Loading ...

Play interactive tourEdit tour

Windows Analysis Report 1ZDvfs8V0D

Overview

General Information

Sample Name:1ZDvfs8V0D (renamed file extension from none to dll)
Analysis ID:483801
MD5:291d328b80fa04b559d8bef5875125f1
SHA1:86664f646c9b2d93102046b34b20ec495f3a58da
SHA256:803674f9a33df4d1a18051592df46f57a5c735367773691ab2bfb17a21aa6eb6
Tags:Dridexexe
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes memory attributes in foreign processes to executable or writable
Machine Learning detection for sample
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Accesses ntoskrnl, likely to find offsets for exploits
Contains functionality to prevent local Windows debugging
Uses Atom Bombing / ProGate to inject into other processes
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Queries the installation date of Windows
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
Drops files with a non-matching file extension (content does not match file extension)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
PE file contains strange resources
Drops PE files
Binary contains a suspicious time stamp
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 1400 cmdline: loaddll64.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll' MD5: A84133CCB118CF35D49A423CD836D0EF)
    • cmd.exe (PID: 1232 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 2752 cmdline: rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1 MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 1380 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA MD5: 73C519F050C20580F8A62C849D49215A)
      • explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • msinfo32.exe (PID: 6444 cmdline: C:\Windows\system32\msinfo32.exe MD5: C471C6B06F47EA1C66E5FAA8DFCEF108)
        • msinfo32.exe (PID: 6468 cmdline: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe MD5: C471C6B06F47EA1C66E5FAA8DFCEF108)
        • mfpmp.exe (PID: 6516 cmdline: C:\Windows\system32\mfpmp.exe MD5: 7C3D09D6DB5DB4A272FCF4C1BB3986BD)
        • mfpmp.exe (PID: 6524 cmdline: C:\Users\user\AppData\Local\BxU\mfpmp.exe MD5: 7C3D09D6DB5DB4A272FCF4C1BB3986BD)
    • rundll32.exe (PID: 4576 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandle MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 5340 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExA MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 5240 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 3268 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeA MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 1748 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExA MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 1744 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6164 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6260 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6284 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileA MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6300 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6320 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileA MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6376 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6404 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameA MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6500 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameW MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 6620 cmdline: rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueA MD5: 73C519F050C20580F8A62C849D49215A)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000001D.00000002.335328318.0000000140001000.00000020.00020000.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
    00000003.00000002.338211546.0000000140001000.00000020.00020000.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
      00000007.00000002.252542553.0000000140001000.00000020.00020000.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
        00000021.00000002.352321962.0000000140001000.00000020.00020000.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
          00000018.00000002.306373888.0000000140001000.00000020.00020000.sdmpJoeSecurity_Dridex_2Yara detected Dridex unpacked fileJoe Security
            Click to see the 15 entries

            Sigma Overview

            No Sigma rule has matched

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Multi AV Scanner detection for submitted fileShow sources
            Source: 1ZDvfs8V0D.dllVirustotal: Detection: 66%Perma Link
            Source: 1ZDvfs8V0D.dllMetadefender: Detection: 65%Perma Link
            Source: 1ZDvfs8V0D.dllReversingLabs: Detection: 73%
            Antivirus / Scanner detection for submitted sampleShow sources
            Source: 1ZDvfs8V0D.dllAvira: detected
            Antivirus detection for dropped fileShow sources
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\AppData\Local\ibC\SPP.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\AppData\Local\BxU\MFPlat.DLLAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPLAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllAvira: detection malicious, Label: TR/Crypt.ZPACK.Gen
            Source: C:\Users\user\AppData\Local\5zVf35m1I\SLC.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\EkXB809\dpx.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPLAvira: detection malicious, Label: HEUR/AGEN.1114452
            Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dllAvira: detection malicious, Label: HEUR/AGEN.1114452
            Machine Learning detection for sampleShow sources
            Source: 1ZDvfs8V0D.dllJoe Sandbox ML: detected
            Machine Learning detection for dropped fileShow sources
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\ibC\SPP.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\BxU\MFPlat.DLLJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPLJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\5zVf35m1I\SLC.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\EkXB809\dpx.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dllJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPLJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dllJoe Sandbox ML: detected

            Exploits:

            barindex
            Accesses ntoskrnl, likely to find offsets for exploitsShow sources
            Source: C:\Windows\explorer.exeFile opened: C:\Windows\system32\ntkrnlmp.exeJump to behavior
            Source: 1ZDvfs8V0D.dllStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
            Source: Binary string: wextract.pdb source: wextract.exe.5.dr
            Source: Binary string: wextract.pdbGCTL source: wextract.exe.5.dr
            Source: Binary string: MFPMP.pdb source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
            Source: Binary string: osk.pdbGCTL source: osk.exe.5.dr
            Source: Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe.5.dr
            Source: Binary string: unregmp2.pdb source: unregmp2.exe.5.dr
            Source: Binary string: osk.pdb source: osk.exe.5.dr
            Source: Binary string: SysResetErr.pdb source: SysResetErr.exe.5.dr
            Source: Binary string: MFPMP.pdbUGP source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
            Source: Binary string: systemreset.pdb source: systemreset.exe.5.dr
            Source: Binary string: SystemPropertiesProtection.pdb source: SystemPropertiesProtection.exe.5.dr
            Source: Binary string: SystemPropertiesProtection.pdbGCTL source: SystemPropertiesProtection.exe.5.dr
            Source: Binary string: AgentService.pdbGCTL source: AgentService.exe.5.dr
            Source: Binary string: SystemSettingsRemoveDevice.pdbGCTL source: SystemSettingsRemoveDevice.exe.5.dr
            Source: Binary string: unregmp2.pdbGCTL source: unregmp2.exe.5.dr
            Source: Binary string: rstrui.pdbGCTL source: rstrui.exe.5.dr
            Source: Binary string: AgentService.pdb source: AgentService.exe.5.dr
            Source: Binary string: rstrui.pdb source: rstrui.exe.5.dr
            Source: Binary string: SystemSettingsRemoveDevice.pdb source: SystemSettingsRemoveDevice.exe.5.dr
            Source: Binary string: irftp.pdb source: irftp.exe.5.dr
            Source: Binary string: lpksetup.pdbGCTL source: lpksetup.exe.5.dr
            Source: Binary string: SndVol.pdbGCTL source: SndVol.exe.5.dr
            Source: Binary string: msinfo32.pdb source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
            Source: Binary string: SystemPropertiesPerformance.pdb source: SystemPropertiesPerformance.exe.5.dr
            Source: Binary string: irftp.pdbGCTL source: irftp.exe.5.dr
            Source: Binary string: SystemPropertiesPerformance.pdbGCTL source: SystemPropertiesPerformance.exe.5.dr
            Source: Binary string: PresentationHost.pdb source: PresentationHost.exe.5.dr
            Source: Binary string: systemreset.pdbGCTL source: systemreset.exe.5.dr
            Source: Binary string: lpksetup.pdb source: lpksetup.exe.5.dr
            Source: Binary string: msinfo32.pdbGCTL source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
            Source: Binary string: SndVol.pdb source: SndVol.exe.5.dr
            Source: Binary string: SysResetErr.pdbGCTL source: SysResetErr.exe.5.dr
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014005D290 FindFirstFileExW,1_2_000000014005D290
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E6334 #620,#624,#6050,#1040,#1040,#4436,#1122,#1040,#624,#1259,#1040,#626,FindFirstFileW,#624,#1259,#1262,#1122,#1040,#1040,#1040,_wcsicmp,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,#624,#1259,#1040,FindFirstFileW,#622,#624,#624,#1259,#1259,#1040,#1040,#1040,#1040,#1040,FindNextFileW,FindClose,RemoveDirectoryW,#1040,#1040,#1040,#1040,32_2_00007FF72A9E6334
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E72AC #624,FindFirstFileW,FindClose,#6050,_wcsicmp,#1040,#1463,_wcsicmp,#624,CreateFileW,GetFileSize,ReadFile,CloseHandle,#1040,CreateFileW,#6886,CloseHandle,#6886,_wcsicmp,#626,#624,#1040,#624,#1122,SetupIterateCabinetW,#1040,#626,#626,RegOpenKeyExW,RegGetValueW,#1126,RegCloseKey,#1040,#1040,#1040,RegOpenKeyExW,#624,#2975,RegSetValueExW,#1122,RegCloseKey,#1040,RegCloseKey,#620,#620,#628,#1042,#1040,#1040,#622,#1259,#1122,#1040,#1040,#1284,#2783,#1040,#1040,#1040,#1042,#1040,#1040,#1040,#1040,#1040,#1040,GetLastError,#626,#626,#4473,#4473,#1287,#1287,MessageBoxW,#1040,#1040,#1040,32_2_00007FF72A9E72AC
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E5DE8 #626,#626,#1122,#624,#6050,#1040,#1040,#624,#1284,#1040,#1259,#1122,#1040,FindFirstFileW,#624,#1259,#1358,#1040,#1040,FindNextFileW,FindClose,#624,#1259,#1122,#1040,#1040,FindFirstFileW,#624,#1259,#1040,#1040,FindNextFileW,FindClose,#1040,#1040,32_2_00007FF72A9E5DE8
            Source: explorer.exe, 00000005.00000000.268789709.0000000006840000.00000004.00000001.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E7D98 LoadCursorW,SetCursor,SetCursor,IsDlgButtonChecked,IsDlgButtonChecked,CheckDlgButton,GetDlgItem,GetWindowTextW,#1126,SendMessageW,PostMessageW,SendMessageW,SendMessageW,LoadIconW,LoadStringW,ShellAboutW,DestroyIcon,GetFocus,IsWindowEnabled,IsWindowEnabled,GetFocus,IsWindowVisible,IsWindowEnabled,OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,#624,#2781,#5979,SendMessageW,GlobalUnlock,#1040,CloseClipboard,SendMessageW,32_2_00007FF72A9E7D98
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9EA9C4 GetFocus,IsWindowVisible,IsWindowEnabled,SendMessageW,#626,#1126,SendMessageW,SendMessageW,#1287,#1284,#1287,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,#1040,32_2_00007FF72A9EA9C4

            E-Banking Fraud:

            barindex
            Yara detected Dridex unpacked fileShow sources
            Source: Yara matchFile source: 0000001D.00000002.335328318.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.338211546.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.252542553.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000021.00000002.352321962.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000018.00000002.306373888.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001A.00000002.320976906.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.372333488.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000020.00000002.347477608.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.260356621.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000A.00000002.268405369.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000023.00000002.356448688.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000016.00000002.298943238.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000D.00000002.283715415.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000011.00000002.292039618.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.279441131.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.246135848.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000024.00000002.361689565.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001E.00000002.395045781.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000019.00000002.314059179.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000001B.00000002.327625102.0000000140001000.00000020.00020000.sdmp, type: MEMORY
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400348701_2_0000000140034870
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400352701_2_0000000140035270
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140048AC01_2_0000000140048AC0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014005C3401_2_000000014005C340
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140065B801_2_0000000140065B80
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006A4B01_2_000000014006A4B0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400524B01_2_00000001400524B0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140026CC01_2_0000000140026CC0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014004BD401_2_000000014004BD40
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400495B01_2_00000001400495B0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140036F301_2_0000000140036F30
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400690101_2_0000000140069010
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400010101_2_0000000140001010
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400660201_2_0000000140066020
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002F8401_2_000000014002F840
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014005D8501_2_000000014005D850
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400640801_2_0000000140064080
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400108801_2_0000000140010880
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400688A01_2_00000001400688A0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002D0D01_2_000000014002D0D0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400018D01_2_00000001400018D0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400161001_2_0000000140016100
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014001D1001_2_000000014001D100
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002A1101_2_000000014002A110
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014001D9101_2_000000014001D910
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400151201_2_0000000140015120
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014000B1201_2_000000014000B120
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014004F9401_2_000000014004F940
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400391401_2_0000000140039140
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400231401_2_0000000140023140
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400579501_2_0000000140057950
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014001E1701_2_000000014001E170
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400029801_2_0000000140002980
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400611A01_2_00000001400611A0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400389A01_2_00000001400389A0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400381A01_2_00000001400381A0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002E1B01_2_000000014002E1B0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400139D01_2_00000001400139D0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400319F01_2_00000001400319F0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002EA001_2_000000014002EA00
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140022A001_2_0000000140022A00
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014003B2201_2_000000014003B220
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140067A401_2_0000000140067A40
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140069A501_2_0000000140069A50
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140007A601_2_0000000140007A60
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014003AAC01_2_000000014003AAC0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014003A2E01_2_000000014003A2E0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140062B001_2_0000000140062B00
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400183001_2_0000000140018300
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002FB201_2_000000014002FB20
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400313401_2_0000000140031340
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400223401_2_0000000140022340
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140017B401_2_0000000140017B40
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014000BB401_2_000000014000BB40
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014004EB601_2_000000014004EB60
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400053701_2_0000000140005370
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014002CB801_2_000000014002CB80
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B3901_2_000000014006B390
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140054BA01_2_0000000140054BA0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140033BB01_2_0000000140033BB0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400263C01_2_00000001400263C0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400123C01_2_00000001400123C0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140063BD01_2_0000000140063BD0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400663F01_2_00000001400663F0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140023BF01_2_0000000140023BF0
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B41B1_2_000000014006B41B
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B4241_2_000000014006B424
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B42D1_2_000000014006B42D
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B4361_2_000000014006B436
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B43D1_2_000000014006B43D
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_00000001400244401_2_0000000140024440
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140005C401_2_0000000140005C40
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006B4461_2_000000014006B446
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9D937032_2_00007FF72A9D9370
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9EBD0032_2_00007FF72A9EBD00
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E221032_2_00007FF72A9E2210
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9EB18432_2_00007FF72A9EB184
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E72AC32_2_00007FF72A9E72AC
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9DC31432_2_00007FF72A9DC314
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E0F9832_2_00007FF72A9E0F98
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9EB7AC32_2_00007FF72A9EB7AC
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9DB0E032_2_00007FF72A9DB0E0
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E08D832_2_00007FF72A9E08D8
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E7D9832_2_00007FF72A9E7D98
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E8F0432_2_00007FF72A9E8F04
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E66F832_2_00007FF72A9E66F8
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9D9E9032_2_00007FF72A9D9E90
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9EA67032_2_00007FF72A9EA670
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: String function: 00007FF72A9D89B8 appears 46 times
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140046C90 NtClose,1_2_0000000140046C90
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_000000014006A4B0 NtQuerySystemInformation,1_2_000000014006A4B0
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9E07E8 #626,#626,#4473,#4473,NtQuerySystemInformation,#4473,#1040,#1040,32_2_00007FF72A9E07E8
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: 1ZDvfs8V0D.dllBinary or memory string: OriginalFilenamekbdyj% vs 1ZDvfs8V0D.dll
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: msinfo32.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SystemPropertiesProtection.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SystemPropertiesProtection.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SystemPropertiesProtection.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: lpksetup.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: lpksetup.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: lpksetup.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: rstrui.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: rstrui.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: rstrui.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: wextract.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: wextract.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: wextract.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: irftp.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: PresentationHost.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SystemPropertiesPerformance.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SystemPropertiesPerformance.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SystemPropertiesPerformance.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: SndVol.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: osk.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: osk.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: osk.exe.5.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: 1ZDvfs8V0D.dllStatic PE information: Number of sections : 43 > 10
            Source: DUI70.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: VERSION.dll1.5.drStatic PE information: Number of sections : 44 > 10
            Source: SYSDM.CPL.5.drStatic PE information: Number of sections : 44 > 10
            Source: SLC.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: VERSION.dll3.5.drStatic PE information: Number of sections : 44 > 10
            Source: VERSION.dll0.5.drStatic PE information: Number of sections : 44 > 10
            Source: dwmapi.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: dpx.dll.5.drStatic PE information: Number of sections : 43 > 10
            Source: DUI70.dll0.5.drStatic PE information: Number of sections : 44 > 10
            Source: VERSION.dll2.5.drStatic PE information: Number of sections : 44 > 10
            Source: SYSDM.CPL0.5.drStatic PE information: Number of sections : 44 > 10
            Source: WTSAPI32.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: MFPlat.DLL.5.drStatic PE information: Number of sections : 44 > 10
            Source: WMsgAPI.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: VERSION.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: SPP.dll.5.drStatic PE information: Number of sections : 44 > 10
            Source: 1ZDvfs8V0D.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: SLC.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: MFPlat.DLL.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: SYSDM.CPL.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: VERSION.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: VERSION.dll0.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: dpx.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: SPP.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: VERSION.dll1.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: DUI70.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: WTSAPI32.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: VERSION.dll2.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: SYSDM.CPL0.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: dwmapi.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: WMsgAPI.dll.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: DUI70.dll0.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: VERSION.dll3.5.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: 1ZDvfs8V0D.dllVirustotal: Detection: 66%
            Source: 1ZDvfs8V0D.dllMetadefender: Detection: 65%
            Source: 1ZDvfs8V0D.dllReversingLabs: Detection: 73%
            Source: 1ZDvfs8V0D.dllStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll'
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandle
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExA
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExW
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeA
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExA
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExW
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeW
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoW
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileA
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileW
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileA
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileW
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameA
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe
            Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameW
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exe
            Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\BxU\mfpmp.exe C:\Users\user\AppData\Local\BxU\mfpmp.exe
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueA
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\SystemPropertiesProtection.exe C:\Windows\system32\SystemPropertiesProtection.exe
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1Jump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoByHandleJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoExWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeExWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoSizeWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerFindFileWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerInstallFileWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerLanguageNameWJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,VerQueryValueAJump to behavior
            Source: C:\Windows\System32\loaddll64.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1ZDvfs8V0D.dll',#1Jump to behavior
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exeJump to behavior
            Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exe C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeJump to behavior
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\mfpmp.exe C:\Windows\system32\mfpmp.exeJump to behavior
            Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\BxU\mfpmp.exe C:\Users\user\AppData\Local\BxU\mfpmp.exeJump to behavior
            Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\SystemPropertiesProtection.exe C:\Windows\system32\SystemPropertiesProtection.exeJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9aJump to behavior
            Source: irftp.exe.5.drBinary string: \Device\IrDAIrDA:TinyTP:LsapSelOBEX:IrXferOBEXControl Panel\InfraredControl Panel\Infrared\GlobalControl Panel\Infrared\IrTranPAllowSendShowTrayIconPlaySoundRecvdFilesLocationDisableIrTranPv1DisableIrCOMMExploreOnCompletionSaveAsUPFireventsIrMon: ReadUserPreferences::Failed to init sockets
            Source: classification engineClassification label: mal100.troj.expl.evad.winDLL@75/33@0/0
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9D7C40 #1126,#1126,#4436,#1040,#6050,#1122,#1040,#2783,DnsHostnameToComputerNameW,#1126,free,#1122,#1126,#1126,CoCreateInstance,#626,#2846,#1606,SysFreeString,#1040,32_2_00007FF72A9D7C40
            Source: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeCode function: 32_2_00007FF72A9EFC05 GetLastError,FormatMessageW,#626,#1463,#4473,MessageBoxW,LocalFree,#1040,32_2_00007FF72A9EFC05
            Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\1ZDvfs8V0D.dll,GetFileVersionInfoA
            Source: C:\Windows\System32\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\{5709daf4-0c2d-3394-6fc5-945ed839e8f5}
            Source: C:\Windows\System32\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\{2dd23468-466f-1085-93c4-c8365b5e01d7}
            Source: 1ZDvfs8V0D.dllStatic PE information: Image base 0x140000000 > 0x60000000
            Source: 1ZDvfs8V0D.dllStatic file information: File size 2109440 > 1048576
            Source: 1ZDvfs8V0D.dllStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
            Source: Binary string: wextract.pdb source: wextract.exe.5.dr
            Source: Binary string: wextract.pdbGCTL source: wextract.exe.5.dr
            Source: Binary string: MFPMP.pdb source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
            Source: Binary string: osk.pdbGCTL source: osk.exe.5.dr
            Source: Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe.5.dr
            Source: Binary string: unregmp2.pdb source: unregmp2.exe.5.dr
            Source: Binary string: osk.pdb source: osk.exe.5.dr
            Source: Binary string: SysResetErr.pdb source: SysResetErr.exe.5.dr
            Source: Binary string: MFPMP.pdbUGP source: mfpmp.exe, 00000023.00000002.357950587.00007FF7B6DB7000.00000002.00020000.sdmp, mfpmp.exe.5.dr
            Source: Binary string: systemreset.pdb source: systemreset.exe.5.dr
            Source: Binary string: SystemPropertiesProtection.pdb source: SystemPropertiesProtection.exe.5.dr
            Source: Binary string: SystemPropertiesProtection.pdbGCTL source: SystemPropertiesProtection.exe.5.dr
            Source: Binary string: AgentService.pdbGCTL source: AgentService.exe.5.dr
            Source: Binary string: SystemSettingsRemoveDevice.pdbGCTL source: SystemSettingsRemoveDevice.exe.5.dr
            Source: Binary string: unregmp2.pdbGCTL source: unregmp2.exe.5.dr
            Source: Binary string: rstrui.pdbGCTL source: rstrui.exe.5.dr
            Source: Binary string: AgentService.pdb source: AgentService.exe.5.dr
            Source: Binary string: rstrui.pdb source: rstrui.exe.5.dr
            Source: Binary string: SystemSettingsRemoveDevice.pdb source: SystemSettingsRemoveDevice.exe.5.dr
            Source: Binary string: irftp.pdb source: irftp.exe.5.dr
            Source: Binary string: lpksetup.pdbGCTL source: lpksetup.exe.5.dr
            Source: Binary string: SndVol.pdbGCTL source: SndVol.exe.5.dr
            Source: Binary string: msinfo32.pdb source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
            Source: Binary string: SystemPropertiesPerformance.pdb source: SystemPropertiesPerformance.exe.5.dr
            Source: Binary string: irftp.pdbGCTL source: irftp.exe.5.dr
            Source: Binary string: SystemPropertiesPerformance.pdbGCTL source: SystemPropertiesPerformance.exe.5.dr
            Source: Binary string: PresentationHost.pdb source: PresentationHost.exe.5.dr
            Source: Binary string: systemreset.pdbGCTL source: systemreset.exe.5.dr
            Source: Binary string: lpksetup.pdb source: lpksetup.exe.5.dr
            Source: Binary string: msinfo32.pdbGCTL source: msinfo32.exe, 00000020.00000000.345704873.00007FF72A9F1000.00000002.00020000.sdmp, msinfo32.exe.5.dr
            Source: Binary string: SndVol.pdb source: SndVol.exe.5.dr
            Source: Binary string: SysResetErr.pdbGCTL source: SysResetErr.exe.5.dr
            Source: C:\Windows\System32\loaddll64.exeCode function: 1_2_0000000140056A4D push rdi; ret 1_2_0000000140056A4E
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .qkm
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .cvjb
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .tlmkv
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .wucsxe
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .fltwtj
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .sfplio
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .rpg
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .bewzc
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .vksvaw
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .wmhg
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .kswemc
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .kaxfk
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .pjf
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .favk
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .vhtukj
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .hmbyox
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .txms
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .vqqm
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .cbwb
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .sggk
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .cbotn
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .urf
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .yera
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .sjj
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .wcro
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .imkkq
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .mrdc
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .eaph
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .wqzg
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .uwxw
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .acz
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .ktb
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .nqplrs
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .btah
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .majbu
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .zefvk
            Source: 1ZDvfs8V0D.dllStatic PE information: section name: .qlndvj
            Source: mfpmp.exe.5.drStatic PE information: section name: .didat
            Source: systemreset.exe.5.drStatic PE information: section name: .imrsiv
            Source: SysResetErr.exe.5.drStatic PE information: section name: .imrsiv
            Source: SndVol.exe.5.drStatic PE information: section name: .imrsiv
            Source: SndVol.exe.5.drStatic PE information: section name: .didat
            Source: SystemSettingsRemoveDevice.exe.5.drStatic PE information: section name: .imrsiv
            Source: SLC.dll.5.drStatic PE information: section name: .qkm
            Source: SLC.dll.5.drStatic PE information: section name: .cvjb
            Source: SLC.dll.5.drStatic PE information: section name: .tlmkv
            Source: SLC.dll.5.drStatic PE information: section name: .wucsxe
            Source: SLC.dll.5.drStatic PE information: section name: .fltwtj
            Source: SLC.dll.5.drStatic PE information: section name: .sfplio
            Source: SLC.dll.5.drStatic PE information: section name: .rpg
            Source: SLC.dll.5.drStatic PE information: section name: .bewzc
            Source: SLC.dll.5.drStatic PE information: section name: .vksvaw
            Source: SLC.dll.5.drStatic PE information: section name: .wmhg
            Source: SLC.dll.5.drStatic PE information: section name: .kswemc
            Source: SLC.dll.5.drStatic PE information: section name: .kaxfk
            Source: SLC.dll.5.drStatic PE information: section name: .pjf
            Source: SLC.dll.5.drStatic PE information: section name: .favk
            Source: SLC.dll.5.drStatic PE information: section name: .vhtukj
            Source: SLC.dll.5.drStatic PE information: section name: .hmbyox
            Source: SLC.dll.5.drStatic PE information: section name: .txms
            Source: SLC.dll.5.drStatic PE information: section name: .vqqm
            Source: SLC.dll.5.drStatic PE information: section name: .cbwb
            Source: SLC.dll.5.drStatic PE information: section name: .sggk
            Source: SLC.dll.5.drStatic PE information: section name: .cbotn
            Source: SLC.dll.5.drStatic PE information: section name: .urf
            Source: SLC.dll.5.drStatic PE information: section name: .yera
            Source: SLC.dll.5.drStatic PE information: section name: .sjj
            Source: SLC.dll.5.drStatic PE information: section name: .wcro
            Source: SLC.dll.5.drStatic PE information: section name: .imkkq
            Source: SLC.dll.5.drStatic PE information: section name: .mrdc
            Source: SLC.dll.5.drStatic PE information: section name: .eaph
            Source: SLC.dll.5.drStatic PE information: section name: .wqzg
            Source: SLC.dll.5.drStatic PE information: section name: .uwxw
            Source: SLC.dll.5.drStatic PE information: section name: .acz
            Source: SLC.dll.5.drStatic PE information: section name: .ktb
            Source: SLC.dll.5.drStatic PE information: section name: .nqplrs
            Source: SLC.dll.5.drStatic PE information: section name: .btah
            Source: SLC.dll.5.drStatic PE information: section name: .majbu
            Source: SLC.dll.5.drStatic PE information: section name: .zefvk
            Source: SLC.dll.5.drStatic PE information: section name: .qlndvj
            Source: SLC.dll.5.drStatic PE information: section name: .csqxkt
            Source: MFPlat.DLL.5.drStatic PE information: section name: .qkm
            Source: MFPlat.DLL.5.drStatic PE information: section name: .cvjb
            Source: MFPlat.DLL.5.drStatic PE information: section name: .tlmkv
            Source: MFPlat.DLL.5.drStatic PE information: section name: .wucsxe
            Source: MFPlat.DLL.5.drStatic PE information: section name: .fltwtj
            Source: MFPlat.DLL.5.drStatic PE information: section name: .sfplio
            Source: MFPlat.DLL.5.drStatic PE information: section name: .rpg
            Source: MFPlat.DLL.5.drStatic PE information: section name: .bewzc
            Source: MFPlat.DLL.5.drStatic PE information: section name: .vksvaw
            Source: MFPlat.DLL.5.drStatic PE information: section name: .wmhg
            Source: MFPlat.DLL.5.drStatic PE information: section name: .kswemc
            Source: MFPlat.DLL.5.drStatic PE information: section name: .kaxfk
            Source: MFPlat.DLL.5.drStatic PE information: section name: .pjf
            Source: MFPlat.DLL.5.drStatic PE information: section name: .favk
            Source: MFPlat.DLL.5.drStatic PE information: section name: .vhtukj
            Source: MFPlat.DLL.5.drStatic PE information: section name: .hmbyox
            Source: MFPlat.DLL.5.drStatic PE information: section name: .txms
            Source: MFPlat.DLL.5.drStatic PE information: section name: .vqqm
            Source: MFPlat.DLL.5.drStatic PE information: section name: .cbwb
            Source: MFPlat.DLL.5.drStatic PE information: section name: .sggk
            Source: MFPlat.DLL.5.drStatic PE information: section name: .cbotn
            Source: MFPlat.DLL.5.drStatic PE information: section name: .urf
            Source: MFPlat.DLL.5.drStatic PE information: section name: .yera
            Source: MFPlat.DLL.5.drStatic PE information: section name: .sjj
            Source: MFPlat.DLL.5.drStatic PE information: section name: .wcro
            Source: MFPlat.DLL.5.drStatic PE information: section name: .imkkq
            Source: MFPlat.DLL.5.drStatic PE information: section name: .mrdc
            Source: MFPlat.DLL.5.drStatic PE information: section name: .eaph
            Source: MFPlat.DLL.5.drStatic PE information: section name: .wqzg
            Source: MFPlat.DLL.5.drStatic PE information: section name: .uwxw
            Source: MFPlat.DLL.5.drStatic PE information: section name: .acz
            Source: MFPlat.DLL.5.drStatic PE information: section name: .ktb
            Source: MFPlat.DLL.5.drStatic PE information: section name: .nqplrs
            Source: MFPlat.DLL.5.drStatic PE information: section name: .btah
            Source: MFPlat.DLL.5.drStatic PE information: section name: .majbu
            Source: MFPlat.DLL.5.drStatic PE information: section name: .zefvk
            Source: MFPlat.DLL.5.drStatic PE information: section name: .qlndvj
            Source: MFPlat.DLL.5.drStatic PE information: section name: .tpynl
            Source: SYSDM.CPL.5.drStatic PE information: section name: .qkm
            Source: SYSDM.CPL.5.drStatic PE information: section name: .cvjb
            Source: SYSDM.CPL.5.drStatic PE information: section name: .tlmkv
            Source: SYSDM.CPL.5.drStatic PE information: section name: .wucsxe
            Source: SYSDM.CPL.5.drStatic PE information: section name: .fltwtj
            Source: SYSDM.CPL.5.drStatic PE information: section name: .sfplio
            Source: SYSDM.CPL.5.drStatic PE information: section name: .rpg
            Source: SYSDM.CPL.5.drStatic PE information: section name: .bewzc
            Source: SYSDM.CPL.5.drStatic PE information: section name: .vksvaw
            Source: SYSDM.CPL.5.drStatic PE information: section name: .wmhg
            Source: SYSDM.CPL.5.drStatic PE information: section name: .kswemc
            Source: SYSDM.CPL.5.drStatic PE information: section name: .kaxfk
            Source: SYSDM.CPL.5.drStatic PE information: section name: .pjf
            Source: SYSDM.CPL.5.drStatic PE information: section name: .favk
            Source: SYSDM.CPL.5.drStatic PE information: section name: .vhtukj
            Source: SYSDM.CPL.5.drStatic PE information: section name: .hmbyox
            Source: SYSDM.CPL.5.drStatic PE information: section name: .txms
            Source: SYSDM.CPL.5.drStatic PE information: section name: .vqqm
            Source: SYSDM.CPL.5.drStatic PE information: section name: .cbwb
            Source: SYSDM.CPL.5.drStatic PE information: section name: .sggk
            Source: SYSDM.CPL.5.drStatic PE information: section name: .cbotn
            Source: SYSDM.CPL.5.drStatic PE information: section name: .urf
            Source: SYSDM.CPL.5.drStatic PE information: section name: .yera
            Source: SYSDM.CPL.5.drStatic PE information: section name: .sjj
            Source: SYSDM.CPL.5.drStatic PE information: section name: .wcro
            Source: SYSDM.CPL.5.drStatic PE information: section name: .imkkq
            Source: SYSDM.CPL.5.drStatic PE information: section name: .mrdc
            Source: SYSDM.CPL.5.drStatic PE information: section name: .eaph
            Source: SYSDM.CPL.5.drStatic PE information: section name: .wqzg
            Source: SYSDM.CPL.5.drStatic PE information: section name: .uwxw
            Source: SYSDM.CPL.5.drStatic PE information: section name: .acz
            Source: SYSDM.CPL.5.drStatic PE information: section name: .ktb
            Source: SYSDM.CPL.5.drStatic PE information: section name: .nqplrs
            Source: SYSDM.CPL.5.drStatic PE information: section name: .btah
            Source: SYSDM.CPL.5.drStatic PE information: section name: .majbu
            Source: SYSDM.CPL.5.drStatic PE information: section name: .zefvk
            Source: SYSDM.CPL.5.drStatic PE information: section name: .qlndvj
            Source: SYSDM.CPL.5.drStatic PE information: section name: .lzeq
            Source: VERSION.dll.5.drStatic PE information: section name: .qkm
            Source: VERSION.dll.5.drStatic PE information: section name: .cvjb
            Source: VERSION.dll.5.drStatic PE information: section name: .tlmkv
            Source: VERSION.dll.5.drStatic PE information: section name: .wucsxe
            Source: VERSION.dll.5.drStatic PE information: section name: .fltwtj
            Source: VERSION.dll.5.drStatic PE information: section name: .sfplio
            Source: VERSION.dll.5.drStatic PE information: section name: .rpg
            Source: VERSION.dll.5.drStatic PE information: section name: .bewzc
            Source: VERSION.dll.5.drStatic PE information: section name: .vksvaw
            Source: VERSION.dll.5.drStatic PE information: section name: .wmhg
            Source: VERSION.dll.5.drStatic PE information: section name: .kswemc
            Source: VERSION.dll.5.drStatic PE information: section name: .kaxfk
            Source: VERSION.dll.5.drStatic PE information: section name: .pjf
            Source: VERSION.dll.5.drStatic PE information: section name: .favk
            Source: VERSION.dll.5.drStatic PE information: section name: .vhtukj
            Source: VERSION.dll.5.drStatic PE information: section name: .hmbyox
            Source: VERSION.dll.5.drStatic PE information: section name: .txms
            Source: VERSION.dll.5.drStatic PE information: section name: .vqqm
            Source: VERSION.dll.5.drStatic PE information: section name: .cbwb
            Source: VERSION.dll.5.drStatic PE information: section name: .sggk
            Source: VERSION.dll.5.drStatic PE information: section name: .cbotn
            Source: VERSION.dll.5.drStatic PE information: section name: .urf
            Source: VERSION.dll.5.drStatic PE information: section name: .yera
            Source: VERSION.dll.5.drStatic PE information: section name: .sjj
            Source: VERSION.dll.5.drStatic PE information: section name: .wcro
            Source: VERSION.dll.5.drStatic PE information: section name: .imkkq
            Source: VERSION.dll.5.drStatic PE information: section name: .mrdc
            Source: VERSION.dll.5.drStatic PE information: section name: .eaph
            Source: VERSION.dll.5.drStatic PE information: section name: .wqzg
            Source: VERSION.dll.5.drStatic PE information: section name: .uwxw
            Source: VERSION.dll.5.drStatic PE information: section name: .acz
            Source: VERSION.dll.5.drStatic PE information: section name: .ktb
            Source: VERSION.dll.5.drStatic PE information: section name: .nqplrs
            Source: VERSION.dll.5.drStatic PE information: section name: .btah
            Source: VERSION.dll.5.drStatic PE information: section name: .majbu
            Source: VERSION.dll.5.drStatic PE information: section name: .zefvk
            Source: VERSION.dll.5.drStatic PE information: section name: .qlndvj
            Source: VERSION.dll.5.drStatic PE information: section name: .mvfgc
            Source: VERSION.dll0.5.drStatic PE information: section name: .qkm
            Source: VERSION.dll0.5.drStatic PE information: section name: .cvjb
            Source: VERSION.dll0.5.drStatic PE information: section name: .tlmkv
            Source: VERSION.dll0.5.drStatic PE information: section name: .wucsxe
            Source: VERSION.dll0.5.drStatic PE information: section name: .fltwtj
            Source: VERSION.dll0.5.drStatic PE information: section name: .sfplio
            Source: VERSION.dll0.5.drStatic PE information: section name: .rpg
            Source: VERSION.dll0.5.drStatic PE information: section name: .bewzc
            Source: VERSION.dll0.5.drStatic PE information: section name: .vksvaw
            Source: VERSION.dll0.5.drStatic PE information: section name: .wmhg
            Source: VERSION.dll0.5.drStatic PE information: section name: .kswemc
            Source: VERSION.dll0.5.drStatic PE information: section name: .kaxfk
            Source: VERSION.dll0.5.drStatic PE information: section name: .pjf
            Source: VERSION.dll0.5.drStatic PE information: section name: .favk
            Source: VERSION.dll0.5.drStatic PE information: section name: .vhtukj
            Source: VERSION.dll0.5.drStatic PE information: section name: .hmbyox
            Source: VERSION.dll0.5.drStatic PE information: section name: .txms
            Source: VERSION.dll0.5.drStatic PE information: section name: .vqqm
            Source: VERSION.dll0.5.drStatic PE information: section name: .cbwb
            Source: VERSION.dll0.5.drStatic PE information: section name: .sggk
            Source: VERSION.dll0.5.drStatic PE information: section name: .cbotn
            Source: VERSION.dll0.5.drStatic PE information: section name: .urf
            Source: VERSION.dll0.5.drStatic PE information: section name: .yera
            Source: VERSION.dll0.5.drStatic PE information: section name: .sjj
            Source: VERSION.dll0.5.drStatic PE information: section name: .wcro
            Source: VERSION.dll0.5.drStatic PE information: section name: .imkkq
            Source: VERSION.dll0.5.drStatic PE information: section name: .mrdc
            Source: VERSION.dll0.5.drStatic PE information: section name: .eaph
            Source: VERSION.dll0.5.drStatic PE information: section name: .wqzg
            Source: VERSION.dll0.5.drStatic PE information: section name: .uwxw
            Source: VERSION.dll0.5.drStatic PE information: section name: .acz
            Source: VERSION.dll0.5.drStatic PE information: section name: .ktb
            Source: VERSION.dll0.5.drStatic PE information: section name: .nqplrs
            Source: VERSION.dll0.5.drStatic PE information: section name: .btah
            Source: VERSION.dll0.5.drStatic PE information: section name: .majbu
            Source: VERSION.dll0.5.drStatic PE information: section name: .zefvk
            Source: VERSION.dll0.5.drStatic PE information: section name: .qlndvj
            Source: VERSION.dll0.5.drStatic PE information: section name: .bgsn
            Source: dpx.dll.5.drStatic PE information: section name: .qkm
            Source: dpx.dll.5.drStatic PE information: section name: .cvjb
            Source: dpx.dll.5.drStatic PE information: section name: .tlmkv
            Source: dpx.dll.5.drStatic PE information: section name: .wucsxe
            Source: dpx.dll.5.drStatic PE information: section name: .fltwtj
            Source: dpx.dll.5.drStatic PE information: section name: .sfplio
            Source: dpx.dll.5.drStatic PE information: section name: .rpg
            Source: dpx.dll.5.drStatic PE information: section name: .bewzc
            Source: dpx.dll.5.drStatic PE information: section name: .vksvaw
            Source: dpx.dll.5.drStatic PE information: section name: .wmhg
            Source: dpx.dll.5.drStatic PE information: section name: .kswemc
            Source: dpx.dll.5.drStatic PE information: section name: .kaxfk
            Source: dpx.dll.5.drStatic PE information: section name: .pjf
            Source: dpx.dll.5.drStatic PE information: section name: .favk
            Source: dpx.dll.5.drStatic PE information: section name: .vhtukj
            Source: dpx.dll.5.drStatic PE information: section name: .hmbyox
            Source: dpx.dll.5.drStatic PE information: section name: .txms
            Source: dpx.dll.5.drStatic PE information: section name: .vqqm
            Source: dpx.dll.5.drStatic PE information: section name: .cbwb
            Source: dpx.dll.5.drStatic PE information: section name: .sggk
            Source: dpx.dll.5.drStatic PE information: section name: .cbotn
            Source: dpx.dll.5.drStatic PE information: section name: .urf
            Source: dpx.dll.5.drStatic PE information: section name: .yera
            Source: dpx.dll.5.drStatic PE information: section name: .sjj
            Source: dpx.dll.5.drStatic PE information: section name: .wcro
            Source: dpx.dll.5.drStatic PE information: section name: .imkkq
            Source: dpx.dll.5.drStatic PE information: section name: .mrdc
            Source: dpx.dll.5.drStatic PE information: section name: .eaph
            Source: dpx.dll.5.drStatic PE information: section name: .wqzg
            Source: dpx.dll.5.drStatic PE information: section name: .uwxw
            Source: dpx.dll.5.drStatic PE information: section name: .acz
            Source: dpx.dll.5.drStatic PE information: section name: .ktb
            Source: dpx.dll.5.drStatic PE information: section name: .nqplrs
            Source: dpx.dll.5.drStatic PE information: section name: .btah
            Source: dpx.dll.5.drStatic PE information: section name: .majbu
            Source: dpx.dll.5.drStatic PE information: section name: .zefvk
            Source: dpx.dll.5.drStatic PE information: section name: .qlndvj
            Source: SPP.dll.5.drStatic PE information: section name: .qkm
            Source: SPP.dll.5.drStatic PE information: section name: .cvjb
            Source: SPP.dll.5.drStatic PE information: section name: .tlmkv
            Source: SPP.dll.5.drStatic PE information: section name: .wucsxe
            Source: SPP.dll.5.drStatic PE information: section name: .fltwtj
            Source: SPP.dll.5.drStatic PE information: section name: .sfplio
            Source: SPP.dll.5.drStatic PE information: section name: .rpg
            Source: SPP.dll.5.drStatic PE information: section name: .bewzc
            Source: SPP.dll.5.drStatic PE information: section name: .vksvaw
            Source: SPP.dll.5.drStatic PE information: section name: .wmhg
            Source: SPP.dll.5.drStatic PE information: section name: .kswemc
            Source: SPP.dll.5.drStatic PE information: section name: .kaxfk
            Source: SPP.dll.5.drStatic PE information: section name: .pjf
            Source: SPP.dll.5.drStatic PE information: section name: .favk
            Source: SPP.dll.5.drStatic PE information: section name: .vhtukj
            Source: SPP.dll.5.drStatic PE information: section name: .hmbyox
            Source: SPP.dll.5.drStatic PE information: section name: .txms
            Source: SPP.dll.5.drStatic PE information: section name: .vqqm
            Source: SPP.dll.5.drStatic PE information: section name: .cbwb
            Source: SPP.dll.5.drStatic PE information: section name: .sggk
            Source: SPP.dll.5.drStatic PE information: section name: .cbotn
            Source: SPP.dll.5.drStatic PE information: section name: .urf
            Source: SPP.dll.5.drStatic PE information: section name: .yera
            Source: SPP.dll.5.drStatic PE information: section name: .sjj
            Source: SPP.dll.5.drStatic PE information: section name: .wcro
            Source: SPP.dll.5.drStatic PE information: section name: .imkkq
            Source: SPP.dll.5.drStatic PE information: section name: .mrdc
            Source: SPP.dll.5.drStatic PE information: section name: .eaph
            Source: SPP.dll.5.drStatic PE information: section name: .wqzg
            Source: SPP.dll.5.drStatic PE information: section name: .uwxw
            Source: SPP.dll.5.drStatic PE information: section name: .acz
            Source: SPP.dll.5.drStatic PE information: section name: .ktb
            Source: SPP.dll.5.drStatic PE information: section name: .nqplrs
            Source: SPP.dll.5.drStatic PE information: section name: .btah
            Source: SPP.dll.5.drStatic PE information: section name: .majbu
            Source: SPP.dll.5.drStatic PE information: section name: .zefvk
            Source: SPP.dll.5.drStatic PE information: section name: .qlndvj
            Source: SPP.dll.5.drStatic PE information: section name: .ovfse
            Source: VERSION.dll1.5.drStatic PE information: section name: .qkm
            Source: VERSION.dll1.5.drStatic PE information: section name: .cvjb
            Source: VERSION.dll1.5.drStatic PE information: section name: .tlmkv
            Source: VERSION.dll1.5.drStatic PE information: section name: .wucsxe
            Source: VERSION.dll1.5.drStatic PE information: section name: .fltwtj
            Source: VERSION.dll1.5.drStatic PE information: section name: .sfplio
            Source: VERSION.dll1.5.drStatic PE information: section name: .rpg
            Source: VERSION.dll1.5.drStatic PE information: section name: .bewzc
            Source: VERSION.dll1.5.drStatic PE information: section name: .vksvaw
            Source: VERSION.dll1.5.drStatic PE information: section name: .wmhg
            Source: VERSION.dll1.5.drStatic PE information: section name: .kswemc
            Source: VERSION.dll1.5.drStatic PE information: section name: .kaxfk
            Source: VERSION.dll1.5.drStatic PE information: section name: .pjf
            Source: VERSION.dll1.5.drStatic PE information: section name: .favk
            Source: VERSION.dll1.5.drStatic PE information: section name: .vhtukj
            Source: VERSION.dll1.5.drStatic PE information: section name: .hmbyox
            Source: VERSION.dll1.5.drStatic PE information: section name: .txms
            Source: VERSION.dll1.5.drStatic PE information: section name: .vqqm
            Source: VERSION.dll1.5.drStatic PE information: section name: .cbwb
            Source: VERSION.dll1.5.drStatic PE information: section name: .sggk
            Source: VERSION.dll1.5.drStatic PE information: section name: .cbotn
            Source: VERSION.dll1.5.drStatic PE information: section name: .urf
            Source: VERSION.dll1.5.drStatic PE information: section name: .yera
            Source: VERSION.dll1.5.drStatic PE information: section name: .sjj
            Source: VERSION.dll1.5.drStatic PE information: section name: .wcro
            Source: VERSION.dll1.5.drStatic PE information: section name: .imkkq
            Source: VERSION.dll1.5.drStatic PE information: section name: .mrdc
            Source: VERSION.dll1.5.drStatic PE information: section name: .eaph
            Source: VERSION.dll1.5.drStatic PE information: section name: .wqzg
            Source: VERSION.dll1.5.drStatic PE information: section name: .uwxw
            Source: VERSION.dll1.5.drStatic PE information: section name: .acz
            Source: VERSION.dll1.5.drStatic PE information: section name: .ktb
            Source: VERSION.dll1.5.drStatic PE information: section name: .nqplrs
            Source: VERSION.dll1.5.drStatic PE information: section name: .btah
            Source: VERSION.dll1.5.drStatic PE information: section name: .majbu
            Source: VERSION.dll1.5.drStatic PE information: section name: .zefvk
            Source: VERSION.dll1.5.drStatic PE information: section name: .qlndvj
            Source: VERSION.dll1.5.drStatic PE information: section name: .eqd
            Source: DUI70.dll.5.drStatic PE information: section name: .qkm
            Source: DUI70.dll.5.drStatic PE information: section name: .cvjb
            Source: DUI70.dll.5.drStatic PE information: section name: .tlmkv
            Source: DUI70.dll.5.drStatic PE information: section name: .wucsxe
            Source: DUI70.dll.5.drStatic PE information: section name: .fltwtj
            Source: DUI70.dll.5.drStatic PE information: section name: .sfplio
            Source: DUI70.dll.5.drStatic PE information: section name: .rpg
            Source: DUI70.dll.5.drStatic PE information: section name: .bewzc
            Source: DUI70.dll.5.drStatic PE information: section name: .vksvaw
            Source: DUI70.dll.5.drStatic PE information: section name: .wmhg
            Source: DUI70.dll.5.drStatic PE information: section name: .kswemc
            Source: DUI70.dll.5.drStatic PE information: section name: .kaxfk
            Source: DUI70.dll.5.drStatic PE information: section name: .pjf
            Source: DUI70.dll.5.drStatic PE information: section name: .favk
            Source: DUI70.dll.5.drStatic PE information: section name: .vhtukj
            Source: DUI70.dll.5.drStatic PE information: section name: .hmbyox
            Source: DUI70.dll.5.drStatic PE information: section name: .txms
            Source: DUI70.dll.5.drStatic PE information: section name: .vqqm
            Source: DUI70.dll.5.drStatic PE information: section name: .cbwb
            Source: DUI70.dll.5.drStatic PE information: section name: .sggk
            Source: DUI70.dll.5.drStatic PE information: section name: .cbotn
            Source: DUI70.dll.5.drStatic PE information: section name: .urf
            Source: DUI70.dll.5.drStatic PE information: section name: .yera
            Source: DUI70.dll.5.drStatic PE information: section name: .sjj
            Source: DUI70.dll.5.drStatic PE information: section name: .wcro
            Source: DUI70.dll.5.drStatic PE information: section name: .imkkq
            Source: DUI70.dll.5.drStatic PE information: section name: .mrdc
            Source: DUI70.dll.5.drStatic PE information: section name: .eaph
            Source: DUI70.dll.5.drStatic PE information: section name: .wqzg
            Source: DUI70.dll.5.drStatic PE information: section name: .uwxw
            Source: DUI70.dll.5.drStatic PE information: section name: .acz
            Source: DUI70.dll.5.drStatic PE information: section name: .ktb
            Source: DUI70.dll.5.drStatic PE information: section name: .nqplrs
            Source: DUI70.dll.5.drStatic PE information: section name: .btah
            Source: DUI70.dll.5.drStatic PE information: section name: .majbu
            Source: DUI70.dll.5.drStatic PE information: section name: .zefvk
            Source: DUI70.dll.5.drStatic PE information: section name: .qlndvj
            Source: DUI70.dll.5.drStatic PE information: section name: .iyirm
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .qkm
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .cvjb
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .tlmkv
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .wucsxe
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .fltwtj
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .sfplio
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .rpg
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .bewzc
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .vksvaw
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .wmhg
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .kswemc
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .kaxfk
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .pjf
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .favk
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .vhtukj
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .hmbyox
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .txms
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .vqqm
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .cbwb
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .sggk
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .cbotn
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .urf
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .yera
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .sjj
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .wcro
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .imkkq
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .mrdc
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .eaph
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .wqzg
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .uwxw
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .acz
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .ktb
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .nqplrs
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .btah
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .majbu
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .zefvk
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .qlndvj
            Source: WTSAPI32.dll.5.drStatic PE information: section name: .zuuw
            Source: VERSION.dll2.5.drStatic PE information: section name: .qkm
            Source: VERSION.dll2.5.drStatic PE information: section name: .cvjb
            Source: VERSION.dll2.5.drStatic PE information: section name: .tlmkv
            Source: VERSION.dll2.5.drStatic PE information: section name: .wucsxe
            Source: VERSION.dll2.5.drStatic PE information: section name: .fltwtj
            Source: VERSION.dll2.5.drStatic PE information: section name: .sfplio
            Source: VERSION.dll2.5.drStatic PE information: section name: .rpg
            Source: VERSION.dll2.5.drStatic PE information: section name: .bewzc
            Source: VERSION.dll2.5.drStatic PE information: section name: .vksvaw
            Source: VERSION.dll2.5.drStatic PE information: section name: .wmhg
            Source: VERSION.dll2.5.drStatic PE information: section name: .kswemc
            Source: VERSION.dll2.5.drStatic PE information: section name: .kaxfk
            Source: VERSION.dll2.5.drStatic PE information: section name: .pjf
            Source: VERSION.dll2.5.drStatic PE information: section name: .favk
            Source: VERSION.dll2.5.drStatic PE information: section name: .vhtukj
            Source: VERSION.dll2.5.drStatic PE information: section name: .hmbyox
            Source: VERSION.dll2.5.drStatic PE information: section name: .txms
            Source: VERSION.dll2.5.drStatic PE information: section name: .vqqm
            Source: VERSION.dll2.5.drStatic PE information: section name: .cbwb
            Source: VERSION.dll2.5.drStatic PE information: section name: .sggk
            Source: VERSION.dll2.5.drStatic PE information: section name: .cbotn
            Source: VERSION.dll2.5.drStatic PE information: section name: .urf
            Source: VERSION.dll2.5.drStatic PE information: section name: .yera
            Source: VERSION.dll2.5.drStatic PE information: section name: .sjj
            Source: VERSION.dll2.5.drStatic PE information: section name: .wcro
            Source: VERSION.dll2.5.drStatic PE information: section name: .imkkq
            Source: VERSION.dll2.5.drStatic PE information: section name: .mrdc
            Source: VERSION.dll2.5.drStatic PE information: section name: .eaph
            Source: VERSION.dll2.5.drStatic PE information: section name: .wqzg
            Source: VERSION.dll2.5.drStatic PE information: section name: .uwxw
            Source: VERSION.dll2.5.drStatic PE information: section name: .acz
            Source: VERSION.dll2.5.drStatic PE information: section name: .ktb
            Source: VERSION.dll2.5.drStatic PE information: section name: .nqplrs
            Source: VERSION.dll2.5.drStatic PE information: section name: .btah
            Source: VERSION.dll2.5.drStatic PE information: section name: .majbu
            Source: VERSION.dll2.5.drStatic PE information: section name: .zefvk
            Source: VERSION.dll2.5.drStatic PE information: section name: .qlndvj
            Source: VERSION.dll2.5.drStatic PE information: section name: .kjsir
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .qkm
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .cvjb
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .tlmkv
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .wucsxe
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .fltwtj
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .sfplio
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .rpg
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .bewzc
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .vksvaw
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .wmhg
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .kswemc
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .kaxfk
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .pjf
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .favk
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .vhtukj
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .hmbyox
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .txms
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .vqqm
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .cbwb
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .sggk
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .cbotn
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .urf
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .yera
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .sjj
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .wcro
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .imkkq
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .mrdc
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .eaph
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .wqzg
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .uwxw
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .acz
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .ktb
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .nqplrs
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .btah
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .majbu
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .zefvk
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .qlndvj
            Source: SYSDM.CPL0.5.drStatic PE information: section name: .aqbz
            Source: dwmapi.dll.5.drStatic PE information: section name: .qkm
            Source: dwmapi.dll.5.drStatic PE information: section name: .cvjb
            Source: 1ZDvfs8V0D.dllStatic PE information: real checksum: 0x7d786c40 should be: 0x20ddeb
            Source: DUI70.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x24911c
            Source: VERSION.dll1.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x21349b
            Source: SYSDM.CPL.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x209ffe
            Source: SLC.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20cfd8
            Source: VERSION.dll3.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x213c73
            Source: VERSION.dll0.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20e755
            Source: dwmapi.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20cfae
            Source: dpx.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20f77b
            Source: DUI70.dll0.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x255c6c
            Source: VERSION.dll2.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20ecd4
            Source: SYSDM.CPL0.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20d4cc
            Source: WTSAPI32.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x205efc
            Source: MFPlat.DLL.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x206e9b
            Source: WMsgAPI.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20d15b
            Source: VERSION.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x20e727
            Source: SPP.dll.5.drStatic PE information: real checksum: 0x7d786c40 should be: 0x208d8e
            Source: msinfo32.exe.5.drStatic PE information: 0xF1906102 [Thu Jun 5 01:44:34 2098 UTC]
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: initial sampleStatic PE information: section name: .text entropy: 7.73364605679
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\rceY\SYSDM.CPLJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPLJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\rceY\SYSDM.CPLJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\whddZ\irftp.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\ueX148\SysResetErr.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\XyDPIStsf\SndVol.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\5zVf35m1I\msinfo32.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\K5GwJI\VERSION.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\EkXB809\lpksetup.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\rRo\AgentService.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\vx8g6QJ\systemreset.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\vx8g6QJ\VERSION.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\9Uw6zQ\VERSION.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\HaXuPA\SYSDM.CPLJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\K5GwJI\wextract.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\EkXB809\dpx.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Ui6tQfJoZ\SystemSettingsRemoveDevice.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Ui6tQfJoZ\DUI70.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\XyDPIStsf\dwmapi.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\ibC\SPP.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\BxU\MFPlat.DLLJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\5zVf35m1I\SLC.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\BxU\mfpmp.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\W6MyNTlP8\WMsgAPI.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\0ubYqNmr\PresentationHost.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\0ubYqNmr\VERSION.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\whddZ\WTSAPI32.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\9Uw6zQ\unregmp2.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\rceY\SystemPropertiesProtection.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\ibC\rstrui.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\HaXuPA\SystemPropertiesPerformance.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\W6MyNTlP8\osk.exeJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\rRo\VERSION.dllJump to dropped file
            Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\ueX148\DUI70.dllJump to dropped file