Overview

overview

8

Static

static

3

CoronaVirus.exe

windows10-2004-x64

8

CoronaVirus.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 15:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CoronaVirus.exe
  • Size 18.6MB
  • Sample260805-sjbhtaca24
  • SHA256 5d8b470bbbabb4cd234fa23a11106b1fa5059a4ec81e312ecefd92d9098890ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Loads dropped DLL 47 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe
    "C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe
      "C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1060
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4640
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3528
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5460
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5540
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4468
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1600
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3604
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5832
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3296
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2992
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5952
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5564
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1604
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5988
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2244
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:248
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5456
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3904
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5280
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5076
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:6008
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5424
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5508
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3372
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4912
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2624
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1384
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3600
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3664
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:5788
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3568
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:4336
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:3708
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4908
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:4112
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:3780
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1756
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:700
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:5552
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4644
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:1740
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2220
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:2752
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1220
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:4064
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:4872
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:204
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
        3⤵
        • Executes a command shell one-liner
        PID:1096
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im taskmgr.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4540
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start /b C:\Windows\Temp\kill_windows.bat"
        3⤵
          PID:6012
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /K C:\Windows\Temp\kill_windows.bat
            4⤵
            • Drops file in Drivers directory
            • Manipulates Digital Signatures
            • Drops file in System32 directory
            • Modifies termsrv.dll
            • Drops file in Windows directory
            PID:2224
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:2688
              • C:\Windows\system32\timeout.exe
                timeout /t 3 /nobreak
                5⤵
                • Delays execution with timeout.exe
                PID:4416
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:5076
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4308
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:4988
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2056
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:5956
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4868
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:2692
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4600
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:5092
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2844
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:4876
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4968
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:3600
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5084
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:1504
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1160
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:2524
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4124
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:1964
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2760
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:5052
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4232
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
            • Executes a command shell one-liner
            PID:4924
            • C:\Windows\system32\taskkill.exe
              taskkill /f /im taskmgr.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5416
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
            3⤵
              PID:5100
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im taskmgr.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3296
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
              3⤵
              • Executes a command shell one-liner
              PID:4512
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im taskmgr.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2120
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
              3⤵
              • Executes a command shell one-liner
              PID:4744
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im taskmgr.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4692
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
              3⤵
              • Executes a command shell one-liner
              PID:5692
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im taskmgr.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4644
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
              3⤵
                PID:3424
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4772
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:5492
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2540
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:4856
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1752
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:2884
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:296
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:248
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4368
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:1132
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  PID:5200
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:3532
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  PID:3844
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:4104
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  PID:856
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:1420
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                  • Kills process with taskkill
                  PID:4320
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
                3⤵
                • Executes a command shell one-liner
                PID:2624
                • C:\Windows\system32\taskkill.exe
                  taskkill /f /im taskmgr.exe
                  4⤵
                    PID:572

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\VCRUNTIME140.dll
                  • Size 95KB
                  • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\_bz2.pyd
                  • Size 81KB
                  • SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\_ctypes.pyd
                  • Size 120KB
                  • SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\_lzma.pyd
                  • Size 154KB
                  • SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-console-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-console-l1-1-0.dll
                  • Size 21KB
                  • SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-datetime-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-datetime-l1-1-0.dll
                  • Size 21KB
                  • SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-debug-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-debug-l1-1-0.dll
                  • Size 21KB
                  • SHA256 591358eb4d1531e9563ee0813e4301c552ce364c912ce684d16576eabf195dc3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-errorhandling-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-errorhandling-l1-1-0.dll
                  • Size 21KB
                  • SHA256 d56ce7b1cd76108ad6c137326ec694a14c99d48c3d7b0ace8c3ff4d9bcee3ce8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-fibers-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-fibers-l1-1-0.dll
                  • Size 21KB
                  • SHA256 91d249d7bc0e38ef6bcb17158b1fdc6dd8888dc086615c9b8b750b87e52a5fb3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-fibers-l1-1-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-fibers-l1-1-1.dll
                  • Size 21KB
                  • SHA256 fc9d86cec621383eab636ebc87ddd3f5c19a3cb2a33d97be112c051d0b275429
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-file-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-file-l1-1-0.dll
                  • Size 25KB
                  • SHA256 1ca895aba4e7435563a6b43e85eba67a0f8c74aa6a6a94d0fc48fa35535e2585
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-file-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-file-l1-2-0.dll
                  • Size 21KB
                  • SHA256 4cadbc0c39da7c6722206fdcebd670abe5b8d261e7b041dd94f9397a89d1990d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-file-l2-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-file-l2-1-0.dll
                  • Size 21KB
                  • SHA256 93c624b366ba16c643fc8933070a26f03b073ad0cf7f80173266d67536c61989
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-handle-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-handle-l1-1-0.dll
                  • Size 21KB
                  • SHA256 39095f59c41d76ec81bb2723d646fde4c148e7cc3402f4980d2ade95cb9c84f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-heap-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-heap-l1-1-0.dll
                  • Size 21KB
                  • SHA256 8f105771b236dbcb859de271f0a6822ce1cb79c36988dd42c9e3f6f55c5f7eb9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-interlocked-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-interlocked-l1-1-0.dll
                  • Size 21KB
                  • SHA256 53b25e753ca785bf8b695d89dde5818a318890211dc992a89146f16658f0b606
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-kernel32-legacy-l1-1-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-kernel32-legacy-l1-1-1.dll
                  • Size 21KB
                  • SHA256 a9b13a1cd1b8c19b0c6b4afcd5bb0dd29c0e2288231ac9e6db8510094ce68ba6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-libraryloader-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-libraryloader-l1-1-0.dll
                  • Size 21KB
                  • SHA256 7f39ba298b41e4963047341288cab36b6a241835ee11ba4ad70f44dacd40906c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-localization-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-localization-l1-2-0.dll
                  • Size 21KB
                  • SHA256 6ee44dd0d8510dc024c9f7c79b1b9fa88c987b26b6beb6653ddd11751c34e5dc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-memory-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-memory-l1-1-0.dll
                  • Size 21KB
                  • SHA256 0512a35316ec9180437f86696a84c5c06a7e4e82e050055a656e5bf9fca206f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-namedpipe-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-namedpipe-l1-1-0.dll
                  • Size 21KB
                  • SHA256 c05f1fffe3b5a2738ea54ce9485cca026fb9635f982626fba1e1dcc531897273
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-processenvironment-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-processenvironment-l1-1-0.dll
                  • Size 21KB
                  • SHA256 c4eca98c3c67b6395d5b005b00ac1eb0318b86b23aa71035a44c2b1602befba9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-processthreads-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-processthreads-l1-1-0.dll
                  • Size 21KB
                  • SHA256 5ccb89e93d67bc3288d4e84649c5346e66e15e3d7cd65d989daf3f4cb584be9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-processthreads-l1-1-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-processthreads-l1-1-1.dll
                  • Size 21KB
                  • SHA256 4ad565a8ba3ef0ea8ab87221ad11f83ee0bc844ce236607958406663b407333e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-profile-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-profile-l1-1-0.dll
                  • Size 21KB
                  • SHA256 7809160932f44e59b021699f5bc68799eb7293ee1fa926d6fcca3c3445302e61
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-rtlsupport-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-rtlsupport-l1-1-0.dll
                  • Size 21KB
                  • SHA256 9dc1e91e71c7c054854bd1487cb4e6946d82c9f463430f1c4e8d1471005172b1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-string-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-string-l1-1-0.dll
                  • Size 21KB
                  • SHA256 60fc31d2a0c634412f529dba76af3b9bf991352877c6dae528186d3935704cfd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-synch-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-synch-l1-1-0.dll
                  • Size 21KB
                  • SHA256 3a72b4f29f39a265d32ad12f0ce15dbf60129c840e10d84d427829ede45e78ad
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-synch-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-synch-l1-2-0.dll
                  • Size 21KB
                  • SHA256 efc1e4460984a73cf47a3def033af1c8f3b1dbc1a56cd27781d3aacf3e3330cb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-sysinfo-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-sysinfo-l1-1-0.dll
                  • Size 21KB
                  • SHA256 b203d862ddef1dd62bf623fc866c7f7a9c317c1c2ae30d1f52cb41f955b5698e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-sysinfo-l1-2-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-sysinfo-l1-2-0.dll
                  • Size 21KB
                  • SHA256 2703635d835396afd0f138d7c73751afe7e33a24f4225d08c1690b0a371932c0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-timezone-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-timezone-l1-1-0.dll
                  • Size 21KB
                  • SHA256 33f4fddc181066fce06b2227bded813f95e94ed1f3d785e982c6b6b56c510c57
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-core-util-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-core-util-l1-1-0.dll
                  • Size 21KB
                  • SHA256 6eda016742a6171205a387a14b3c0b331841567740376f56768f8c151724207d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-conio-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-conio-l1-1-0.dll
                  • Size 21KB
                  • SHA256 b762061b688aae679afe788904d2c9970f74a7dac98f3b42463d08f25e483d3f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-convert-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-convert-l1-1-0.dll
                  • Size 25KB
                  • SHA256 ebb2ae5535a64f65daeab8235585114fc9dd2cf1a49f5852d446250b998b6ae4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-environment-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-environment-l1-1-0.dll
                  • Size 21KB
                  • SHA256 17d63275d00bdd8670422b95bd264c532998e0a1b041079e54fce4b6b7a55819
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-filesystem-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-filesystem-l1-1-0.dll
                  • Size 21KB
                  • SHA256 9a9e2a65a281644e368d0f272b95ba5f6b445d1c35910d06056c5ebeb77402db
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-heap-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-heap-l1-1-0.dll
                  • Size 21KB
                  • SHA256 bab9ac3ec83e380ae51e4295ef3bf2c738627812d3a49d1e713661abbc8dc57a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-locale-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-locale-l1-1-0.dll
                  • Size 21KB
                  • SHA256 bd14c67ea28e21d6257ad780a37122c9b5773f69e693f5db6bffaee4d839526e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-math-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-math-l1-1-0.dll
                  • Size 29KB
                  • SHA256 606d66d82db562ea7979179d06486a0f94d079941d26b80a1e2c49d29959df6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-multibyte-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-multibyte-l1-1-0.dll
                  • Size 29KB
                  • SHA256 95f49efbe8107786733fa7c474025cf3fee0ac632f240367b296c736d06572aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-process-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-process-l1-1-0.dll
                  • Size 21KB
                  • SHA256 f6156b1020380ec4f0e48577ebedaaef5fb1ab1f337d8b4e72e6a33a7567a9cc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-runtime-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-runtime-l1-1-0.dll
                  • Size 25KB
                  • SHA256 c5902934d026d7e15fbe9917d474f3322846a41a25e66f4b2b1f758801879f4b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-stdio-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-stdio-l1-1-0.dll
                  • Size 25KB
                  • SHA256 a9c5a153d8c0286f9b41a2b1c65854ad9e6471b8755b7de87bae4470e60bcab6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-string-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-string-l1-1-0.dll
                  • Size 25KB
                  • SHA256 25b8f83a7767211b11132775a0e27a45aa4ec8ab4e6572599f9c172ae3606b40
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-time-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-time-l1-1-0.dll
                  • Size 21KB
                  • SHA256 7c7f6393f06de11750adb09cc5698ae55cd9fb27b2e51e207286feb1b5b2b156
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  api-ms-win-crt-utility-l1-1-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\api-ms-win-crt-utility-l1-1-0.dll
                  • Size 21KB
                  • SHA256 d8ba5f17b9ffcbf3aeaf3fa1da226832d2fa90f81acce0cd669464e76ce434ac
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\base_library.zip
                  • Size 859KB
                  • SHA256 4e22ea1760704dd2a68b3bd0fdf5c9e1590d016d80ebbbfdeca0ceb16e9bc306
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  freetype.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\freetype.dll
                  • Size 639KB
                  • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  koronovirus.py
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\koronovirus.py
                  • Size 8KB
                  • SHA256 350d01f8d22055bded42955ce5fa1fcf5e4e9986bfa65797e621e26e4cc74f54
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\libcrypto-1_1.dll
                  • Size 3.3MB
                  • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-7.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\libffi-7.dll
                  • Size 32KB
                  • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libjpeg-9.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\libjpeg-9.dll
                  • Size 238KB
                  • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libmodplug-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\libmodplug-1.dll
                  • Size 259KB
                  • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libogg-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\libogg-0.dll
                  • Size 25KB
                  • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python310.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\python310.dll
                  • Size 4.3MB
                  • SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ucrtbase.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI37562\ucrtbase.dll
                  • Size 1.3MB
                  • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/2188-213-0x00007FFC6AD60000-0x00007FFC6AFCC000-memory.dmp
                  Download

                  memory/2188-212-0x00007FFC6AD60000-0x00007FFC6AFCC000-memory.dmp
                  Download

                  memory/2188-210-0x00007FFC6AD60000-0x00007FFC6AFCC000-memory.dmp
                  Download

                  memory/2188-209-0x00007FFC6AD60000-0x00007FFC6AFCC000-memory.dmp
                  Download

                  memory/2188-208-0x00007FFC6AD60000-0x00007FFC6AFCC000-memory.dmp
                  Download