Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	8166321f14d5804c_api-ms-win-crt-heap-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-heap-l1-1-0.dll
Size	12.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`212d58cefb2347bd694b214a27828c83`
SHA1	`f0e98e2d594054e8a836bd9c6f68c3fe5048f870`
SHA256	`8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989`
CRC32	`4B7C0CDA`
ssdeep	`192:8a9aY17aFBRAWYhWYWWFYg7VWQ4eWbr0tJSUtpwBqnajrmaaG:8ad9WYhW4F/qlQG`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	76fdb83fde238226_VCRUNTIME140.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\VCRUNTIME140.dll
Size	106.8KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`870fea4e961e2fbd00110d3783e529be`
SHA1	`a948e65c6f73d7da4ffde4e8533c098a00cc7311`
SHA256	`76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644`
CRC32	`D4EEA8EC`
ssdeep	`1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	9447218cc4ab1a2c_api-ms-win-core-string-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-string-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`7a15b909b6b11a3be6458604b2ff6f5e`
SHA1	`0feb824d22b6beeb97bce58225688cb84ac809c7`
SHA256	`9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234`
CRC32	`C3008D3F`
ssdeep	`192:byMvQWYhW5fWWFYg7VWQ4eWio3gDwcunYqnajv9JS:byMvQWYhW/BXwulhw`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	19c78ef5ba470c5b_api-ms-win-core-sysinfo-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-sysinfo-l1-1-0.dll
Size	12.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`9d43b5e3c7c529425edf1183511c29e4`
SHA1	`07ce4b878c25b2d9d1c48c462f1623ae3821fcef`
SHA256	`19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328`
CRC32	`2309E14A`
ssdeep	`192:fKIMFFyWYhW6WWFYg7VWQ4eWoVjxceXqnajLJ4:fcyWYhWKRjmAlnJ4`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	1c72ac404781a998_api-ms-win-core-synch-l1-2-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-synch-l1-2-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`d175430eff058838cee2e334951f6c9c`
SHA1	`7f17fbdcef12042d215828c1d6675e483a4c62b1`
SHA256	`1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a`
CRC32	`8AC8A06F`
ssdeep	`192:ztZ3XWYhW3WWFYg7VWQ4eWNnpit7ZqnajgnLSl:ztZ3XWYhWVg+llk2`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	aa1e959dcff75a34_python311.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\python311.dll
Size	5.5MB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`a72993488cecd88b3e19487d646f88f6`
SHA1	`5d359f4121e0be04a483f9ad1d8203ffc958f9a0`
SHA256	`aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038`
CRC32	`4F61F064`
ssdeep	`98304:qvpgHup+dhRXLPw3W47SrSUHfMWdPrjUOYmIF:qvpgHup+XJrYWYWdjUOYmU`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) anti_vm_detect - Possibly employs anti-virtualization techniques Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	8eecdcc250637652__bz2.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\_bz2.pyd
Size	81.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`10d42efac304861ad19821b4594fa959`
SHA1	`1a65f60bba991bc7e9322af1e19f193dae76d77a`
SHA256	`8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14`
CRC32	`608E1CBD`
ssdeep	`1536:KouLz7p5TcaWlZkKWVa5cP6T8MsAUxZIgtVt7SyKrPxji2:JuLz9tVaDQMslxZIgtVtozxj/`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	175c4cb528f1ac4e_unicodedata.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\unicodedata.pyd
Size	1.1MB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`cdb5f373d24adceb4dc4fa1677757f0c`
SHA1	`af6b381eed65d244c57129346008ec8532ba336b`
SHA256	`175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9`
CRC32	`3F73744D`
ssdeep	`12288:g32YbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ub:gGYbM00IDJcjEwPgPOG6Xyd461ub`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	6c008be766c44bf9_api-ms-win-crt-convert-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-convert-l1-1-0.dll
Size	15.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`285dcd72d73559678cfd3ed39f81ddad`
SHA1	`df22928e43ea6a9a41c1b2b5bfcab5ba58d2a83a`
SHA256	`6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44`
CRC32	`BE8D83DC`
ssdeep	`192:JM0wd8dc9cydWYhWyWWFYg7VWQ4eW9jTXfH098uXqnajH/VCf:G0wd8xydWYhWi2bXuXlTV2`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c78a1217f8dcb157_api-ms-win-core-handle-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-handle-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`bbafa10627af6dfae5ed6e4aeae57b2a`
SHA1	`3094832b393416f212db9107add80a6e93a37947`
SHA256	`c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d`
CRC32	`EF73D66F`
ssdeep	`192:P9RWYhWEWWFYg7VWQ4eWncTjxceXqnajLJS:LWYhWk3TjmAlnJS`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	3d798b9c345a507e_api-ms-win-core-timezone-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-timezone-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`43e1ae2e432eb99aa4427bb68f8826bb`
SHA1	`eee1747b3ade5a9b985467512215caf7e0d4cb9b`
SHA256	`3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c`
CRC32	`1A7AE38B`
ssdeep	`192:4EWYhWdWWFYg7VWQ4eWvvJ6jxceXqnajLJn:4EWYhWbwYjmAlnJ`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c81c4bba4e5f2053_api-ms-win-crt-utility-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-utility-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`6f1a1dfb2761228ccc7d07b8b190054c`
SHA1	`117d66360c84a0088626e22d8b3b4b685cb70d56`
SHA256	`c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed`
CRC32	`3DA5914B`
ssdeep	`192:GI6fHQduPWYhWcWWFYg7VWQ4yWpbdsQlmqnajlDPD:2f5WYhW8Kd6l9L`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	dadbd2204b015e81_api-ms-win-core-memory-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-memory-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`808f1cb8f155e871a33d85510a360e9e`
SHA1	`c6251abff887789f1f4fc6b9d85705788379d149`
SHA256	`dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3`
CRC32	`07D2DB48`
ssdeep	`96:qo1aCFEWYhWwp/DEs39DHDs35FrsvYgmr0DD0ADEs3TDL2L4m2grMWaLNpDEs3OC:teWYhWVWWFYg7VWQ4yWwAKZRqnajl6x7`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	c9a686030e073975_api-ms-win-core-processthreads-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-processthreads-l1-1-0.dll
Size	13.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`e173f3ab46096482c4361378f6dcb261`
SHA1	`7922932d87d3e32ce708f071c02fb86d33562530`
SHA256	`c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14`
CRC32	`8BE6906C`
ssdeep	`192:AWXk1JzX9cKSIvWYhWLWWFYg7VWQ4SWW0uI7oinEqnajxMyqY:AWXk1JzNcKSIvWYhW5+uOEle6`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	33ae42f744d2688b__lzma.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\_lzma.pyd
Size	153.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`3230404a7191c6228a8772d3610e49e5`
SHA1	`4e8e36c89b4ff440ddff9a5b084b262c9b2394ec`
SHA256	`33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903`
CRC32	`2A4237AC`
ssdeep	`3072:jlirS97HrdVmEkGCm5heznf49mNo2OOvJ72ZIge1z7axC:jlirG0EkT7AYO2OQSE`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	7cb0396229c3da43_api-ms-win-core-file-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-file-l1-1-0.dll
Size	14.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`580d9ea2308fc2d2d2054a79ea63227c`
SHA1	`04b3f21cbba6d59a61cd839ae3192ea111856f65`
SHA256	`7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66`
CRC32	`9A90787C`
ssdeep	`192:+AuVYPvVX8rFTsRWYhWyWWFYg7VWQ4eWQBAW+JSdqnajeMoLR9au:TBPvVXLWYhWiBdlaLFAu`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	b02324c49dd039fa_api-ms-win-core-interlocked-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-interlocked-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`a038716d7bbd490378b26642c0c18e94`
SHA1	`29cd67219b65339b637a1716a78221915ceb4370`
SHA256	`b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08`
CRC32	`E7E2F31B`
ssdeep	`192:nWYhWNWWFYg7VWQ4uWtGDlR/BVrqnajcU8:nWYhWLJDlRLlAU8`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	edc1699e9995f988_api-ms-win-crt-locale-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-locale-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`242829c7be4190564becee51c7a43a7e`
SHA1	`663154c1437acf66480518068fbc756f5cabb72f`
SHA256	`edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0`
CRC32	`50B4BE92`
ssdeep	`192:+WYhWoWWFYg7VWQ4eWSoV7jjT6iBTqnajbQwr1:+WYhWIiVTTXZl3QC`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	4390c389bbbf9ec7_api-ms-win-crt-runtime-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-runtime-l1-1-0.dll
Size	15.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`883120f9c25633b6c688577d024efd12`
SHA1	`e4fa6254623a2b4cdea61712cdfa9c91aa905f18`
SHA256	`4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc`
CRC32	`02EBE202`
ssdeep	`192:maajPrpJhhf4AN5/KixWYhW4XWWFYg7VWQ4eWvppXjxceXqnajLJhrdCq:mlbr7nWYhW41MXjmAlnJhUq`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	813eede996fc08e1_select.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\select.pyd
Size	28.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`116335ebc419dd5224dd9a4f2a765467`
SHA1	`482ef3d79bfd6b6b737f8d546cd9f1812bd1663d`
SHA256	`813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4`
CRC32	`96BE7AAD`
ssdeep	`384:Ag1ecReJK4HquuI7A70RUZNIg7GXIYiSy1pCQm3MnfPxh8E9VF0NyyRt:AseUeJRHqgbGNIg7GYYiSyvwMfPxWEo`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	b119adad588ebca7_api-ms-win-crt-conio-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-conio-l1-1-0.dll
Size	12.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`031dc390780ac08f498e82a5604ef1eb`
SHA1	`cf23d59674286d3dc7a3b10cd8689490f583f15f`
SHA256	`b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede`
CRC32	`6F514D2F`
ssdeep	`192:R0WYhWRWWFYg7VWQ4eWLeNxUUtpwBqnajrmaaG:R0WYhWPzjqlQG`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	974af1f1a38c0286_api-ms-win-crt-filesystem-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-filesystem-l1-1-0.dll
Size	13.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`41fbbb054af69f0141e8fc7480d7f122`
SHA1	`3613a572b462845d6478a92a94769885da0843af`
SHA256	`974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c`
CRC32	`F288C0C1`
ssdeep	`192:CGnWlC0i5ClWYhWwWWFYg7VWQ4eWtOUtpwBqnajrmaaGN4P:9nWm5ClWYhWQ8qlQGN6`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	2e981ee04f35c0e0_api-ms-win-core-heap-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-heap-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`3a4b6b36470bad66621542f6d0d153ab`
SHA1	`5005454ba8e13bac64189c7a8416ecc1e3834dc6`
SHA256	`2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af`
CRC32	`1128080C`
ssdeep	`192:5t6DjZlTIWYhWsWWFYg7VWQ4eW4MtkR/BVrqnajc:5t6Dll0WYhWMqkRLlA`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	349a79fa1572e353_api-ms-win-core-file-l2-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-file-l2-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`3bf4406de02aa148f460e5d709f4f67d`
SHA1	`89b28107c39bb216da00507ffd8adb7838d883f6`
SHA256	`349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e`
CRC32	`229FFD69`
ssdeep	`192:/VyWYhWjAWWFYg7VWQ4eWiuNwzNbDXbBqnaj0q:/VyWYhW8g+LbBlwq`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	08484ed55e435840_api-ms-win-core-libraryloader-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-libraryloader-l1-1-0.dll
Size	12.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`d75144fcb3897425a855a270331e38c9`
SHA1	`132c9ade61d574aa318e835eb78c4cccddefdea2`
SHA256	`08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f`
CRC32	`1B7E8229`
ssdeep	`192:FvuBL3BBLZWYhWxWWFYg7VWQ4uW4g0jrQYcunYqnajv9Ml:FvuBL3BPWYhWv8jYulhMl`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	2afbfa1d77969d0f_api-ms-win-core-console-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-console-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`919e653868a3d9f0c9865941573025df`
SHA1	`eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2`
SHA256	`2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c`
CRC32	`5C110711`
ssdeep	`192:4nWYhWxWWFYg7VWQ4uWjXUtpwBqnajrmaaGJ:2WYhWvZqlQGJ`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	976ce72efd0a8aee_libcrypto-1_1.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\libcrypto-1_1.dll
Size	3.3MB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`6f4b8eb45a965372156086201207c81f`
SHA1	`8278f9539463f0a45009287f0516098cb7a15406`
SHA256	`976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541`
CRC32	`C804BB75`
ssdeep	`49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	28a6f44d2659159d_base_library.zip Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\base_library.zip
Size	1.4MB
Processes	2556 (reverse_ctl.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`43e4288f2fe9c2b8527306fc075f2e24`
SHA1	`4a4de54c96579e55945eef355a65cb47e019c5bd`
SHA256	`28a6f44d2659159d3be35d7dc2e6c566e6d02964819f466f513f80c394a73700`
CRC32	`4CE864E6`
ssdeep	`24576:mQR5pATt7xm4lUKdcubgAnyfbTI0iwhxdYf9PssaHH4:mQR5pQxmfaH`
Yara	zip_file_format - ZIP file format
VirusTotal	Search for analysis

Name	b57e70798af248f9_api-ms-win-core-namedpipe-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-namedpipe-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`cff476bb11cc50c41d8d3bf5183d07ec`
SHA1	`71e0036364fd49e3e535093e665f15e05a3bde8f`
SHA256	`b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363`
CRC32	`CAF6C0B0`
ssdeep	`192:cWYhWZSWWFYg7VWQ4eWkcc7ZqnajgnLSp:cWYhW84cllk2p`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	02d987eba4a65509_api-ms-win-core-rtlsupport-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-rtlsupport-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`e1ba66696901cf9b456559861f92786e`
SHA1	`d28266c7ede971dc875360eb1f5ea8571693603e`
SHA256	`02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f`
CRC32	`0F59D11D`
ssdeep	`192:4GeVvXK9WYhW1WWFYg7VWQ4yWj6k50IsQlmqnajlDl:4GeVy9WYhWzVk6l9l`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	45e0835b1d3b446f_api-ms-win-crt-string-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-string-l1-1-0.dll
Size	17.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`f816666e3fc087cd24828943cb15f260`
SHA1	`eae814c9c41e3d333f43890ed7dafa3575e4c50e`
SHA256	`45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a`
CRC32	`A44ECE3B`
ssdeep	`384:NFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl/WYhW49PBolniMcx:T5yguNvZ5VQgx3SbwA71IkFwNJT`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	191f53988c7f02dd_api-ms-win-crt-process-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-process-l1-1-0.dll
Size	12.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`dd899c6ffecce1dca3e1c3b9ba2c8da2`
SHA1	`2914b84226f5996161eb3646e62973b1e6c9e596`
SHA256	`191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae`
CRC32	`7B612CBD`
ssdeep	`192:+nqjd7dWYhWDWWFYg7VWQ4yWMJ5HKZRqnajl6b:+nsWYhWxp5HyRlwb`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	25a99bdf8bf4d160_api-ms-win-core-processthreads-l1-1-1.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-processthreads-l1-1-1.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`9c9b50b204fcb84265810ef1f3c5d70a`
SHA1	`0913ab720bd692abcdb18a2609df6a7f85d96db3`
SHA256	`25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40`
CRC32	`E6B055BF`
ssdeep	`192:NtxDfIeA6WYhW7WWFYg7VWQ4eWpB5ABzR/BVrqnajcb:NtxDfIeA6WYhWp28RLlA`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	77577f35d3a61217_api-ms-win-core-datetime-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-datetime-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`ac51e3459e8fce2a646a6ad4a2e220b9`
SHA1	`60cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a`
SHA256	`77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638`
CRC32	`F8872DD0`
ssdeep	`192:5WYhWYWWFYg7VWQ4SWSS/njxceXqnajLJ35H:5WYhW4gjmAlnJpH`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	b48310b0837027f7_api-ms-win-crt-time-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-time-l1-1-0.dll
Size	13.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`143a735134cd8c889ec7d7b85298705b`
SHA1	`906ac1f3a933dd57798ae826bbefa3096c20d424`
SHA256	`b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2`
CRC32	`AC916782`
ssdeep	`192:qy5NDSWYhWcQWWFYg7VWQ4eWAcSJR/BVrqnajcm2:qU0WYhWcwASJRLlA`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	5eb724c51eecba9a_api-ms-win-core-util-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-util-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`735636096b86b761da49ef26a1c7f779`
SHA1	`e51ffbddbf63dde1b216dccc753ad810e91abc58`
SHA256	`5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3`
CRC32	`D1B96D02`
ssdeep	`192:dZ89WYhWFWWFYg7VWQ4eW5QLyFqnajziMOci:dZ89WYhWDnolniMOP`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	42f4e84073cf876b_api-ms-win-core-profile-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-profile-l1-1-0.dll
Size	10.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`0233f97324aaaa048f705d999244bc71`
SHA1	`5427d57d0354a103d4bb8b655c31e3189192fc6a`
SHA256	`42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594`
CRC32	`AA54827C`
ssdeep	`192:clIHyZ36WYhWulWWFYg7VWQ4yWqeQDbLtsQlmqnajlDC:clIHyZKWYhWKhlbp6l9C`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	45e48320abe6e3c6_api-ms-win-core-debug-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-debug-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`b0e0678ddc403effc7cdc69ae6d641fb`
SHA1	`c1a4ce4ded47740d3518cd1ff9e9ce277d959335`
SHA256	`45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1`
CRC32	`8B2DFCED`
ssdeep	`192:4WYhWFsWWFYg7VWQ4eWZzAR/BVrqnajcJH:4WYhWFMJRLlA5`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	441d32922122e59f__hashlib.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\_hashlib.pyd
Size	62.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`f419ac6e11b4138eea1fe8c86689076a`
SHA1	`886cda33fa3a4c232caa0fa048a08380971e8939`
SHA256	`441d32922122e59f75a728cc818f8e50613866a6c3dec627098e6cc6c53624e2`
CRC32	`5EB1F0DF`
ssdeep	`1536:aS8njpHxGkYjEbEJkn8cw6TxIg5Iyv7SyKPxk:InjpHxYJ8w6TxIg5IyvMxk`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	b8409829dc4fde70__decimal.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\_decimal.pyd
Size	245.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`a1ffc2a156e9266932c351a88e5e7fab`
SHA1	`ebfc901c28035264fbb5b0f30e68ab3b45410d13`
SHA256	`b8409829dc4fde70f38754de55d3090a1cd52c78ffece2a08572a58de3af294d`
CRC32	`BC5E85B9`
ssdeep	`6144:3Zu25e1itIj95vlqyhw+H8DOdKd2vk6LhKwwI9qWM53pLW1AxzwhtTYW3iQ:Jhe1oIj7vlpN8D0KA3swwJ/wzTYWf`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	aa3e3e99964d7f9b_api-ms-win-crt-environment-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-environment-l1-1-0.dll
Size	11.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`5cce7a5ed4c2ebaf9243b324f6618c0e`
SHA1	`fdb5954ee91583a5a4cbb0054fb8b3bf6235eed3`
SHA256	`aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3`
CRC32	`C4CDC41A`
ssdeep	`192:6KNMWYhW6WWFYg7VWQ4eWSA5lJSdqnajeMh3:6KNMWYhWKiKdlaW`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	6f6f6e857b347f70_api-ms-win-crt-stdio-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-stdio-l1-1-0.dll
Size	17.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`29680d7b1105171116a137450c8bb452`
SHA1	`492bb8c231aae9d5f5af565abb208a706fb2b130`
SHA256	`6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af`
CRC32	`E9EA45AD`
ssdeep	`192:WpPLNPjFuWYFxEpahTWYhWHWWFYg7VWQ4eW9M3u57ZqnajgnLSuRCz:W19OFVhTWYhWlBu5llk2`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	360744663fce8dec__socket.pyd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\_socket.pyd
Size	76.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`0fc65ec300553d8070e6b44b9b23b8c0`
SHA1	`f8db6af578cf417cfcddb2ed798c571c1abd878f`
SHA256	`360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c`
CRC32	`527B2219`
ssdeep	`1536:/2JlcAdpEVuji9/s+S+pmGQRivVia3iNIgQw97Sy2Pxe:/27ce+uji9/sT+pmGdvVp3iNIgQw9cxe`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	a31a15bed26232a1_api-ms-win-core-synch-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-synch-l1-1-0.dll
Size	13.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`6c3fcd71a6a1a39eab3e5c2fd72172cd`
SHA1	`15b55097e54028d1466e46febca1dbb8dbefea4f`
SHA256	`a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26`
CRC32	`2455B392`
ssdeep	`192:L1dv3V0dfpkXc2MAvVaoKKDWYhWTJWWFYg7VWQ4uWoSUtpwBqnajrmaaGWpmJ:Zdv3V0dfpkXc0vVaeWYhWj/qlQGWpmJ`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	accdd7455fb6d02f_api-ms-win-core-errorhandling-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-errorhandling-l1-1-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`94788729c9e7b9c888f4e323a27ab548`
SHA1	`b0ba0c4cf1d8b2b94532aa1880310f28e87756ec`
SHA256	`accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187`
CRC32	`F65C0C7F`
ssdeep	`192:imxD3vEWYhWnWWFYg7VWQ4eWMOwNbDXbBqnaj0qJm8:iIEWYhWFpLbBlwqJm`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	059cb23fdcf4d80b_api-ms-win-core-localization-l1-2-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-localization-l1-2-0.dll
Size	13.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`8acb83d102dabd9a5017a94239a2b0c6`
SHA1	`9b43a40a7b498e02f96107e1524fe2f4112d36ae`
SHA256	`059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413`
CRC32	`722FE7AF`
ssdeep	`384:NOMw3zdp3bwjGzue9/0jCRrndbwNWYhW6WAulh2:NOMwBprwjGzue9/0jCRrndbw5D`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	aa415db99828f30a_api-ms-win-core-processenvironment-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-processenvironment-l1-1-0.dll
Size	12.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`f43286b695326fc0c20704f0eebfdea6`
SHA1	`3e0189d2a1968d7f54e721b1c8949487ef11b871`
SHA256	`aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43`
CRC32	`85AE2F1D`
ssdeep	`192:qKWYhWbWWFYg7VWQ4eWYoWjxceXqnajLJe:qKWYhWJ4WjmAlnJe`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	7a3c5167731238cf_api-ms-win-core-file-l1-2-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-core-file-l1-2-0.dll
Size	11.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`35bc1f1c6fbccec7eb8819178ef67664`
SHA1	`bbcad0148ff008e984a75937aaddf1ef6fda5e0c`
SHA256	`7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7`
CRC32	`0A8E9D6A`
ssdeep	`192:dzWYhW1sWWFYg7VWQ4yWL3sQlmqnajlD4h1N:BWYhW2e6l94h1N`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis

Name	10521fe73fe05f2b_ucrtbase.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\ucrtbase.dll
Size	987.9KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`61eb0ad4c285b60732353a0cb5c9b2ab`
SHA1	`21a1bea01f6ca7e9828a522c696853706d0a457b`
SHA256	`10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd`
CRC32	`AC6134A3`
ssdeep	`24576:xOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLh:xO1aNoaxNfo/+a`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	f6a93fe6b57a54aa_api-ms-win-crt-math-l1-1-0.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_MEI25562\api-ms-win-crt-math-l1-1-0.dll
Size	20.4KB
Processes	2556 (reverse_ctl.exe)
Type	PE32+ executable (DLL) (console) x86-64, for MS Windows
MD5	`fb79420ec05aa715fe76d9b89111f3e2`
SHA1	`15c6d65837c9979af7ec143e034923884c3b0dbd`
SHA256	`f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e`
CRC32	`F5805EB6`
ssdeep	`192:8JIDSM4Oe59rmkUALQe1hgmL44WYhWWWWFYg7VWQ4yWARgKZRqnajl6umA:8JI2M4Oe59Ckb1hgmLhWYhW2v2yRlwQ`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description)
VirusTotal	Search for analysis