF3E9FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ransom_note.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\ransom_note.png
Size 19KB
SHA256 2f93339971d0b037d189ff0b56ece75dc7944d9b837bcb6dcc151dfae5f3d38b
MD5 4843e7f378ff009c6452d44cb2fd138c
SHA1 4769ce8d1d225d2f1fb0fe5d463fc9ab56f02c6d
SHA512 0f0c9b23687e0563d867056db0b714c595f72f3a7f81b79dbdc782e541136ebe3df9ee6ee4095a2a3a20b679d7546a0611f004d14aa9a6b04f73f778d4e89e7e
SSDEEP 384:+vBxLRaFMEgCCjkd/8AYoa9ytQx4k8pgFWzt2MOmlPzXOwmkYuWf:WB7aFeCCsxQ9ytTk8uFWzsxAPKSXWf
TLSH
T1CD92E09DCA4520782E3B697ED8DC4182E8B9FD7818B58AEB3D98D66558F707029C37C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stop.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\stop.png
Size 5KB
SHA256 dcc0c1728d94bd73a3f415baacb737650f8baa5976e9c79a9f1ac84ecc739302
MD5 6cfd0f8b408610ba325774cfcfa208cc
SHA1 38d20d37933edf3f0c55692aff21d9f531542294
SHA512 c1cca5d5b5b0ca7b13567a0988b7ec81a60764ef6afb25d5ea1a0f0fe4cec576aaffa58d4b8a35971fcbd9d2da9a723e9be5a6a33cde8899448a3531b3b9ca92
SSDEEP 96:2O7oogvRGHpvLgWKjXPaYP7gBdlUy4WGO1WDwSkQ0WUmMYfh20FHCF70g:2ldepvLgWqPa0g6y4JO15SkpWHMYfh2V
TLSH
T1AAB18D3B688EC60902F884E24D98C91616E65921B5B6697511C8F20F7F0FA923D6DE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stop_reference.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\stop_reference.png
Size 1.1MB
SHA256 f2112165903d260151d9b7507fde86d78331dae9fea7a318de1494e45f0b9d44
MD5 c748bc140a137728008adfab049830ee
SHA1 e18579860d63d503c95d25e646617107853e8455
SHA512 278c73c8df46f5c8fa6a5cc01b435c118d05b2d7661a9623383e9c4ef8b63a7460fbf0b93a666fd9142199d3cc56f4fcc54f3d7acf767ab13386acfb24b906ff
SSDEEP 24576:BOv5IC67e/d4U6LB/rxmoNB+p4EYfFUG3mdxMgUG:g5IJ7e/aPdmo/8YfFbmrMS
TLSH
T15635339A0A49A9BCE1CF287DDE66151C1B3183B4BD5BC248CE36CD910106676EC86CFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thank_you.png

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\assets\thank_you.png
Size 18KB
SHA256 26b0b056623c79a5eae342b77a3e19ee876188be8a8c576b18f719027356ee40
MD5 b5ea7b3a8970337c5fc213c25894136e
SHA1 c0f81125f545c86a60c70354da1c9798c6cbde91
SHA512 260a19fe5fff5188b6cb73202bc0e5c6d43001e48ca8768b3073b80e544be5eba15882d73e9527612e4ace2dc9800689d3fd5c5c98171e87a1400344fa2a7ee5
SSDEEP 384:PzlX6WSK6Ob2UEjG6qOSLVjcAjddIU5rc90dVMVCR50UTeUQk79:BKLKvzuGfXLVjcAjXBa90jMk0UTbQk79
TLSH
T12182E19A164010E4C1FEC793D28ACA68F51C6D6035EDC89C41CC816B2CC9EF7A6E95FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\base_library.zip
Size 1.2MB
SHA256 326495cf89be0b4789f6db8f032785864e565d8cefa13cd8bdf8689c453f9d09
MD5 5a9639976c63636a1af0736f3bc47c88
SHA1 7c3f0fe73c365fc1a754c285b73295f1ee96e899
SHA512 89ebc4eaee0c72e2d5ca96f71d102a83fc0d5164d3369fb3ca34743498bfa0f313d0040baa70ae1888f999c810f5f1d1f2326d052f9ecbcd10ddf9bbbd5a953f
SSDEEP 12288:575yP25xXmDh32ZHI8GGdvhEMn2ydgMopj4mZfTNyHCyfVxVRV3vlnXNL0Dh/Af+:5FyP25xXmB2Bec1V5dvlnBUf
TLSH
T19D450AC2B5427853FF68F37B80B6484CF32D96A2EE00D307364A46661EFF6B49D59948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\python313.dll
Size 5.8MB
SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
MD5 5acd4d4f35e13ef79c883ace05c4eaf5
SHA1 03a2944b87b8a6fe0bff5336978ed6558deda5a2
SHA512 f1bb13fac80f28e2419479ee14e41dbcba8fbdc0ca3698d01a8ccddf2bc2fe3a4cf90acf2fd42e4a2f1ec49751d0c66cbc7b59fb8a43fc4dcb7b892cae76e525
SSDEEP 98304:GlKJHA/wful8vHGtFjX/LTv4HDMiEJZIPcR:GlLhl8kDioIPcR
TLSH
T102568D16729E41ACC97B8078CA03864BFBB27C417FA0534B61E6BB5D2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

attack.wav

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\attack.wav
Size 75KB
SHA256 7886570361aad6bc5aea9192302044bc3995c00fbfa165ede4ba32a128fa9eb8
MD5 be0a97d74873c60bf98d26a8b2fa1af5
SHA1 c8ffa0687920a9c78e5790948eddd2511083d662
SHA512 214a5a3bab160f77b0f984da7f83074241bf240a9fd4889819f618123f51a7803ebfbfd3e6bd521e57756b1f01475c42a4395c0b0c71c6f8bff21880f53c6545
SSDEEP 1536:CQ+SUp+rh2c014c00jUnOhl+NADlrCV7Jxu+FSPLZ169B7Vti:ESUpChAtUOX+OZroJxfUP+V4
TLSH
T13F730271B8D3BB5ADE93C497A8198A620DB48117F07E83B6E1E4C564730718BEF1835C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coin.wav

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\coin.wav
Size 24KB
SHA256 40763a9a9b497d3b1f0b660b2034d489b1a2218d4f1c6602058fcfaaad17f28f
MD5 cd29e5b31b0c730d4ecc9d691775de9c
SHA1 1ebd2ef55aecb19af612fdaf0a5421f16c73fd5a
SHA512 780b8486c02bcecc5d31e7ad7877584035c4de64cbef928fbf5e70383a18bbae2af3ef2a2786d5e47ef7d5e7cc6e26a94a173996ebb2faf0da5c8b88e8810c19
SSDEEP 384:hsnWsf3Fg0hJU+pokzIPkunDK7o7uTHiAn2iq2T9KedOrJGliDjUMCjal1:q9gGrkcua1LiArqSlOFGlcT
TLSH
T133B2D1A1F0CB076052B325A94E1414386C75FDDE7C38847B951BCFA8B28F2349626BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

failure.wav

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\failure.wav
Size 107KB
SHA256 5c0f0760449665cbe3d1ef0f5f1a2ff46c61291051756ee93e5a7a42e4f41967
MD5 f79e577457798cfd17ff25d931e861e7
SHA1 e97ad0b31e0f95b7aaf2a441e099d3a495ba0cb7
SHA512 455aa4c5e19d74f788aabc44b7bb25259d307c6ee755bf69b2ef941efe40e83281a603000ed17aecebf32cba2d59525f3020229bdf7eb96fb06ee5b1b0a3f7b3
SSDEEP 3072:Qcu5pokoZE9k6k1Ufr9mIWCRimMniCF+lCjA:QrpokoZUkC9mIFhMpo
TLSH
T112B3D18BF9DEF4CE392A789F2D4D66D741523657CAAF02C701DC4E70A2B5C1628C6E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jumpscare1.mp3

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\jumpscare1.mp3
Size 39KB
SHA256 cad9b03c295d852502501c226cae21d05cbd5f6fc4edf81b2efdd65815c505a4
MD5 0a0189122cdd91114f32beb0cec8bf15
SHA1 2e265dab13aac0a2bd83e7fe29d32b1949763ead
SHA512 9cc48d492c0323e0fa0919fef39a5b9eef69bb53a47e6a75a2faa504e95b49af1177be19e551d8c61d7ab5fb1a2294298abcf0a4cbf175c2290c12a5a918873d
SSDEEP 768:GiWa+P8riUdXmlMCiFFxKQjYviOlWXcWIjoFSn/vAG2aAT7K7cR9Z:7Wa+PAbXmNiHoviOlmcZj//uaAPdR9Z
TLSH
T1E403F1A2C14FD68CC020297E42896F6080A7BF8FA107645A6DF5471F6F7B5823BB85DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jumpscare2.mp3

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\jumpscare2.mp3
Size 22KB
SHA256 436fcaf2e5b1e8bf147a51ee4a8ea0b698efbd1bbce37a63392eeea95d94b8d8
MD5 2d435113d4030c05ad0059f566addf53
SHA1 6a0483c430abf893ff6a5d7f37455862c3f1411d
SHA512 5210e970aea00da295e2887312eb2bae0e5b8b01f0824edb37e81e8e7c3f350638dbb4e9c76f045b676ae46ac4b4ed088d00366379a4609b86112deedd7ed958
SSDEEP 384:Yl72nuXSKQTsUQos08PWrRri1CWrlILxhCzLRjRpHl/cKW6ypAs:uIKFUQosJF1xuCztVxl/HFO
TLSH
T1A7A2CF1C2EE1617EF06A637CFE6762F8F5460AEA2DA0DC5D82D5BB29027B2421351706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ransom_loop.wav

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\ransom_loop.wav
Size 516KB
SHA256 045abaf2be0227bc4168dfa592cea3aa2e6d1c7a347317454a8cc4a024d913ab
MD5 0c8be7326c104a86205ff466d5c57505
SHA1 74f957dcd1de2f28f223d56cc94f02f0fd260035
SHA512 19bf8f1bf67b618f50f0653febd79a4cd1e019c17fea00f8303c45a2aea0abe7990ee2a5bc27c2fab1f4a9263e884ee896ae05e6d3fc8799aa0286d98486e524
SSDEEP 12288:3GyIIYjCp5EkVvMVZZSr41LnTE6OqQK8PtkBUDjmEOpWEXv:3GjVup5EkVUVZMrynTE6OqQzkBUDu3
TLSH
T163B4233EFA542BE82439459B5AC7D4E04704FECC3C666DA5A400ED6D8F32450AA32FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ransom_ost_to_jumpscare.mp3

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\ransom_ost_to_jumpscare.mp3
Size 1.6MB
SHA256 48dbfdf97e14743145f42d6b615781ecb9860c583174e14574653fdc56379190
MD5 003c74887e7dda793c0dfbbbd683ed83
SHA1 2af57a93bcd22861f77ede13030d9763babd3e4b
SHA512 e526fcce2762a9f1e148679ce56d5ec0432e5603f9a29174fc85bb4eb96d6895d20806f30cccad5c512c52003820cfac88243c52e427d14694394cf667b4d033
SSDEEP 49152:Qn/NJOejadGFRfYbRjpOGFd9rmfs05KKgA2uF5bhtl:43YCRfuRjprd9rkfl
TLSH
T16A7523C5B11268CEC1454A72D6E04E38E9FAAF5D7302305BA8EEBF1715F369BB720815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ransom_success.ogg

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\ransom_success.ogg
Size 67KB
SHA256 241548bf2a51ee8318fc29a48569263b86bd7f7d9b1091e829c66a64517072d1
MD5 46fbc3a37dfd3c6302224a67dbcba9e3
SHA1 f3229b27fbaed2b439f0e0ca9f541406f14ee702
SHA512 97cc02f96fc7478e0217d8b265bdc0dc2a5b48c1469089cee050ae75d2ce21384999721f922870ab92f864a29e4fe741c4c8d4da396459386e0d9e41778b97ca
SSDEEP 1536:hPuIp14ux8nz2/iftS9/STJQj6tTHurSl0EEdJ2NkFmu75o1Ob3DM:RueuOqnOZ6uS2EEdQNkFP7O1STM
TLSH
T11763F283DA57EE21D5012A77CABB604119199CF4BB39DED3C7B8E42D0EB46F5F420289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stop_static.wav

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\sounds\stop_static.wav
Size 41KB
SHA256 a2dfd2b1532aaa135f2181387e481cc6915e72cb7d6e65f3ba84c58b3f68d1f9
MD5 ba8b4ab67faceb86f9148c4efc08c661
SHA1 2ae6ddd46185975187f50b23f7876482279676d0
SHA512 a1b895edfb0319adfcbb73d16aa96e32e7cff26579e06f649b9529b988277d3eeece887b22bf0a299d32c1d3b0dc01e4896d27541cde4d67fa5233a11bc23ec9
SSDEEP 768:FEWlNsUK5oYXGZ+Bh+loHM7cnA9+MjpROPWLyPRx3mLwg4AgF6TDwyKgFj6:FEWlSUKusGZ+DjHpnATvOPm+RR7OgwPU
TLSH
T1E713017EE75148D69272469777B3C94F2B805EA37F6388DC8281F66D8363A436C12478
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\tcl8\8.5\msgcat-1.6.1.tm
Size 34KB
SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
MD5 e102bf017d302c494c1dbd449b040053
SHA1 58b16b222f881271e09f7775c46817bbc4bed81e
SHA512 7001af784de0663bbf634842c12d833e447221a0fef05723373db3281d5bb9545c3c12103413137451730fba6207a1dc318b662aa4da6a72fe6944577c199da2
SSDEEP 768:m3SQ0CzasW/rHPG2yfkZ0Kbh91iQQLnq5MIVYB8mbgijsPIAtw4qvUm:4SQ0CzasWDHPG2yW0kJQ2imXmUij6njG
TLSH
T10EF2D614334741AB36B2526799F9A2A4CE3CE23F10AB959EB89A801C7731F5D43F74D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\ucrtbase.dll
Size 1.3MB
SHA256 3239227d27667ba20d10a880751924e5719de0078f9fce232d149d383f7681f6
MD5 b938a441aa9ab59182d0116961318531
SHA1 58f60f8da6cf66ab224f82d41105fdda433897a9
SHA512 8b3063e50b94d555bf73b2f6eda0bb38e71056d83de05eb0b4473b448fc0b3cb26617ff340a0c3ac69acb9ee2aacc9e5b503279c593b1b0b916204a6a7426b0c
SSDEEP 24576:X9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszifmxvSZX0ypapJDBW:X9KpUmTfFqSgdDPq3DjqI08vkpJD8
TLSH
T14E55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29042\zlib1.dll
Size 106KB
SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
MD5 5eac41b641e813f2a887c25e7c87a02e
SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
SSDEEP 3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
TLSH
T16FB38E9BBA9362FDD972C17052E69BB4E930BC0109705ADB5148FBB02F12C906F597EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-1215-0x0000022E6C5B0000-0x0000022E6CAD8000-memory.dmp

Download

memory/1860-1214-0x0000022E6BEB0000-0x0000022E6C072000-memory.dmp

Download

memory/1860-1213-0x0000022E6B3E0000-0x0000022E6B402000-memory.dmp

Download

memory/2132-1124-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Download

memory/4920-1123-0x00007FF95E670000-0x00007FF95E8DC000-memory.dmp

Download

memory/4920-1156-0x00007FF95E670000-0x00007FF95E8DC000-memory.dmp

Download

memory/4920-1159-0x00007FF95E670000-0x00007FF95E8DC000-memory.dmp

Download

memory/4920-1162-0x00007FF95E670000-0x00007FF95E8DC000-memory.dmp

Download

memory/4920-1121-0x00000231E4E30000-0x00000231E4E31000-memory.dmp

Download

memory/4920-1120-0x00007FF95E670000-0x00007FF95E8DC000-memory.dmp

Download

memory/4920-1119-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Download