Windows Analysis Report
d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi.zip

Overview

General Information

Sample name: d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi.zip
Analysis ID: 1532102
MD5: 2e68d1dbedf3e80f938a305ada936c8d
SHA1: 81cac25a0e566d7741961dd0f9c93bdd16c81e88
SHA256: 8e36968274e6eff65a02d776953af1147ad72b682bb340457d119a5512365605
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Yara detected Remcos RAT
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Found API chain indicative of debugger detection
Loading BitLocker PowerShell Module
PE file has a writeable .text section
Sigma detected: Suspicious PowerShell Parameter Substring
Uses whoami command line tool to query computer and username
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Found malware configuration
Source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack Malware Configuration Extractor: Remcos {"Version": "5.1.1 Pro", "Host:Port:Password": "45.133.74.183:2404", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "Rmc-1QFIL0", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
Multi AV Scanner detection for domain / URL
Source: 45.133.74.183 Virustotal: Detection: 8% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1748957291.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750127063.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1742404659.00000000051C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1749417346.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1753919014.00000000057F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1764870232.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750585922.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1751129561.000000000532A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Coolmuster PDF Image Extractor.exe PID: 4680, type: MEMORYSTR
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_6c98e2b3-3
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\license_En.txt Jump to behavior
Source: Binary string: E:\Project\Software\Common\tags\102.libBasic-2.6\msw\2017\libBasic\Win32\Release\lib\libBasic.pdbBB%GCTL source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799114042.0000000073D7C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Release\Module.View.pdb>>#GCTL source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791496099.000000006CB77000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: E:\Project\Software\Common\tags\103.libUpdate-1.6\msw\2017\Release\libUpdate.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791049275.000000006CB3C000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: E:\software\Lib\common\glog-20161230\src\build\vsprojects\libglog\Release\libglog.pdb"" source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792741802.000000006CC0D000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: E:\Project\Software\Common\tags\104.libI18n-1.3\msw\2017\I18n\Release\libI18n.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1800329373.0000000074AC6000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Release\Module.View.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791496099.000000006CB77000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: E:\software\Lib\common\glog-20161230\src\build\vsprojects\libglog\Release\libglog.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792741802.000000006CC0D000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: ucrtbase.pdb source: ucrtbase.dll.14.dr
Source: Binary string: E:\Project\Software\Common\tags\17.register-1.1\msw-2017\Release\libRG.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799526500.0000000073DEB000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: E:\Project\Software\Common\tags\102.libBasic-2.6\msw\2017\libBasic\Win32\Release\lib\libBasic.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799114042.0000000073D7C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799804567.00000000747F1000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1798016768.0000000073CE1000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\ImageUtility.pdb2 source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1773080344.000000006BC5F000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Win32\Release\Bin\FileProcessManager.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000000.1709763138.0000000000214000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: E:\Project\Software\Common\tags\103.libUpdate-1.6\msw\2017\Release\libUpdate.pdb$$ source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791049275.000000006CB3C000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\vccorlib140.i386.pdb source: vccorlib140.dll.14.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\vccorlib140.i386.pdbGCTL source: vccorlib140.dll.14.dr
Source: Binary string: D:\DGProject\bin\Win32\Release\GuardEassosRestoreBoot.pdb source: GuardEassosRestoreBoot,1.exe.14.dr
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Release\Module.Helper.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1788395528.000000006C9BC000.00000002.00000001.01000000.00000016.sdmp, Module.Helper.dll.14.dr
Source: Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\ImageUtility.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1773080344.000000006BC5F000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: E:\Project\Software\Common\tags\104.libI18n-1.3\msw\2017\I18n\Release\libI18n.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1800329373.0000000074AC6000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Win32\Release\Bin\FileProcessManager.pdbJJ2 source: Coolmuster PDF Image Extractor.exe, 0000000F.00000000.1709763138.0000000000214000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: E:\Project\Software\Common\tags\85.groceryc-1.1\msw\2017\temp\link\groceryc\Release\groceryc.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792221350.000000006CBD6000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-xstate-l2-1-0.pdb source: API-MS-Win-core-xstate-l2-1-0.dll.14.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.14.dr
Source: Binary string: E:\Project\Software\Common\tags\85.groceryc-1.1\msw\2017\temp\link\groceryc\Release\groceryc.pdbEE"GCTL source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792221350.000000006CBD6000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.14.dr
Source: Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.14.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 45.133.74.183
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1789730468.000000006CA95000.00000002.00000001.01000000.00000017.sdmp, libcurl.dll.14.dr String found in binary or memory: http://.css
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1789730468.000000006CA95000.00000002.00000001.01000000.00000017.sdmp, libcurl.dll.14.dr String found in binary or memory: http://.jpg
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 0000001A.00000002.2542506617.00000215E47A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.mf
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libdrive.dll.14.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: GuardEassosRestoreBoot,1.exe.14.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: libdrive.dll.14.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1719239028.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1719452091.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://en.w
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1715211508.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://en.wikipedia
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1748957291.0000000003418000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742404659.00000000051C1000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1750127063.0000000003418000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1749417346.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753919014.00000000057F3000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1764870232.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1750585922.0000000005778000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1751129561.000000000532A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1789730468.000000006CA95000.00000002.00000001.01000000.00000017.sdmp, libcurl.dll.14.dr String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 0000001A.00000002.2533794190.00000215DC78E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2468091631.00000215CC8C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2533794190.00000215DC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://ocsp.digicert.com0
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: 7zG.exe, 0000000B.00000003.1598075585.0000022352430000.00000004.00000800.00020000.00000000.sdmp, GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CE16D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CC8C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.pngp4(
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://purl.oclc.org/dsdl/schematron
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://relaxng.org/ns/structure/1.0Use
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CC5E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1771998747.0000000062498000.00000008.00000001.01000000.0000000A.sdmp String found in binary or memory: http://sourceware.org/pthreads-win32/DVarFileInfo$
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2468091631.00000215CDFE3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CE16D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CC8C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlp4(
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://www.ascc.net/xml/schematron
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://www.ascc.net/xml/schematronL
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741422053.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741207429.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723119947.0000000003892000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723119947.0000000003892000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTC
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723119947.0000000003892000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comTCU)
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comX
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723119947.0000000003892000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.combli
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comd
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722822164.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.comde0)
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: GuardEassosRestoreBoot,1.exe.14.dr, libdrive.dll.14.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732014333.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745113402.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744555798.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1740687994.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747114045.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753825189.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752741479.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742717841.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732215353.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1731519810.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746372002.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744078990.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752328813.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745924243.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1743093534.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746732597.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753427512.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742321757.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1730654645.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727033049.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726821756.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727704373.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727459329.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726419430.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726624557.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727211944.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752328813.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745113402.00000000038A6000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.00000000038A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers&
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1730654645.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.00000000038AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.00000000038AD000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742321757.00000000038AD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html8z
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1740687994.00000000038AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1730654645.00000000038A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/r
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732215353.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersDLr
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1731519810.00000000038A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersd
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726419430.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726624557.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.00000000038A3000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designerse
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1731519810.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1730654645.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com2
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745113402.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744555798.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747114045.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746372002.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745924243.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746732597.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747508403.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732873365.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732215353.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732686584.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732485898.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF.Ev
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732873365.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732686584.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1733031852.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732485898.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1733202327.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF8E
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745113402.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744555798.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747114045.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746372002.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745924243.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746732597.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747508403.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comalsd
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732014333.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732873365.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732215353.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732686584.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1733031852.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732485898.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1733202327.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comased
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732873365.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732686584.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732485898.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comcomo
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1750528655.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1751134931.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1749354729.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1749814332.0000000003896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comgrito
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comitu
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732014333.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732215353.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.como.jp/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1751997246.0000000003895000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753825189.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752741479.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1750528655.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1751134931.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752328813.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753427512.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1749354729.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1751702306.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1749814332.0000000003896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comoJER
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732873365.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732215353.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732686584.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1732485898.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comonyaoE7
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1740687994.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741207429.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comonyd
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753825189.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752741479.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1752328813.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1753427512.000000000389B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comrita
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741422053.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741207429.000000000388F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comsiefdE
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745113402.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744555798.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747114045.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746372002.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744078990.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745924243.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746732597.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747508403.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comtas
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718445979.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718356419.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718250150.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718578432.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718445979.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comn-u
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718578432.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1718657434.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.comnt
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742321757.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745113402.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744555798.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747114045.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742717841.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746372002.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1744078990.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745924243.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1743466216.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1743093534.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746732597.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742321757.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1747508403.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/oE7
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1741877450.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742321757.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmY=
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724384337.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724117095.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724384337.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/1Ei
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724117095.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724384337.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727033049.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726821756.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726419430.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726624557.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727211944.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/8E
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/CE
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724117095.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724384337.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723912386.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/JER
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724384337.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727033049.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726821756.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726419430.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726624557.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727211944.000000000389E000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724117095.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723912386.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724117095.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724384337.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/oE7
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725088113.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/vE.
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723912386.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724852939.00000000038A0000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1724648148.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723377149.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1723455455.00000000038A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/oE7
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/tant
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/vE.
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726298467.0000000003896000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725893463.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725385477.000000000389B000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1725731416.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726036225.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726171400.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/yE
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1794183255.0000000071005000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd-//OASIS//DTD
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1743093534.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1719452091.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1719558546.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.typography.net
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1719239028.0000000003897000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1719452091.0000000003897000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.typography.nethi
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726965342.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727618738.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deF
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726965342.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deO
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1726965342.0000000000FDA000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1727618738.0000000000FDC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.dea
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791049275.000000006CB3C000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799114042.0000000073D7C000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: http://www.winimage.com/zLibDll0123456789ABCDEFuuuuuuuubtnufruuuuuuuuuuuuuuuuuu
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1766296726.0000000004A82000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1722369894.0000000003892000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cnk
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1772485868.0000000062EA0000.00000008.00000001.01000000.0000000B.sdmp String found in binary or memory: http://www.zlib.net/DVarFileInfo$
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CC5E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001A.00000002.2533794190.00000215DC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001A.00000002.2533794190.00000215DC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001A.00000002.2533794190.00000215DC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1790291772.000000006CAE8000.00000008.00000001.01000000.00000017.sdmp, libcurl.dll.14.dr String found in binary or memory: https://curl.se/V
Source: libcurl.dll.14.dr String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1790291772.000000006CAE8000.00000008.00000001.01000000.00000017.sdmp, libcurl.dll.14.dr String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: libcurl.dll.14.dr String found in binary or memory: https://curl.se/docs/hsts.html
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1789730468.000000006CA95000.00000002.00000001.01000000.00000017.sdmp, libcurl.dll.14.dr String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CE16D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CC8C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pesterp4(
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CDA36000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CE1F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2533794190.00000215DC78E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2468091631.00000215CC8C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2533794190.00000215DC64E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000001A.00000002.2468091631.00000215CDFE3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://oneget.org
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1762660383.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742260027.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1745614609.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1748204827.00000000009F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.isoo.com
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1779078940.000000006C219000.00000008.00000001.01000000.0000001A.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1775111836.000000006BFBF000.00000008.00000001.01000000.00000019.sdmp String found in binary or memory: https://www.openssl.org/H
Yara detected Keylogger Generic
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1748957291.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750127063.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1742404659.00000000051C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1749417346.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1753919014.00000000057F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1764870232.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750585922.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1751129561.000000000532A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Coolmuster PDF Image Extractor.exe PID: 4680, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1748957291.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750127063.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1742404659.00000000051C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1749417346.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1753919014.00000000057F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1764870232.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750585922.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1751129561.000000000532A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Coolmuster PDF Image Extractor.exe PID: 4680, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
PE file has a writeable .text section
Source: ImageUtility.dll.14.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\5f925e.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{4A194FDC-5FC7-428C-83CA-BC4A750D530B} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI9665.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\5f9260.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\5f9260.msi Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\5f9260.msi Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_624868CC 15_2_624868CC
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6248D2D4 15_2_6248D2D4
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E81A7C 15_2_62E81A7C
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E83A1C 15_2_62E83A1C
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E8F7E0 15_2_62E8F7E0
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E81794 15_2_62E81794
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E87F24 15_2_62E87F24
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E934C4 15_2_62E934C4
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E8B0B0 15_2_62E8B0B0
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E86D4C 15_2_62E86D4C
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E89D51 15_2_62E89D51
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC5C7CB 15_2_6BC5C7CB
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC08FD0 15_2_6BC08FD0
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC2C3D0 15_2_6BC2C3D0
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC1C7F0 15_2_6BC1C7F0
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC5A78B 15_2_6BC5A78B
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC37BB0 15_2_6BC37BB0
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC09F50 15_2_6BC09F50
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC14750 15_2_6BC14750
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC34F50 15_2_6BC34F50
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC5E750 15_2_6BC5E750
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC06F70 15_2_6BC06F70
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC5BF70 15_2_6BC5BF70
One or more processes crash
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 1228
PE file contains executable resources (Code or Archives)
Source: Module.Helper.dll.14.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Module.View.dll.14.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file contains more sections than normal
Source: libpng14-14.dll.14.dr Static PE information: Number of sections : 18 > 10
Source: libcurl.dll.14.dr Static PE information: Number of sections : 11 > 10
Source: libssl-1_1.dll.14.dr Static PE information: Number of sections : 11 > 10
Source: libxml2-2.dll.14.dr Static PE information: Number of sections : 19 > 10
Source: pthreadGC2.dll.14.dr Static PE information: Number of sections : 21 > 10
Source: libgccfree.dll.14.dr Static PE information: Number of sections : 14 > 10
Source: zlib1.dll.14.dr Static PE information: Number of sections : 11 > 10
Source: libcrypto-1_1.dll.14.dr Static PE information: Number of sections : 11 > 10
PE file does not import any functions
Source: api-ms-win-core-libraryloader-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-2-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-louserzation-l1-2-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: API-MS-Win-core-xstate-l2-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.14.dr Static PE information: No import functions for PE file found
Yara signature match
Source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: classification engine Classification label: mal100.troj.evad.winZIP@15/115@0/0
Source: C:\Program Files\7-Zip\7zG.exe File created: C:\Users\user\Desktop\d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_762381681
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Mutant created: \Sessions\1\BaseNamedObjects\59035925
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Mutant created: \Sessions\1\BaseNamedObjects\Global_Coolmuster PDF Image Extractor_2.2.27
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\TEMP\~DF4373894EECD42FC3.TMP Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: Coolmuster PDF Image Extractor.exe String found in binary or memory: set-addPolicy
Source: Coolmuster PDF Image Extractor.exe String found in binary or memory: id-cmc-addExtensions
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi\" -spe -an -ai#7zMap15499:192:7zEvent20179
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi\d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe "C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe"
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 1228
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -ep bypass
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep bypass
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe" /all
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe "C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -ep bypass Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep bypass Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe" /all Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srclient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: spp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libbasic.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: pthreadgc2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: librg.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libi18n.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libglog.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: groceryc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: module.view.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libxml2-2.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libupdate.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: module.helper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libexpat.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libcurl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libdrive.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: quserex.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: unrar.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: imageutility.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: libjack.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Section loaded: wshunix.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: taskflowdataengine.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cdp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dsreg.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kdscli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\whoami.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\whoami.exe Section loaded: authz.dll Jump to behavior
Source: C:\Windows\System32\whoami.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\whoami.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\whoami.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: d7816ba6ddda0c4e833d9bba85864de6b1bd289246fcedae84b8a6581db3f5b6.msi.zip Static file information: File size 14664427 > 1048576
Source: Binary string: E:\Project\Software\Common\tags\102.libBasic-2.6\msw\2017\libBasic\Win32\Release\lib\libBasic.pdbBB%GCTL source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799114042.0000000073D7C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Release\Module.View.pdb>>#GCTL source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791496099.000000006CB77000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: E:\Project\Software\Common\tags\103.libUpdate-1.6\msw\2017\Release\libUpdate.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791049275.000000006CB3C000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: E:\software\Lib\common\glog-20161230\src\build\vsprojects\libglog\Release\libglog.pdb"" source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792741802.000000006CC0D000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: E:\Project\Software\Common\tags\104.libI18n-1.3\msw\2017\I18n\Release\libI18n.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1800329373.0000000074AC6000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Release\Module.View.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791496099.000000006CB77000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: E:\software\Lib\common\glog-20161230\src\build\vsprojects\libglog\Release\libglog.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792741802.000000006CC0D000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: ucrtbase.pdb source: ucrtbase.dll.14.dr
Source: Binary string: E:\Project\Software\Common\tags\17.register-1.1\msw-2017\Release\libRG.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799526500.0000000073DEB000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: E:\Project\Software\Common\tags\102.libBasic-2.6\msw\2017\libBasic\Win32\Release\lib\libBasic.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799114042.0000000073D7C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1799804567.00000000747F1000.00000020.00000001.01000000.0000000D.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1798016768.0000000073CE1000.00000020.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\ImageUtility.pdb2 source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1773080344.000000006BC5F000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Win32\Release\Bin\FileProcessManager.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000000.1709763138.0000000000214000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: E:\Project\Software\Common\tags\103.libUpdate-1.6\msw\2017\Release\libUpdate.pdb$$ source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1791049275.000000006CB3C000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\vccorlib140.i386.pdb source: vccorlib140.dll.14.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\vccorlib140.i386.pdbGCTL source: vccorlib140.dll.14.dr
Source: Binary string: D:\DGProject\bin\Win32\Release\GuardEassosRestoreBoot.pdb source: GuardEassosRestoreBoot,1.exe.14.dr
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Release\Module.Helper.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1788395528.000000006C9BC000.00000002.00000001.01000000.00000016.sdmp, Module.Helper.dll.14.dr
Source: Binary string: C:\PDR14_AutoBuild\LayerTemplate_9\Generic\Trunk\bin\Win32\Release\ImageUtility.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1773080344.000000006BC5F000.00000002.00000001.01000000.0000001D.sdmp
Source: Binary string: E:\Project\Software\Common\tags\104.libI18n-1.3\msw\2017\I18n\Release\libI18n.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1800329373.0000000074AC6000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\software\110.pdfimage-extractor-gui-2.2\projects\gui\Win32\Release\Bin\FileProcessManager.pdbJJ2 source: Coolmuster PDF Image Extractor.exe, 0000000F.00000000.1709763138.0000000000214000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: E:\Project\Software\Common\tags\85.groceryc-1.1\msw\2017\temp\link\groceryc\Release\groceryc.pdb source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792221350.000000006CBD6000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-xstate-l2-1-0.pdb source: API-MS-Win-core-xstate-l2-1-0.dll.14.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.14.dr
Source: Binary string: E:\Project\Software\Common\tags\85.groceryc-1.1\msw\2017\temp\link\groceryc\Release\groceryc.pdbEE"GCTL source: Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1792221350.000000006CBD6000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: api-ms-win-core-interlocked-l1-1-0.dll.14.dr
Source: Binary string: ucrtbase.pdbUGP source: ucrtbase.dll.14.dr
Binary contains a suspicious time stamp
Source: api-ms-win-crt-math-l1-1-0.dll.14.dr Static PE information: 0xBB0CD117 [Tue Jun 11 12:29:11 2069 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E8E0B0 _winmajor,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary, 15_2_62E8E0B0
PE file contains an invalid checksum
Source: libBasic.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x43159
Source: libI18n.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x8c9e
Source: libglog.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x31892
Source: groceryc.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x5d60f
Source: ImageUtility.dll.14.dr Static PE information: real checksum: 0x7a6e6 should be: 0x826e6
Source: libIPC.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x12eb2
Source: Module.Helper.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x1706a
Source: libRG.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x14e23
Source: libUpdate.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x12584
Source: Module.View.dll.14.dr Static PE information: real checksum: 0x0 should be: 0x433a1
Source: Unrar.dll.14.dr Static PE information: real checksum: 0x0 should be: 0xab3d7
PE file contains sections with non-standard names
Source: libpng14-14.dll.14.dr Static PE information: section name: /4
Source: libpng14-14.dll.14.dr Static PE information: section name: /14
Source: libpng14-14.dll.14.dr Static PE information: section name: /29
Source: libpng14-14.dll.14.dr Static PE information: section name: /41
Source: libpng14-14.dll.14.dr Static PE information: section name: /55
Source: libpng14-14.dll.14.dr Static PE information: section name: /67
Source: libpng14-14.dll.14.dr Static PE information: section name: /80
Source: libpng14-14.dll.14.dr Static PE information: section name: /91
Source: libpng14-14.dll.14.dr Static PE information: section name: /102
Source: zlib1.dll.14.dr Static PE information: section name: /4
Source: libgccfree.dll.14.dr Static PE information: section name: /4
Source: libgccfree.dll.14.dr Static PE information: section name: /14
Source: libgccfree.dll.14.dr Static PE information: section name: /29
Source: libgccfree.dll.14.dr Static PE information: section name: /41
Source: libgccfree.dll.14.dr Static PE information: section name: /55
Source: libcrypto-1_1.dll.14.dr Static PE information: section name: /4
Source: libcurl.dll.14.dr Static PE information: section name: .eh_fram
Source: libssl-1_1.dll.14.dr Static PE information: section name: /4
Source: libxml2-2.dll.14.dr Static PE information: section name: /4
Source: libxml2-2.dll.14.dr Static PE information: section name: /14
Source: libxml2-2.dll.14.dr Static PE information: section name: /29
Source: libxml2-2.dll.14.dr Static PE information: section name: /45
Source: libxml2-2.dll.14.dr Static PE information: section name: /57
Source: libxml2-2.dll.14.dr Static PE information: section name: /71
Source: libxml2-2.dll.14.dr Static PE information: section name: /83
Source: libxml2-2.dll.14.dr Static PE information: section name: /96
Source: libxml2-2.dll.14.dr Static PE information: section name: /107
Source: libxml2-2.dll.14.dr Static PE information: section name: /118
Source: ImageUtility.dll.14.dr Static PE information: section name: .data1
Source: ImageUtility.dll.14.dr Static PE information: section name: .trace
Source: ImageUtility.dll.14.dr Static PE information: section name: _RDATA
Source: pthreadGC2.dll.14.dr Static PE information: section name: /4
Source: pthreadGC2.dll.14.dr Static PE information: section name: /14
Source: pthreadGC2.dll.14.dr Static PE information: section name: /29
Source: pthreadGC2.dll.14.dr Static PE information: section name: /45
Source: pthreadGC2.dll.14.dr Static PE information: section name: /61
Source: pthreadGC2.dll.14.dr Static PE information: section name: /73
Source: pthreadGC2.dll.14.dr Static PE information: section name: /87
Source: pthreadGC2.dll.14.dr Static PE information: section name: /99
Source: pthreadGC2.dll.14.dr Static PE information: section name: /112
Source: pthreadGC2.dll.14.dr Static PE information: section name: /123
Source: pthreadGC2.dll.14.dr Static PE information: section name: /134
Source: msvcp140.dll.14.dr Static PE information: section name: .didat
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC90 push ebx; iretd 15_3_009AAC92
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009AAC31 push ebx; ret 15_3_009AAC32
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\vcruntime140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libexpat.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\DGBCDX64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libpng14-14.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\groceryc.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\vccorlib140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\OfflineReg.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libUpdate.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Module.Helper.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-console-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\pthreadGC2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Module.View.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Unrar.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\ucrtbase.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\concrt140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libglog.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libRG.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\ImageUtility.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libcrypto-1_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\API-MS-Win-core-xstate-l2-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libIPC.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\GuardEassosRestoreBoot,2.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-louserzation-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\zlib1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libdrive.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\GuardEassosRestoreBoot,1.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libI18n.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libssl-1_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libxml2-2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libcurl.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libBasic.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libgccfree.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\license_En.txt Jump to behavior

Boot Survival
barindex
Uses whoami command line tool to query computer and username
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe" /all
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe" /all Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains functionality to detect virtual machines (SLDT)
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_3_009FCF80 sldt word ptr [eax] 15_3_009FCF80
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1262 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8616 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 974 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8829 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\DGBCDX64.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libpng14-14.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-console-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\vccorlib140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\OfflineReg.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-console-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_codecvt_ids.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\concrt140.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-datetime-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\API-MS-Win-core-xstate-l2-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libIPC.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\GuardEassosRestoreBoot,2.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-louserzation-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\GuardEassosRestoreBoot,1.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-namedpipe-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_atomic_wait.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\libgccfree.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Network MPluginManager\msvcp140_2.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe API coverage: 2.9 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\msiexec.exe TID: 6812 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6172 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6168 Thread sleep count: 974 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108 Thread sleep count: 8829 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4300 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 26_2_00007FFEC7F02BD0 GetSystemInfo, 26_2_00007FFEC7F02BD0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746540298.0000000000999000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1711656176.0000000000995000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW{G~
Source: Coolmuster PDF Image Extractor.exe, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1714864839.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1711656176.0000000000995000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1746540298.00000000009A2000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1762660383.00000000009A2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1713159155.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1714864839.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1711656176.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1742260027.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000002.1762660383.00000000009F6000.00000004.00000020.00020000.00000000.sdmp, Coolmuster PDF Image Extractor.exe, 0000000F.00000003.1712121777.00000000009F6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Process queried: DebugPort Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC52782 IsDebuggerPresent, 15_2_6BC52782
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_62E8E0B0 _winmajor,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary, 15_2_62E8E0B0
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\whoami.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\whoami.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\whoami.exe Process token adjusted: Debug Jump to behavior
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe "C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC573DB SetUnhandledExceptionFilter,UnhandledExceptionFilter, 15_2_6BC573DB

HIPS / PFW / Operating System Protection Evasion
barindex
Bypasses PowerShell execution policy
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep bypass
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c powershell -ep bypass Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep bypass Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\whoami.exe "C:\Windows\system32\whoami.exe" /all Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userbrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userbrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userbrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userbriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userSTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userSTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\userSTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.3448.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Code function: 15_2_6BC56FA6 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 15_2_6BC56FA6
Source: C:\Users\user\AppData\Local\Programs\Network MPluginManager\Coolmuster PDF Image Extractor.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1748957291.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750127063.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1742404659.00000000051C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1749417346.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1753919014.00000000057F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1764870232.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750585922.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1751129561.000000000532A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Coolmuster PDF Image Extractor.exe PID: 4680, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Remcos RAT
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185bf.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.532aea2.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.34185ae.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.33a12b6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5779caa.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.52b2896.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.5239f2a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.Coolmuster PDF Image Extractor.exe.33a0686.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.3.Coolmuster PDF Image Extractor.exe.57f3ce2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000003.1745283637.00000000033A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1748957291.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750127063.0000000003418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1742404659.00000000051C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1749417346.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1753919014.00000000057F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.1764870232.00000000033A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1750585922.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000003.1751129561.000000000532A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Coolmuster PDF Image Extractor.exe PID: 4680, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1532102 Sample: d7816ba6ddda0c4e833d9bba858... Startdate: 12/10/2024 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for domain / URL 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 5 other signatures 2->46 8 msiexec.exe 157 117 2->8         started        11 powershell.exe 15 2->11         started        14 7zG.exe 2 2->14         started        16 2 other processes 2->16 process3 file4 32 C:\...\Coolmuster PDF Image Extractor.exe, PE32 8->32 dropped 34 C:\Users\user\AppData\Local\...\zlib1.dll, PE32 8->34 dropped 36 C:\Users\user\AppData\...\vcruntime140.dll, PE32 8->36 dropped 38 74 other files (none is malicious) 8->38 dropped 18 Coolmuster PDF Image Extractor.exe 17 8->18         started        50 Uses whoami command line tool to query computer and username 11->50 20 cmd.exe 1 11->20         started        23 conhost.exe 1 11->23         started        signatures5 process6 signatures7 25 WerFault.exe 4 18->25         started        48 Bypasses PowerShell execution policy 20->48 27 powershell.exe 9 20->27         started        process8 signatures9 52 Uses whoami command line tool to query computer and username 27->52 54 Loading BitLocker PowerShell Module 27->54 30 whoami.exe 1 27->30         started        process10
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
45.133.74.183 true unknown