Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	6d2c0ff2056eefa3_api-ms-win-crt-convert-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-convert-l1-1-0.dll
Size	15.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`d27946c6186aeb3adb2b9b2ac09ea797`
SHA1	`fc4da67f07a94343bda8f97150843c76c308695b`
SHA256	`6d2c0ff2056eefa3a74856e4c34e7e868c088c7c548f05b939912efeb8191751`
CRC32	`2CC7B2E6`
ssdeep	`192:WjypdkKBcyxWfhWooWULwu0Sc2HnhWgN7a8WZVsmsqnaj5fQ1PIF:WyuyxWfhWomD/HRN7ss9l1GAF`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	76fdb83fde238226_VCRUNTIME140.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\VCRUNTIME140.dll
Size	106.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`870fea4e961e2fbd00110d3783e529be`
SHA1	`a948e65c6f73d7da4ffde4e8533c098a00cc7311`
SHA256	`76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644`
CRC32	`D4EEA8EC`
ssdeep	`1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c0f771a24e7f6eda_api-ms-win-core-heap-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-heap-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`a0c0c0ff40c9ed12b1ecacadcb57569a`
SHA1	`87ed14454c1cf8272c38199d48dfa81e267bc12f`
SHA256	`c0f771a24e7f6eda6e65d079f7e99c57b026955657a00962bcd5ff1d43b14dd0`
CRC32	`20368B59`
ssdeep	`192:WZZlKWfhWomWULwu0Sc2HnhWgN7a8WyLhWOk9qnajMDks:WLlKWfhWo4D/HRN7LEhlQDks`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c8c2e69fb9b3f095_api-ms-win-core-namedpipe-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-namedpipe-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`d6297cfe7187850db6439e13003203c6`
SHA1	`9455184ad49e5c277b06d1af97600b6b5fa1f638`
SHA256	`c8c2e69fb9b3f0956c442c8fbafd2da64b9a32814338104c361e8b66d06d36a2`
CRC32	`122525FD`
ssdeep	`192:WqWfhWo+WULwu0Sc2HnhWgN7a8WYRK+sOk9qnajMDkBSF:WqWfhWoQD/HRN7oBhlQDkBSF`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	659f3321f272166f_api-ms-win-core-localization-l1-2-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-localization-l1-2-0.dll
Size	14.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`75ef38b27be5fa07dc07ca44792edcc3`
SHA1	`7392603b8c75a57857e5b5773f2079cb9da90ee9`
SHA256	`659f3321f272166f0b079775df0abdaf1bc482d1bcc66f42cae08fde446eb81a`
CRC32	`3753471C`
ssdeep	`384:WpOMw3zdp3bwjGjue9/0jCRrndbWsWfhWOD/HRN7DlEnEQmDWlGs76Qq:8OMwBprwjGjue9/0jCRrndbG/DvhEE1t`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	7fc3c456a25be1ca_api-ms-win-crt-multibyte-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-multibyte-l1-1-0.dll
Size	19.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`a234ec74b828d5f9c1d097bd93ad69cb`
SHA1	`b2eb0481329fcc9221a591cd02369f5fe9d6a86e`
SHA256	`7fc3c456a25be1ca2d2802a14a8778dd69ec5fea19ce27fcce41fdafbefda569`
CRC32	`FF8F2CBC`
ssdeep	`384:Wxy+Kr6aLPmIHJI6/CpG3t2G3t4odXLVWfhWojD/HRN7uUhlQDkN:4ZKrZPmIHJI6kxjDvn9N`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	348f47aa5448e513_registers.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\registers.exe
Size	113.0KB
Processes	2552 (os.exe)
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`c23f914f54bdfdbb4189ddabdebec70d`
SHA1	`8c6a72c231ba921f121c6d13e15f023697ddf045`
SHA256	`348f47aa5448e5135adc5a4232f3f1b69eb93d83227dd9ab0e060476c7c544bc`
CRC32	`83948C7C`
ssdeep	`3072:c6Af4uswlDPO119nM9QkWaS4RAd02xkOUUYOgM/EEt:CpNPO1vzkWNHpjbyEt`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	7dc931f1a2dc7b6e_api-ms-win-crt-locale-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-locale-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`995b8129957cde9563cee58f0ce3c846`
SHA1	`06e4ab894b8fa6c872438870fb8bd19dfdc12505`
SHA256	`7dc931f1a2dc7b6e7bd6e7ada99d7fadc2a65ebf8c8ea68f607a3917ac7b4d35`
CRC32	`12697999`
ssdeep	`192:WkWfhWGWULwu0Sc2HnhWgN7asWCaXcA5E8qnajlsEa:WkWfhWYD/HRN7sXx5E8lmh`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	b74fc81aeed00ece_api-ms-win-core-processenvironment-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-processenvironment-l1-1-0.dll
Size	12.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`e1239fa9b8909dccde2c246e8097aebf`
SHA1	`3d6510e0d80ed5df227cac7b0e9d703898303bd6`
SHA256	`b74fc81aeed00ece41cd995b24ae18a32f4e224037165f0124685288c8fae0bd`
CRC32	`1D6EA552`
ssdeep	`192:W8WWfhWo9WULwu0Sc2HnhWgN7a8WC/OFOk9qnajMDkmUa:W8WWfhWoHD/HRN7PshlQDkmp`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	3bac94d8713a1430__ssl.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_ssl.pyd
Size	157.3KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`0a7eb5d67b14b983a38f82909472f380`
SHA1	`596f94c4659a055d8c629bc21a719ce441d8b924`
SHA256	`3bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380`
CRC32	`FCBD3FE3`
ssdeep	`3072:g/bIQQOiv334t8g419Qkd83X2u70rExnlSQOXLkd1ItS+Q8YuAO8JIJC7BIxZ:W0OuYtv41aQ82u7JnN+8G`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	a52dfa3e66d923fd_api-ms-win-core-util-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-util-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`0cfe48ae7fa9ec261c30de0ce4203c8f`
SHA1	`0a8040a35d90ebbcacaba62430300d6d24c7cacb`
SHA256	`a52dfa3e66d923fdf92c47d7222d56a615d5e4dd13f350a4289eb64189169977`
CRC32	`397DF7E4`
ssdeep	`192:WTtWWfhWogWULwu0Sc2HnhWgN7a8W2nOk9qnajMDkLy0:WTtWWfhWo+D/HRN7bhlQDkLP`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	6583c15de0f5a1b2_pywintypes311.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\pywin32_system32\pywintypes311.dll
Size	134.0KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`1696732a242bfaf6a50bd98eb7874f23`
SHA1	`090a85275c7c67430d511570bab36eb299c7e787`
SHA256	`6583c15de0f5a1b20c8750b0599e5cf162f91f239f8341bda842485d8bbc9887`
CRC32	`35CBE3EC`
ssdeep	`3072:MzfsYtdH4B0IgYrrC0DdZ2N9WWefjK/9+dZNJ:k/tdHz1YrrC02LeLKF+d`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	d98dd943517963fd_libssl-1_1.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\libssl-1_1.dll
Size	686.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`86f2d9cc8cc54bbb005b15cabf715e5d`
SHA1	`396833cba6802cb83367f6313c6e3c67521c51ad`
SHA256	`d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771`
CRC32	`C34107F9`
ssdeep	`12288:OI5WfesuqsFp0cPOtTBV3UxqM5v9nhg/RYXFopg0KOKUU2lvz:OIMcPOtlqXCpg0KUU2lvz`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	5911c9d1d2820272_api-ms-win-crt-heap-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-heap-l1-1-0.dll
Size	12.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`8a04bd9fc9cbd96d93030eb974abfc6b`
SHA1	`f7145fd6c8c4313406d64492a962e963ca1ea8c9`
SHA256	`5911c9d1d28202721e6ca6dd394ffc5e03d49dfa161ea290c3cb2778d6449f0f`
CRC32	`98246C72`
ssdeep	`192:WhY3vY17aFBR0WfhWGWULwu0Sc2HnhWgN7asWx1FZL1aqnajKsCCd:WhY3eRWfhWYD/HRN7oFSlGsCA`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	a5db7900ecd5ea5a_unicodedata.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\unicodedata.pyd
Size	1.1MB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`2ab7e66dff1893fea6f124971221a2a9`
SHA1	`3be5864bc4176c552282f9da5fbd70cc1593eb02`
SHA256	`a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f`
CRC32	`33887AA3`
ssdeep	`12288:r3kYbfjwR6nbnonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1y:rUYbM60IDJcjEwPgPOG6Xyd461y`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	59a867dc60b9ef40_api-ms-win-core-debug-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-debug-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`a53bb2f07886452711c20f17aa5ae131`
SHA1	`2e05c242ee8b68eca7893fba5e02158fae46c2c7`
SHA256	`59a867dc60b9ef40da738406b7cccd1c8e4be34752f59c3f5c7a60c3c34b6bcc`
CRC32	`43E09639`
ssdeep	`192:WvMWfhWoZWULwu0Sc2HnhWgN7a8WHjmcsmsqnaj5fQ19IdOr:WvMWfhWozD/HRN7fcs9l1Gicr`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	9da6bc4dee6d8f64_win32security.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\win32security.pyd
Size	143.5KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`bff7ba95ce1042f0e66f6bd816bbf89d`
SHA1	`894a9117d57a7fceecf1a32b0536bdfd6857a5c7`
SHA256	`9da6bc4dee6d8f6484b77f794527e02a8041d5aef2c308cbcc1eb01e996223a6`
CRC32	`64FE84F4`
ssdeep	`1536:pemeFQ/DeN26oF/8uq/VWnaot0sW9CVZAK9L9RwWMCnBXaqV/4HBrTkiihqqtYxe:U3Q/f0uztYCV64R7orGqqtc3BU`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Packer_Zero - Malicious Packer UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	93c49c67e24001f8_win32trace.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\win32trace.pyd
Size	22.5KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`3aab73fe8c25186e987514479bebc76b`
SHA1	`5fc506f83a6fd1333d16301643b275ff11ae29c2`
SHA256	`93c49c67e24001f86effe1bc2078c9e5c94aa4905c5aac9f500a519fa1ec97c0`
CRC32	`96ED8308`
ssdeep	`384:MGSpxrXk0uuAb2lwP2ZwJ0g83rrPYI7AHCsaCcE9H4q1B94:TVM1YI4HhB`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	19dd3b5ebb840885__hashlib.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_hashlib.pyd
Size	63.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`1c88b53c50b5f2bb687b554a2fc7685d`
SHA1	`bfe6fdb8377498bbefcaad1e6b8805473a4ccbf3`
SHA256	`19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778`
CRC32	`2F0DDBEE`
ssdeep	`1536:H8njpnxGkYNEUsZE/0Cw6cG1BIJOILis7SydPxPK:cnjpnxbZyw6t1BIJOILNTxC`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	ab822f7e846d4388__lzma.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_lzma.pyd
Size	155.3KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`bc07d7ac5fdc92db1e23395fde3420f2`
SHA1	`e89479381beeba40992d8eb306850977d3b95806`
SHA256	`ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b`
CRC32	`D958EBB0`
ssdeep	`3072:jlirS97HrdVmEkGCm5hRznf49mNo2wOvJ02JIJZ1G0qf1xPD:jlirG0EkTuAYO2wQ35j`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	5456b4c4e0045276_api-ms-win-core-processthreads-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-processthreads-l1-1-0.dll
Size	13.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`73c94e37721ce6d642ec6870f92035d8`
SHA1	`be06eff7ca92231f5f1112dd90b529df39c48966`
SHA256	`5456b4c4e0045276e2ad5af8f3f29cd978c4287c2528b491935dd879e13fdaf9`
CRC32	`01EA5FDF`
ssdeep	`384:WOWXk1JzNcKSIHWfhWoxD/HRN7rMphlQDk1z+:FbcKStxxDvre916`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	fbe41a27837b8be0_api-ms-win-core-handle-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-handle-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`f4e6ecd99fe8b3abd7c5b3e3868d8ea2`
SHA1	`609ee75d61966c6e8c2830065fba09ebebd1eef3`
SHA256	`fbe41a27837b8be026526ad2a6a47a897dd1c9f9eba639d700f7f563656bd52b`
CRC32	`698B3A23`
ssdeep	`192:WrWfhWZWULwu0Sc2HnhWgN7aMWubjafvXqnajan5tu2:WrWfhWzD/HRN7XYXlOna2`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	d87b2994c283004c_api-ms-win-core-sysinfo-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-sysinfo-l1-1-0.dll
Size	12.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`217d10571181b7fe4b5cb1a75e308777`
SHA1	`2c2dc926bf8c743c712aabeded21765e4be7736c`
SHA256	`d87b2994c283004cd45107cf9b10e6b10838c190654cf2f75e7d4894cbdae853`
CRC32	`09FC1689`
ssdeep	`192:WQKIMFqnWfhWo5WULwu0Sc2HnhWgN7a8W8wLaOk9qnajMDkrn:WQTnWfhWoTD/HRN7LlhlQDkj`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	0bf0f70bd2b599ed_api-ms-win-core-file-l2-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-file-l2-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`c3408e38a69dc84d104ce34abf2dfe5b`
SHA1	`8c01bd146cfd7895769e3862822edb838219edab`
SHA256	`0bf0f70bd2b599ed0d6c137ce48cf4c419d15ee171f5faeac164e3b853818453`
CRC32	`B80F1E82`
ssdeep	`192:WxVzWfhWFWULwu0Sc2HnhWgN7aMW/tImZdGP2qnajxfgX:WxVzWfhWvD/HRN7c3LlFfu`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	fe7081c825cd49c9_api-ms-win-core-rtlsupport-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-rtlsupport-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`462e7163064c970737e83521ae489a42`
SHA1	`969727049ef84f1b45de23c696b592ea8b1f8774`
SHA256	`fe7081c825cd49c91d81b466f2607a8bb21f376b4fdb76e1d21251565182d824`
CRC32	`086971C5`
ssdeep	`192:WIGeVxWfhWoAWULwu0Sc2HnhWgN7a8WapOk9qnajMDkQID:WIGeVxWfhWoeD/HRN7hhlQDkQe`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	59fee7a8d0a85ed9__decimal.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_decimal.pyd
Size	247.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`5e8aa9cd4742a51acc5b2155770241d5`
SHA1	`af030327ea6702a081de422168d812263f581470`
SHA256	`59fee7a8d0a85ed98bbf5dfb7a0ad64b60cbe88427efd98b3c9faad3e4421a87`
CRC32	`47EC908A`
ssdeep	`6144:81/80zC2Ej7n9Is3yVKFoob4Q48dl2r89qWM53pLW1AsUtIFcb:czC2c7nUVKFd40Cdi8icb`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	ae6c2e946b4dcdf5_api-ms-win-crt-stdio-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-stdio-l1-1-0.dll
Size	17.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`50c4a43be99c732cd9265bcbbcd2f6a2`
SHA1	`190931dae304c2fcb63394eba226e8c100d7b5fd`
SHA256	`ae6c2e946b4dcdf528064526b5a2280ee5fa5228f7bb6271c234422e2b0e96dd`
CRC32	`671595B8`
ssdeep	`192:WdgnLpHquWYFxEpahXWfhWo4/WULwu0Sc2HnhWgN7a8WWih/Ok9qnajMDk2R:WUZpFVhXWfhWo4tD/HRN7mhlQDkC`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	e0e38faf83050127_api-ms-win-core-synch-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-synch-l1-1-0.dll
Size	13.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`e87ccfd7f7210adcd5c20255dfe4d39f`
SHA1	`9f85557d2b8871b6b1b1d5bb378b3a8a9db2ffc2`
SHA256	`e0e38faf83050127ab274fd6ccb94e9e74504006740c5d8c4b191de5f98de3b5`
CRC32	`3EACD9AC`
ssdeep	`384:W9dv3V0dfpkXc0vVaCWfhWgD/HRN7Rus9l1G43U:Udv3VqpkXc0vVabBDvRuX4E`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	0a9f2c98f36ba897_python311.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\python311.dll
Size	5.5MB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`1fe47c83669491bf38a949253d7d960f`
SHA1	`de5cc181c0e26cbcb31309fe00d9f2f5264d2b25`
SHA256	`0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae`
CRC32	`3CC4F934`
ssdeep	`98304:ZjCxzAISyt+EaudO141ibXHkMLyP59mJ3:ZjCxzAISXElO13L09`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	27d7ee900eaa170e__win32sysloader.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_win32sysloader.pyd
Size	14.0KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`b88cdf681385175f923c571e428dd2c1`
SHA1	`4695587845197c998486a4745b047504c6f29493`
SHA256	`27d7ee900eaa170eddbd8434b2489f56065ceaf14620566e8c387c0cdbe7807e`
CRC32	`0FC08FE9`
ssdeep	`192:7Ncw1m7PN4Rl+4AvH92WIPslbetNSoXU/ZdcyMfDU+9+/l:xcwoBmKBKcdIY/l`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	07a5cba122b1100a_api-ms-win-crt-string-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-string-l1-1-0.dll
Size	17.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`9b3f816d29b5304388e21dd99bebaa7d`
SHA1	`1b3f2d34c71f1877630376462dc638085584f41b`
SHA256	`07a5cba122b1100a1b882c44ac5ffdd8fb03604964addf65d730948deaa831c5`
CRC32	`22B65A72`
ssdeep	`384:WyiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWfhWoLD/HRN74o6hlQDk0:Z6S5yguNvZ5VQgx3SbwA71IkFDxLDv4K`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	b1cff7f4aab3303a_api-ms-win-crt-utility-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-utility-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`969daa50c4ef3bd2a8c1d9b2c452f541`
SHA1	`3d36a074c3171ad9a3cc4ad22e0e820db6db71b4`
SHA256	`b1cff7f4aab3303aec4e95ee7e3c7906c5e4f6062a199c83241e9681c5fcaa74`
CRC32	`A322DC83`
ssdeep	`192:WWfHQdujWfhWoiWULwu0Sc2HnhWgN7a8W+UzWQfvXqnajan51L8:WWf9WfhWoUD/HRN7CSWXlOnn8`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	a77b2de78310c0b2__elementtree.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_elementtree.pyd
Size	125.3KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`974d858b12d10c7ee9e8875f20e0e7af`
SHA1	`5f56ee3d0a26ce45857016c329984a1ef121fc61`
SHA256	`a77b2de78310c0b2b4158202ee48734d4835b7ba235aa5f6169f89566357369d`
CRC32	`4BB3704D`
ssdeep	`3072:ahGlNy/CPxvpewUjYk2f2/4YkWQNBkUVrk/54h75IJ6fZbxm:r4/CPxvpTFk2fNKQrix4h70`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	0ae3ee32f44aaed5_api-ms-win-core-file-l1-2-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-file-l1-2-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`1f72ba20e6771fe77dd27a3007801d37`
SHA1	`db0eb1b03f742ca62eeebca6b839fdb51f98a14f`
SHA256	`0ae3ee32f44aaed5389cc36d337d57d0203224fc6808c8a331a12ec4955bb2f4`
CRC32	`68EFE1EA`
ssdeep	`192:WOMWfhW8WULwu0Sc2HnhWgN7asWatDwmcVTW1KqnajKswlZzX:W5WfhWaD/HRN7FwmEy4lGswldX`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	429eb73cc17924f0_api-ms-win-core-datetime-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-datetime-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`38d6b73a450e7f77b17405ca9d726c76`
SHA1	`1b87e5a35db0413e6894fc8c403159abb0dcef88`
SHA256	`429eb73cc17924f0068222c7210806daf5dc96df132c347f63dc4165a51a2c62`
CRC32	`A9E4E981`
ssdeep	`192:W2WfhWoNLWULwu0Sc2HnhWgN7a8WaDwmvOk9qnajMDkfw:W2WfhWoLD/HRN75wOhlQDkfw`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	fab3891780c7f7ba_api-ms-win-core-memory-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-memory-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`960c4def6bdd1764aeb312f4e5bfdde0`
SHA1	`3f5460bd2b82fbeeddd1261b7ae6fa1c3907b83a`
SHA256	`fab3891780c7f7bac530b4b668fce31a205fa556eaab3c6516249e84bba7c3dc`
CRC32	`95300F32`
ssdeep	`192:WyqWfhWowWULwu0Sc2HnhWgN7a8Wi6msOk9qnajMDk7:WyqWfhWoOD/HRN78BhlQDk7`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	2087318c9edbae60_api-ms-win-core-file-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-file-l1-1-0.dll
Size	15.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`869c7061d625fec5859dcea23c812a0a`
SHA1	`670a17ebde8e819331bd8274a91021c5c76a04ba`
SHA256	`2087318c9edbae60d27b54dd5a5756fe5b1851332fb4dcd9efdc360dfeb08d12`
CRC32	`F71246E7`
ssdeep	`192:W/IAuVYPvVX8rFTs0WfhWoOWULwu0Sc2HnhWgN7a8WW52bTfvXqnajan5J7N0y:WFBPvVXuWfhWogD/HRN7D0XlOnP`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	39635c850db76508_api-ms-win-core-libraryloader-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-libraryloader-l1-1-0.dll
Size	12.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`aa47023ceed41432662038fd2cc93a71`
SHA1	`7728fb91d970ed4a43bea77684445ee50d08cc89`
SHA256	`39635c850db76508db160a208738d30a55c4d6ee3de239cc2ddc7e18264a54a4`
CRC32	`4D43CB52`
ssdeep	`192:WkvuBL3BBLJWfhWiWULwu0Sc2HnhWgN7asWhpfH2vArqnajKsrw:WkvuBL3BrWfhWUD/HRN7QH24rlGsrw`
Yara	Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	d5685e38faccdf97__psutil_windows.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\psutil\_psutil_windows.pyd
Size	75.0KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`5e9fc79283d08421683cb9e08ae5bf15`
SHA1	`b3021534d2647d90cd6d445772d2e362a04d5ddf`
SHA256	`d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6`
CRC32	`645D697C`
ssdeep	`1536:2ztEQV7I0DiMRAlELBNvpEnd17dO1vIFbHGy:2pESdiQAlEL6dJdO1vibHGy`
Yara	OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware IsDLL - (no description) Malicious_Packer_Zero - Malicious Packer UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	eee66f709ea126e2_api-ms-win-crt-process-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-process-l1-1-0.dll
Size	12.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`4b7d7bfdc40b2d819a8b80f20791af6a`
SHA1	`5ddd1720d1c748f5d7b2ae235bce10af1785e6a5`
SHA256	`eee66f709ea126e292019101c571a008ffca99d13e3c0537bb52223d70be2ef3`
CRC32	`3DD9AC8D`
ssdeep	`192:WqRQqjd7xWfhWm6WULwu0Sc2HnhWgN7asWSipXZL1aqnajKsCCtS:WqKAWfhWPD/HRN7WXSlGsCR`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	e05c5342d55cb452__socket.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_socket.pyd
Size	77.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`290dbf92268aebde8b9507b157bef602`
SHA1	`bea7221d7abbbc48840b46a19049217b27d3d13a`
SHA256	`e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe`
CRC32	`205A28F6`
ssdeep	`1536:vJleMWdP0uj19/s+S+p7GQyivViap59IJLw17SygPxYd:v7eMgsuj19/sT+p7GkvVpp59IJLw1Gxw`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	ffc74cd49df7d8b6_mfc140u.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\mfc140u.dll
Size	5.6MB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`598536e5ce9c6b10db3579ac7b8bcc49`
SHA1	`193f8433207de516baa1b38dd8de31bac065d456`
SHA256	`ffc74cd49df7d8b6ddcb94de1e12a399897aebf066e4884c9e563067ed399c89`
CRC32	`B6C37F17`
ssdeep	`49152:sGeFUHwMdKH3fVL7u8dFLP0OwuXJ7ahucFeXGGjzAjRptGu3n+CF9ZhIuSwIbFL4:jg9DoRaFLOAkGkzdnEVomFHKnPFT`
Yara	OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet IsPE64 - (no description)
VirusTotal	Search for analysis

Name	eb975c94e5f4292e_libcrypto-1_1.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\libcrypto-1_1.dll
Size	3.3MB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`80b72c24c74d59ae32ba2b0ea5e7dad2`
SHA1	`75f892e361619e51578b312605201571bfb67ff8`
SHA256	`eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d`
CRC32	`F7D6C9D2`
ssdeep	`49152:M3TKuk2CQIU6iV9OjPW9tmR+NtkYlhIo4QKLb0y+HnuJ1kQSYrLs1fEY7NPiNEsZ:nv+QYRKZSnfEYwNEs21CPwDv3uFfJ5`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	852b901e17022c43_python3.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\python3.dll
Size	65.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`2ad3039bd03669f99e948f449d9f778b`
SHA1	`dae8f661990c57adb171667b9206c8d84c50ecad`
SHA256	`852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61`
CRC32	`974B9CA5`
ssdeep	`768:lqw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:7/5k8cnzeJl9IJL0H7Sy4Pxt`
Yara	IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	47abfb801bcbd349_api-ms-win-core-interlocked-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-interlocked-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`41d96e924dea712571321ad0a8549922`
SHA1	`29214a2408d0222dae840e5cdba25f5ba446c118`
SHA256	`47abfb801bcbd349331532ba9d3e4c08489f27661de1cb08ccaf5aca0fc80726`
CRC32	`FEB68170`
ssdeep	`192:W9WfhWo0WULwu0Sc2HnhWgN7a8WBinOk9qnajMDkFE:W9WfhWoSD/HRN7e2hlQDkFE`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	10bffbe759fb4005_api-ms-win-crt-filesystem-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-filesystem-l1-1-0.dll
Size	13.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`3a8e2d90e4300d0337650cea494ae3f0`
SHA1	`008a0b56bce9640a4cf2cbf158a063fbb01f97ba`
SHA256	`10bffbe759fb400537db8b68b015829c6fed91823497783413deae79ae1741b9`
CRC32	`C42D6535`
ssdeep	`192:Wq7q6nWlC0i5CpWfhWeWULwu0Sc2HnhWgN7asWFLEJxZAqnajKsKOJTZu:WEq6nWm5CpWfhWwD/HRN7FJ/AlGsKO5Q`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	f91e905479a56183_api-ms-win-core-string-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-string-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`ae08fb2dccaf878e33fe1e473adfac97`
SHA1	`edaee07aad10f6518d3529c71c6047e38f205bab`
SHA256	`f91e905479a56183c7fbb12b215da366c601151adbcdb4cd09eb4f42d691c4c3`
CRC32	`BAA7EC8D`
ssdeep	`192:WIyMv9WfhW/FdWULwu0Sc2HnhWgN7aMW/H51Ok9qnajMDk0gW:WIyMv9WfhWdnD/HRN7chlQDkq`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	b5d4d5b6da675376_select.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\select.pyd
Size	29.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`4ac28414a1d101e94198ae0ac3bd1eb8`
SHA1	`718fbf58ab92a2be2efdb84d26e4d37eb50ef825`
SHA256	`b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5`
CRC32	`2515EED0`
ssdeep	`384:N1ecReJKCHqeUI7A700EZ9IJQGzHQIYiSy1pCQ82Pxh8E9VF0Nyqnn:3eUeJPHqgbD9IJQGD5YiSyvxPxWEUn`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	3a9a7e6f02d1f770_win32net.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\win32net.pyd
Size	96.5KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`cd9f5e5fc0b6d4e98df615fc9ad65bd6`
SHA1	`107d66711f191d8715221d6f749a0e7d5c734e0f`
SHA256	`3a9a7e6f02d1f7704298a86e5662b1f62356fc00a8344984d76a83aa524313d6`
CRC32	`3E53E65B`
ssdeep	`1536:+Y+KxparDFBIGf6K5XahqVKFP4JDuchmQggTkYwkzwlzDf:B+9f6b+uc0QggTpwkMlXf`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c2f296dd8372681c_api-ms-win-core-processthreads-l1-1-1.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-processthreads-l1-1-1.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`a55abf3646704420e48c8e29ccde5f7c`
SHA1	`c2ac5452adbc8d565ad2bc9ec0724a08b449c2d8`
SHA256	`c2f296dd8372681c37541b0ca8161b4621037d5318b7b8c5346cf7b8a6e22c3e`
CRC32	`430830FC`
ssdeep	`192:Wet2DfIe9jWfhWo3OWULwu0Sc2HnhWgN7a8WZkYfvXqnajan5CHB:Wet2DfIe9jWfhWo3gD/HRN7AXlOnG`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	3d81d06311a8a159_pyexpat.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\pyexpat.pyd
Size	194.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`c5c1ca1b3641772e661f85ef0166fd6c`
SHA1	`759a34eca7efa25321a76788fb7df74cfac9ee59`
SHA256	`3d81d06311a8a15967533491783ea9c7fc88d594f40eee64076723cebdd58928`
CRC32	`33127E14`
ssdeep	`3072:SA1YT2Ga6xEpCRohrRoi90IC08K9YSMJiCNi+GVlliHOOBgg4i9IJLhgFx:z1YO36ohNoaC08K9oJ5G/lFzi`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	130c9e523122d9ce_api-ms-win-crt-environment-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-environment-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`13645e85d6d9cf9b7f4b18566d748d7a`
SHA1	`806a04d85e56044a33935ff15168dadbd123a565`
SHA256	`130c9e523122d9ce605f5c5839421f32e17b5473793de7cb7d824b763e41a789`
CRC32	`4B443D27`
ssdeep	`192:WPWfhWobWULwu0Sc2HnhWgN7a8WybueOk9qnajMDkaU:WPWfhWo5D/HRN7NbzhlQDkaU`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	b59e103f8ec6c119__ctypes.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_ctypes.pyd
Size	120.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`496dcf8821ffc12f476878775999a8f3`
SHA1	`6b89b8fdd7cd610c08e28c3a14b34f751580cffd`
SHA256	`b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80`
CRC32	`45D469DF`
ssdeep	`3072:L7u5LnIx1If3yJdZfLIUAYX5BO89IJLPSVxr:LwxfijZfLIU9BO8f`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	90017928a8a15597_api-ms-win-crt-time-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-time-l1-1-0.dll
Size	14.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`2774d3550b93ba9cbca42d3b6bb874bd`
SHA1	`3fa1fc7d8504199d0f214ccef2fcff69b920040f`
SHA256	`90017928a8a1559745c6790bc40bb6ebc19c5f8cdd130bac9332c769bc280c64`
CRC32	`6D4A0788`
ssdeep	`192:W3JD2WfhWv6WULwu0Sc2HnhWgN7aIWof8XEKup3JdqnajKsX55qg9:W3cWfhWvsD/HRN7SX7aJdlGsXl`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c85f376407bae092_api-ms-win-core-synch-l1-2-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-synch-l1-2-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`87a0961ad7ea1305cbcc34c094c1f913`
SHA1	`3c744251e724ae62f937f4561f8e5cdac38d8a8e`
SHA256	`c85f376407bae092cdbba92cc86c715c7535b1366406cfe50916ff3168454db0`
CRC32	`7005F9A0`
ssdeep	`192:WvtZ36WfhWoilWULwu0Sc2HnhWgN7a8WNuesmsqnaj5fQ1wIuw:WvtZ36WfhWoiPD/HRN7SVs9l1GLr`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	13cbf00e9d399f6a_hfnvizcygemozxgw.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\HfNVizcyGemoZXgW.exe
Size	11.8MB
Processes	2552 (os.exe)
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`aada729aea888ff9495a2874ac7af65f`
SHA1	`49e523be157214e04b16c1cd2c7c87f9b2cd9d68`
SHA256	`13cbf00e9d399f6afc566d347e6210b8d90b823806b02200752d3512b14b0cb9`
CRC32	`4DCCFF5B`
ssdeep	`196608:2LF3ZyqzxbAQvaNJm3AqowejuJDUX47dwdW0tnFwB2nT7vYPJSuI2wlH:qFJyyxy/m3poaUX47d4VnNHeU`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	4ba34ee15d266f65_api-ms-win-core-errorhandling-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-errorhandling-l1-1-0.dll
Size	11.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`ab810b5ed6a091a174196d39af3eb40c`
SHA1	`31f175b456ab5a56a0272e984d04f3062cf05d25`
SHA256	`4ba34ee15d266f65420f9d91bac19db401c9edf97a2f9bde69e4ce17c201ab67`
CRC32	`0E2472AF`
ssdeep	`192:W4mxD3JbDWfhWoqEWULwu0Sc2HnhWgN7a8W1FFUOk9qnajMDkU0:W4AbDWfhWojD/HRN7aghlQDkz`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	64d1ca4ead666023_api-ms-win-core-timezone-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-timezone-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`e8af200a0127e12445eb8004a969fc1d`
SHA1	`a770fe20e42e2bef641c0591c0e763c1c8ba404d`
SHA256	`64d1ca4ead666023681929d86db26cfd3c70d4b2e521135205a84001d25187db`
CRC32	`D15D2B92`
ssdeep	`192:W2BtoXeOWfhWoZWULwu0Sc2HnhWgN7a8Wnmesmsqnaj5fQ1VIe:WUOWfhWozD/HRN78Zs9l1GKe`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	a2c8d0513cad34df_api-ms-win-crt-math-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-math-l1-1-0.dll
Size	20.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`05461408d476053d59af729cebd88f80`
SHA1	`b8182cab7ec144447dd10cbb2488961384b1118b`
SHA256	`a2c8d0513cad34df6209356aeae25b91cf74a2b4f79938788f56b93ebce687d9`
CRC32	`8CE4AB2C`
ssdeep	`384:WjQUbM4Oe59Ckb1hgmLVWfhWoLD/HRN74CXlOnM:yRMq59Bb1jyxLDv4C+M`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	368689a0d2b70a58_base_library.zip Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\base_library.zip
Size	1.7MB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`8e419844496ea5b8fed733642a701d12`
SHA1	`d880a5a62e6a5b5b4532af34c83a4448d7a01df5`
SHA256	`368689a0d2b70a587486f30d47550cebc1022d39c5bf7eead47d247d80f55ce9`
CRC32	`11165E1C`
ssdeep	`24576:mQR5pATt7xm4lUKdcubgAnyfbl90iwhpM2dYf9PssOGTWLdma0HHHC:mQR5pQxmh1SjLga5`
Yara	OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	68fba9dd89bfad35_libffi-8.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\libffi-8.dll
Size	37.3KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`d86a9d75380fab7640bb950aeb05e50e`
SHA1	`1c61aaf9022cd1f09a959f7b2a65fb1372d187d7`
SHA256	`68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b`
CRC32	`132A1798`
ssdeep	`768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	8376a3885961d241_win32ui.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\win32ui.pyd
Size	1.5MB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`7e3a34f9ac65d3b92bcd4b531f5cfdd1`
SHA1	`26654fc95e84905434526c1301dc3c2710958be6`
SHA256	`8376a3885961d2416481f6d180dff9f10fa93114fd4ba1e4b50719a95a2dca02`
CRC32	`4DA2587C`
ssdeep	`12288:AZFWNcLXl04P3GlELDY2JNw6KZ7H29BOFOdnzenLr:UKcLZLY2JNv4b299B`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	8af17a746533844b__uuid.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_uuid.pyd
Size	24.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`a16b1acfdaadc7bb4f6ddf17659a8d12`
SHA1	`482982d623d88627c447f96703e4d166f9e51db4`
SHA256	`8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0`
CRC32	`7E1E872E`
ssdeep	`384:bkfwFpEWM6ivQJIJZwc9HQIYiSy1pCQl+fr4Pxh8E9VF0Nyw1Pd:bkqpEM4QJIJZwC5YiSyvicPxWE25`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	bf5147f4fffbffa7_win32api.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\win32api.pyd
Size	136.5KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`3210cb66deb7f1bbcc46b4c3832c7e10`
SHA1	`5c5f59a29f5ef204f52fd3a9433b3a27d8a30229`
SHA256	`bf5147f4fffbffa77d9169b65af13d983e2fcccdbca8151d72814c55939bb2c4`
CRC32	`9D09F016`
ssdeep	`3072:HmO5Vq7iJmlPhjnDPsSd3lRVSELa8BoXJqsTtygmhN5Z1i2bm+/e:HRI7Iml5jnbXJlRVhsTty95KW`
Yara	OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	9111856645f779f1_pythoncom311.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\pywin32_system32\pythoncom311.dll
Size	675.5KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`f655cc794762ae686c65b969e83f1e84`
SHA1	`ac635354ea70333c439aa7f97f2e1759df883e38`
SHA256	`9111856645f779f137c46d78a68374292fc512a2a4038466476bb9c6024097b5`
CRC32	`2AF86F3B`
ssdeep	`6144:fOkHsgIlh9LjPPhAT+e7jXze0O1VUqOXD69z0FpYcXnphcr1NcpdsOqhxcsfFww/:fqgUhdrGPT8mBXu9IFKQfSapdV6fiw3`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis

Name	3af73012379203c1_api-ms-win-crt-conio-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-conio-l1-1-0.dll
Size	12.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`e4ffa031686b939aaf8cf76a0126f313`
SHA1	`610f3c07f5308976f71928734bbe38db39fbaf54`
SHA256	`3af73012379203c1cb0eab96330e59bc3e8c488601c7b7f48fbe6d685de9523b`
CRC32	`C3FA5559`
ssdeep	`192:WN5WfhWo3WULwu0Sc2HnhWgN7a8W/N9DOk9qnajMDk3USQ:WN5WfhWoFD/HRN7Y/hlQDkkSQ`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	bb3edf0ecdf1b700_api-ms-win-crt-runtime-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-crt-runtime-l1-1-0.dll
Size	16.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`1495fb3efbd22f589f954fec982dc181`
SHA1	`4337608a36318f624268a2888b2b1be9f5162bc6`
SHA256	`bb3edf0ecdf1b700f1d3b5a3f089f28b4433d9701d714ff438b936924e4f8526`
CRC32	`EDE8BC09`
ssdeep	`192:W8PtIPrpJhhf4AN5/KilWfhWjWULwu0Sc2HnhWgN7asWPhIzLMmDWqnajKs76+3R:W8PtYr7LWfhWhD/HRN7+EQmDWlGs76ER`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	962c50afcb9fbfd0_ucrtbase.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\ucrtbase.dll
Size	993.9KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`9679f79d724bcdbd3338824ffe8b00c7`
SHA1	`5ded91cc6e3346f689d079594cf3a9bf1200bd61`
SHA256	`962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36`
CRC32	`CDC59A60`
ssdeep	`24576:ZLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+o:dyubJvlhrVETiR+o`
Yara	Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	39be1d39db5b41a1_api-ms-win-core-console-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-console-l1-1-0.dll
Size	12.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`f5625259b91429bb48b24c743d045637`
SHA1	`51b6f321e944598aec0b3d580067ec406d460c7b`
SHA256	`39be1d39db5b41a1000d400d929f6858f1eb3e75a851bcbd5110fe41e8e39ae5`
CRC32	`F3020F58`
ssdeep	`192:WDGBWfhWxPWULwu0Sc2HnhWgN7aMWBHiOk9qnajMDkVt2:W+WfhWTD/HRN73hlQDkO`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	39942416fdc139d3_api-ms-win-core-profile-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\api-ms-win-core-profile-l1-1-0.dll
Size	11.4KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`053e6daa285f2e36413e5b33c6307c0c`
SHA1	`e0ec3b433b7dfe1b30f5e28500d244e455ab582b`
SHA256	`39942416fdc139d309e45a73835317675f5b9ab00a05ac7e3007bb846292e8c8`
CRC32	`11309323`
ssdeep	`192:WUaVWfhWo+9WULwu0Sc2HnhWgN7a8WeL/ismsqnaj5fQ1TIK+:WUIWfhWo+HD/HRN7tLqs9l1G8K+`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature Admin_Tool_IN_Zero - Admin Tool Sysinternals IsPE64 - (no description)
VirusTotal	Search for analysis

Name	50e21ce62f8d9bab__bz2.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI26442\_bz2.pyd
Size	82.8KB
Processes	2644 (HfNVizcyGemoZXgW.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`a8a37ba5e81d967433809bf14d34e81d`
SHA1	`e4d9265449950b5c5a665e8163f7dda2badd5c41`
SHA256	`50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b`
CRC32	`04B8CF49`
ssdeep	`1536:0RdQz7pZ3catNZTRGE51LOBK5bkb8BsfYqJIJCVM7SyTjPxL:0/Qz9Z5VOwkIBsAqJIJCVM9x`
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis