Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

bNdOhKPy0F.exe

Status: finished
Submission Time: 2021-06-16 12:17:48 +02:00
Malicious
Trojan
Spyware
Evader
Raccoon RedLine SmokeLoader Tofsee

Comments

Tags

  • exe

Details

  • Analysis ID:
    435324
  • API (Web) ID:
    802916
  • Analysis Started:
    2021-06-16 12:17:48 +02:00
  • Analysis Finished:
    2021-06-16 12:37:58 +02:00
  • MD5:
    c5c9a99d045fd2b0380e2b7e3fd28189
  • SHA1:
    56d82d12434d7069bfccc93d35d7312289b65ea8
  • SHA256:
    ae7ae9ea7fd0100b620704d462083caaedda2c5c5618ceeca54c1d7673b6be4a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 23/67
malicious

IPs

IP Country Detection
95.216.186.40
 Germany
95.213.144.186
 Russian Federation
87.251.71.118
 Russian Federation
Click to see the 4 hidden entries
176.111.174.89
 Russian Federation
185.156.177.26
 Russian Federation
91.212.150.205
 Russian Federation
34.76.8.115
 United States

Domains

Name IP Detection
999080321test14781-service10020125999080321.info
 0.0.0.0
999080321test136831-service10020125999080321.space
 0.0.0.0
999080321newfolder33417-012425999080321.space
 0.0.0.0
Click to see the 22 hidden entries
api.ip.sb
 0.0.0.0
999080321test147831-service10020125999080321.space
 0.0.0.0
999080321test134831-service10020125999080321.space
 0.0.0.0
999080321newfolder3100231-service1002.space
 0.0.0.0
999080321newfolder1002002531-service1002.space
 0.0.0.0
999080321test15671-service10020125999080321.tech
 0.0.0.0
999080321test125831-service10020125999080321.space
 0.0.0.0
999080321test61-service10020125999080321.website
 0.0.0.0
999080321test146831-service10020125999080321.space
 0.0.0.0
999080321newfolder1002002431-service1002.space
 0.0.0.0
tttttt.me
 95.216.186.40
999080321newfolder1002002231-service1002.space
 0.0.0.0
999080321utest1341-service10020125999080321.ru
 0.0.0.0
999080321test13561-service10020125999080321.su
 0.0.0.0
999080321newfolder1002002131-service1002.space
 0.0.0.0
18.52.17.84.in-addr.arpa
 0.0.0.0
999080321est213531-service1002012425999080321.ru
 0.0.0.0
999080321test12671-service10020125999080321.online
 0.0.0.0
999080321yes1t3481-service10020125999080321.ru
 0.0.0.0
999080321test13461-service10020125999080321.net
 0.0.0.0
999080321uest71-service100201dom25999080321.ru
 0.0.0.0
999080321test51-service10020125999080321.xyz
 185.156.177.26

URLs

Name Detection
http://999080321newfolder1002-01452599908032135.site/
http://999080321newfolder1002-01352599908032135.site/
http://999080321test13561-service10020125999080321.su/
Click to see the 97 hidden entries
http://999080321newfolder1002-service100201life25999080321.ru/
http://999080321newfolder1002002231-service1002.space/
http://999080321test146831-service10020125999080321.space/
http://999080321newfolder1002-01552599908032135.site/
http://999080321besttest971-service10020125999080321.ru/
http://999080321megatest251-service10020125999080321.ru/
http://999080321newfolder1002-01492599908032135.site/
http://999080321newfolder1002-01362599908032135.site/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321proftest981-service10020125999080321.ru/
http://999080321newfolder1002-01512599908032135.site/
http://95.213.144.186:8080/3.php
http://999080321newfolder1002002131-service1002.space/
http://127.0.0.1/
http://999080321newfolder351-service10020125999080321.ru/
http://999080321test51-service10020125999080321.xyz/raccon.exe
http://999080321newfolder1002-01412599908032135.site/
http://999080321tostest371-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yirtest231-service10020125999080321.ru/
http://999080321shoptest871-service10020125999080321.ru/
http://999080321newfolder1002002431-service1002.space/
https://tttttt.me/mimimimaxormin
http://999080321newfolder1002-012625999080321.ga/
http://999080321newfolder471-service10020125999080321.ru/
http://999080321newfolder1002-01422599908032135.site/
http://999080321newfoldert161-service1002012425999080321.ru/
http://999080321newfolder1002-01322599908032135.site/
http://999080321newfolder1002-01312599908032135.site/
http://999080321newfolder1002-01392599908032135.site/
http://999080321test571-service10020125999080321.pro/
http://999080321test281-service10020125999080321.ru/
http://999080321test134831-service10020125999080321.space/
http://999080321newfolder100251-service25999080321.ru/
http://999080321newfolder1002-service100201blog25999080321.ru/
http://999080321mytest151-service1002012425999080321.ru/
http://999080321newfolder1002-01472599908032135.site/
http://999080321newfolder1002-01302599908032135.site/
http://91.212.150.205/filename.exe
http://999080321newfolder1002-01532599908032135.site/
http://999080321newfolder1002-01332599908032135.site/
http://999080321newfolder1002-01382599908032135.site/
http://999080321newfolder1002-012725999080321.cf/
http://999080321newfolder1002-01442599908032135.site/
http://999080321test14781-service10020125999080321.info/
http://999080321newfolder1002-service100201shop25999080321.ru/
http://999080321test51-service10020125999080321.xyz/
http://999080321newfolder1002-01502599908032135.site/
http://999080321test15671-service10020125999080321.tech/
http://999080321newfolder1002-012525999080321.ml/
http://999080321test13461-service10020125999080321.net/
http://999080321test231-service10020125999080321.fun/
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
http://tempuri.org/
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
https://ipinfo.io/ip%appdata%
http://34.76.8.115//l/f/jV7rBnoBuI_ccNKoDPQZ/8c9243abed88ae742099a303cebe9c7956888979
http://schemas.xmlsoap.org/ws/2004/08/addressing
http://www.carterandcone.coml
http://tempuri.org/Endpoint/GetArgumentsResponse
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
https://api.ip.sb
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
http://www.fonts.com
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
http://87.251.71.118
http://tempuri.org/0D
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
https://duckduckgo.com/ac/?q=
https://dev.virtualearth.net/REST/v1/Locations
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
https://duckduckgo.com/chrome_newtab
http://bot.whatismyipaddress.com/
http://www.fontbureau.com/designers/cabarga.htmlN
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
https://dev.virtualearth.net/REST/v1/Routes/Driving
https://icanhazip.com5https://wtfismyip.com/textChttp://bot.whatismyipaddress.com/3http://checkip.dy
http://tempuri.org/Endpoint/GetArguments
http://www.founder.com.cn/cn/bThe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
http://www.zhongyicts.com.cn
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
http://www.typography.netD
https://dynamic.t
http://tempuri.org/Endpoint/VerifyUpdate
http://www.galapagosdesign.com/DPlease
http://checkip.dyndns.org
http://fontfabrik.com
http://tempuri.org/Endpoint/VerifyScanRequest
https://dev.virtualearth.net/REST/v1/Routes/Transit
https://wtfismyip.com/text
http://www.fontbureau.com/designers
https://api.ip.sb/geoip%USERPEnvironmentROFILE%
http://www.sandoll.co.kr

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\4DAB.exe
 PE32+ executable (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\5CDE.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\6ACA.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
Click to see the 97 hidden entries
C:\Users\user\AppData\Local\Temp\88A3.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\2531.exe
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\bquyobss.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\vcruntime140.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\3252.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\1D31.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2531.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\LocalLow\x3CF3EDNhm3.zip
 empty
 #
C:\Users\user\AppData\LocalLow\sqlite3.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\rQF69AzBla
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\LocalLow\machineinfo.txt
 ASCII text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\libEGL.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ucrtbase.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\qipcap.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\prldap60.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\pY4zE3fX7h.zip
 Zip archive data, at least v2.0 to extract
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssdbm3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nssckbi.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\nss3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\msvcp140.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32_InUse.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\mozMapi32.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\lgpllibs.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\tmp3060.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpEB6C.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpD1A4.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmpBA3A.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp8D9B.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp8D6B.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp5FC2.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp5FC1.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp5EA7.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp3091.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp3061.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\9CA2.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp13FB.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp13CC.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp138C.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp138B.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp135B.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp135A.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\tmp131.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\Local\Temp\MpCmdRun.log
 data
 #
C:\Users\user\AppData\Local\Temp\AE30.tmp
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\ACE1.tmp
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l2-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-rtlsupport-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-profile-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-1.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processthreads-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-processenvironment-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-namedpipe-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-memory-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-localization-l1-2-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-libraryloader-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-interlocked-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-heap-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-handle-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-string-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-file-l1-2-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy_InUse.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\MapiProxy.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\IA2Marshal.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleMarshal.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\AccessibleHandler.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\frAQBc8Wsa
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\LocalLow\RYwTiizs2t
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\Users\user\AppData\LocalLow\1xVPfvJcrg
 SQLite 3.x database, last written using SQLite version 3032001
 #
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
 data
 #
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
 Extensible storage engine DataBase, version 0x620, checksum 0x428a5b17, page size 16384, DirtyShutdown, Windows version 10.0
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-math-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldif60.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\ldap60.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\breakpadinjector.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-utility-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-time-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-string-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-stdio-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-runtime-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-process-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-private-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-multibyte-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\ProgramData\Microsoft\Network\Downloader\edb.log
 data
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-locale-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-heap-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-filesystem-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-environment-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-convert-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-crt-conio-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-util-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-timezone-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-sysinfo-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-2-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\LocalLow\gC9tT2iQ3s\api-ms-win-core-synch-l1-1-0.dll
 PE32 executable (DLL) (console) Intel 80386, for MS Windows
 #