Windows Analysis Report X5C9EzCB7A

AV Detection:

Multi AV Scanner detection for submitted file

Source: X5C9EzCB7A.dll	Virustotal: Detection: 64%			Perma Link
Source: X5C9EzCB7A.dll	Metadefender: Detection: 57%			Perma Link
Source: X5C9EzCB7A.dll	ReversingLabs: Detection: 75%

Antivirus / Scanner detection for submitted sample

Source: X5C9EzCB7A.dll

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\9Krbbc\ACTIVEDS.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\8FwY\dpx.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\2vl\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\0Nty\ReAgent.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\2vl\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\M5A\wer.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\4DETSU\MFC42u.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\B8nn\XmlLite.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\Mnd\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\4DETSU\MFC42u.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Mnd\VERSION.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\2vl\DUI70.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\QEkvVts\WINMM.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\T6Vn91tw0\SLC.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\Nom\WTSAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\SB1jY1h\UxTheme.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Machine Learning detection for sample

Source: X5C9EzCB7A.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\9Krbbc\ACTIVEDS.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\8FwY\dpx.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\2vl\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\0Nty\ReAgent.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\2vl\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\M5A\wer.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\4DETSU\MFC42u.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\B8nn\XmlLite.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Mnd\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\4DETSU\MFC42u.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Mnd\VERSION.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\2vl\DUI70.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\QEkvVts\WINMM.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\T6Vn91tw0\SLC.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Nom\WTSAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\SB1jY1h\UxTheme.dll	Joe Sandbox ML: detected

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBF5C8 RegQueryValueExW,RegQueryValueExW,CryptUnprotectData,GetLastError,LocalFree,		34_2_00007FF7D5CBF5C8
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBF500 CryptProtectData,GetLastError,RegSetValueExW,		34_2_00007FF7D5CBF500
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F8780 memset,LocalFree,CryptAcquireContextW,GetLastError,CryptGenRandom,GetLastError,memset,CreateDirectoryA,GetLastError,GetFileAttributesA,GetLastError,DecryptFileA,GetLastError,MultiByteToWideChar,GetLastError,CryptReleaseContext,LocalFree,		40_2_00007FF6EE1F8780

Compliance:

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: X5C9EzCB7A.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: wusa.pdbGCTL source: wusa.exe, 00000028.00000000.367767741.00007FF6EE207000.00000002.00020000.sdmp
Source:	Binary string: wusa.pdb source: wusa.exe, 00000028.00000000.367767741.00007FF6EE207000.00000002.00020000.sdmp
Source:	Binary string: Wfs.pdbGCTL source: WFS.exe, 00000022.00000002.365079762.00007FF7D5CDC000.00000002.00020000.sdmp
Source:	Binary string: WerMgr.pdb source: wermgr.exe, 0000001F.00000000.351011301.00007FF740985000.00000002.00020000.sdmp
Source:	Binary string: Wfs.pdb source: WFS.exe, 00000022.00000002.365079762.00007FF7D5CDC000.00000002.00020000.sdmp
Source:	Binary string: WerMgr.pdbGCTL source: wermgr.exe, 0000001F.00000000.351011301.00007FF740985000.00000002.00020000.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,		0_2_000000014005D290
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740981BA0 FindFirstFileExW,_wcsicmp,_wcsicmp,FindNextFileW,GetLastError,GetLastError,FindClose,		31_2_00007FF740981BA0
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF74097BE54 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,CompareStringW,FindNextFileW,FindClose,FindClose,		31_2_00007FF74097BE54
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C871B0 #626,memset,#6887,#1122,#1287,FindFirstFileW,GetLastError,#6886,#1122,#1287,#1287,#624,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,GetLastError,FindClose,#6887,#1040,SendMessageW,		34_2_00007FF7D5C871B0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CA30D8 SendMessageW,GetLastError,wcschr,#626,#2846,FindFirstFileW,GetLastError,#1040,#626,memset,GetLastError,ReadFile,GetLastError,CloseHandle,FindNextFileW,GetLastError,FindClose,GetLastError,#1040,CloseHandle,SendMessageW,#4262,#640,#1122,#1040,#6395,#6395,		34_2_00007FF7D5CA30D8
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C7F0AC GetTempPathW,GetLastError,wcsrchr,_wcsnset,GetCurrentProcessId,FindFirstFileW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,FindClose,		34_2_00007FF7D5C7F0AC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB89BC wcscpy_s,wcscat_s,FindFirstFileW,_wcsicmp,FindNextFileW,GetLastError,FindClose,		34_2_00007FF7D5CB89BC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C85B40 #626,#626,memset,memset,#6887,#620,#1122,#1040,#1287,FindFirstFileW,GetLastError,#6886,#620,#1122,#1040,#1287,#1287,#620,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,GetLastError,FindClose,#6887,#1040,#1040,SendMessageW,		34_2_00007FF7D5C85B40
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F1BC0 memset,memset,CoInitializeEx,FindFirstFileW,GetLastError,lstrcmpiW,FindNextFileW,GetLastError,GetCommandLineW,EventWrite,FindClose,CoUninitialize,LocalFree,		40_2_00007FF6EE1F1BC0
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F8D04 memset,memset,memset,FindFirstFileW,GetLastError,lstrcmpW,lstrcmpW,DeleteFileW,GetLastError,MoveFileExW,GetLastError,FindNextFileW,GetLastError,FindClose,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,GetLastError,LocalFree,		40_2_00007FF6EE1F8D04

Networking:

URLs found in memory or binary data

Source: explorer.exe, 00000004.00000000.268276705.0000000006870000.00000004.00000001.sdmp

String found in binary or memory: http://www.autoitscript.com/autoit3/J

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 00000020.00000002.357738953.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.294331565.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.332178412.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.452046176.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.324869275.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.310372882.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.341553991.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.256116400.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.353298117.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.363607406.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.270725525.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.279755934.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.249682229.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.317261849.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.287591369.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.302760143.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.339544401.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.263669758.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.367587367.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.399487635.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.370038497.0000000140001000.00000020.00020000.sdmp, type: MEMORY

System Summary:

PE file contains section with special chars

Source: SppExtComObj.Exe.4.dr

Static PE information: section name: ?g_Encry

Detected potential crypto function

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140034870		0_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003B220		0_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035270		0_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140048AC0		0_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003A2E0		0_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005C340		0_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140065B80		0_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0		0_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400524B0		0_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140026CC0		0_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004BD40		0_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400495B0		0_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140036F30		0_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069010		0_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001010		0_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140066020		0_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002F840		0_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D850		0_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064080		0_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140010880		0_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400688A0		0_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002D0D0		0_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400018D0		0_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016100		0_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D100		0_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002A110		0_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D910		0_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140015120		0_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000B120		0_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004F940		0_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140039140		0_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023140		0_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140057950		0_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001E170		0_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140002980		0_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400611A0		0_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400389A0		0_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400381A0		0_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002E1B0		0_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007C9D0		0_2_000000014007C9D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400139D0		0_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400319F0		0_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EA00		0_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022A00		0_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140067A40		0_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069A50		0_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007A60		0_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003AAC0		0_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140062B00		0_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018300		0_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FB20		0_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031340		0_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022340		0_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140017B40		0_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000BB40		0_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140079360		0_2_0000000140079360
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004EB60		0_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005370		0_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002CB80		0_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B390		0_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140054BA0		0_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033BB0		0_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400263C0		0_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400123C0		0_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140063BD0		0_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400663F0		0_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023BF0		0_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B41B		0_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B424		0_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B42D		0_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B436		0_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B43D		0_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140024440		0_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005C40		0_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B446		0_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005F490		0_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022D00		0_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035520		0_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019D20		0_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140030530		0_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023530		0_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078D3F		0_2_0000000140078D3F
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031540		0_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033540		0_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007BD50		0_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078570		0_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019580		0_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400205A0		0_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025DB0		0_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140071DC0		0_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000C5C0		0_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002DDE0		0_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007D5F0		0_2_000000014007D5F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031DF0		0_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000DDF0		0_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001620		0_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018630		0_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140032650		0_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140050E60		0_2_0000000140050E60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064E80		0_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016E80		0_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140079681		0_2_0000000140079681
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007EA0		0_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400286B0		0_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140006EB0		0_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400276C0		0_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FEC0		0_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078EBB		0_2_0000000140078EBB
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EED0		0_2_000000014002EED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002B6E0		0_2_000000014002B6E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140053F20		0_2_0000000140053F20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022730		0_2_0000000140022730
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140029780		0_2_0000000140029780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018F80		0_2_0000000140018F80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003EFB0		0_2_000000014003EFB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400067B0		0_2_00000001400067B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400667D0		0_2_00000001400667D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140060FE0		0_2_0000000140060FE0
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF74097CFF0		31_2_00007FF74097CFF0
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740972F54		31_2_00007FF740972F54
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF74097E368		31_2_00007FF74097E368
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740977EFC		31_2_00007FF740977EFC
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740982438		31_2_00007FF740982438
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740976848		31_2_00007FF740976848
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740980A58		31_2_00007FF740980A58
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C7B6C4		34_2_00007FF7D5C7B6C4
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB0630		34_2_00007FF7D5CB0630
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C785B0		34_2_00007FF7D5C785B0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAF5D0		34_2_00007FF7D5CAF5D0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CC15BC		34_2_00007FF7D5CC15BC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBB904		34_2_00007FF7D5CBB904
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB18CC		34_2_00007FF7D5CB18CC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C9E840		34_2_00007FF7D5C9E840
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C9F71C		34_2_00007FF7D5C9F71C
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C75738		34_2_00007FF7D5C75738
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C73258		34_2_00007FF7D5C73258
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C79250		34_2_00007FF7D5C79250
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBA1B0		34_2_00007FF7D5CBA1B0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB6180		34_2_00007FF7D5CB6180
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB54E0		34_2_00007FF7D5CB54E0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C7C4F8		34_2_00007FF7D5C7C4F8
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAE4C0		34_2_00007FF7D5CAE4C0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C9541C		34_2_00007FF7D5C9541C
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CD2440		34_2_00007FF7D5CD2440
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBB410		34_2_00007FF7D5CBB410
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C9B3A8		34_2_00007FF7D5C9B3A8
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAA380		34_2_00007FF7D5CAA380
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAD320		34_2_00007FF7D5CAD320
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C73A30		34_2_00007FF7D5C73A30
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB3E1C		34_2_00007FF7D5CB3E1C
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB6E50		34_2_00007FF7D5CB6E50
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBB0DC		34_2_00007FF7D5CBB0DC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAC060		34_2_00007FF7D5CAC060
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CD1F60		34_2_00007FF7D5CD1F60
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C87AF0		34_2_00007FF7D5C87AF0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB8AB0		34_2_00007FF7D5CB8AB0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C73A30		34_2_00007FF7D5C73A30
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBA9E0		34_2_00007FF7D5CBA9E0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C819D0		34_2_00007FF7D5C819D0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C7C974		34_2_00007FF7D5C7C974
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C93940		34_2_00007FF7D5C93940
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C74CD4		34_2_00007FF7D5C74CD4
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB5C10		34_2_00007FF7D5CB5C10
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CBFC0C		34_2_00007FF7D5CBFC0C
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB6C00		34_2_00007FF7D5CB6C00
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CD2B6C		34_2_00007FF7D5CD2B6C
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C90B80		34_2_00007FF7D5C90B80
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAFB30		34_2_00007FF7D5CAFB30
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CAAB1C		34_2_00007FF7D5CAAB1C
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1FA0FC		40_2_00007FF6EE1FA0FC
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F3D88		40_2_00007FF6EE1F3D88
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F5EA4		40_2_00007FF6EE1F5EA4
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F1BC0		40_2_00007FF6EE1F1BC0
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F8780		40_2_00007FF6EE1F8780
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F9910		40_2_00007FF6EE1F9910
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F356C		40_2_00007FF6EE1F356C
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F23F0		40_2_00007FF6EE1F23F0

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: String function: 00007FF7D5C738C8 appears 261 times
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: String function: 00007FF6EE1F9520 appears 162 times

Contains functionality to launch a process as a different user

Source: C:\Users\user\AppData\Local\8FwY\wusa.exe

Code function: 40_2_00007FF6EE1F3A2C memset,GetSystemDirectoryW,wcsrchr,memset,CreateProcessAsUserW,GetLastError,WaitForSingleObject,GetLastError,GetExitCodeProcess,GetLastError,GetLastError,CloseHandle,CloseHandle,LocalFree,

40_2_00007FF6EE1F3A2C

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003BFF0 NtDuplicateObject,		0_2_000000014003BFF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003B220 NtReadVirtualMemory,NtQueueApcThread,NtProtectVirtualMemory,NtQueueApcThread,NtProtectVirtualMemory,NtProtectVirtualMemory,		0_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025280 NtDuplicateObject,		0_2_0000000140025280
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003A2E0 NtDuplicateObject,NtQueueApcThread,		0_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025330 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,		0_2_0000000140025330
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003BC10 CreateFileMappingW,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,		0_2_000000014003BC10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004E440 NtDelayExecution,		0_2_000000014004E440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140046C90 NtClose,		0_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0 NtQuerySystemInformation,		0_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003C560 NtDuplicateObject,NtClose,		0_2_000000014003C560
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140039F50 NtReadVirtualMemory,		0_2_0000000140039F50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003BF70 NtDuplicateObject,NtClose,		0_2_000000014003BF70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003AF90 NtQueueApcThread,		0_2_000000014003AF90
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740978404 DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,		31_2_00007FF740978404
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740981F54 NtQueryLicenseValue,		31_2_00007FF740981F54
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF74097E368 ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,NtQuerySystemInformation,NtOpenEvent,NtWaitForSingleObject,NtClose,RtlAllocateAndInitializeSid,RtlInitUnicodeString,memset,NtAlpcConnectPort,memset,NtAlpcSendWaitReceivePort,RtlFreeSid,NtClose,		31_2_00007FF74097E368
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF7409782EC DbgPrintEx,NtQueryInformationProcess,DbgPrintEx,DbgPrintEx,ReadProcessMemory,DbgPrintEx,GetLastError,		31_2_00007FF7409782EC
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740982438 LoadLibraryExW,GetProcAddress,NtQueryLicenseValue,FreeLibrary,NtQueryLicenseValue,		31_2_00007FF740982438

PE file contains strange resources

Source: wermgr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WFS.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WFS.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: WFS.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wusa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wusa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wusa.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SndVol.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wlrmdr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wlrmdr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: mblctr.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Dxpserver.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Dxpserver.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Dxpserver.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DevicePairingWizard.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wscript.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: recdisc.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: recdisc.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: recdisc.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perfmon.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perfmon.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: perfmon.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wermgr.exe0.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SnippingTool.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SnippingTool.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SnippingTool.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SnippingTool.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wextract.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wextract.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wextract.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FXSCOVER.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FXSCOVER.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FXSCOVER.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file contains more sections than normal

Source: ACTIVEDS.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: WTSAPI32.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: DUI70.dll0.4.dr	Static PE information: Number of sections : 43 > 10
Source: UxTheme.dll0.4.dr	Static PE information: Number of sections : 43 > 10
Source: wer.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: XmlLite.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: VERSION.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: DUI70.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: WINMM.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: X5C9EzCB7A.dll	Static PE information: Number of sections : 42 > 10
Source: dpx.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: UxTheme.dll.4.dr	Static PE information: Number of sections : 43 > 10
Source: MFC42u.dll.4.dr	Static PE information: Number of sections : 43 > 10

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: X5C9EzCB7A.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: wer.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINMM.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dpx.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WTSAPI32.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll0.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DUI70.dll0.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XmlLite.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFC42u.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ACTIVEDS.dll.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SppExtComObj.Exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: X5C9EzCB7A.dll	Virustotal: Detection: 64%
Source: X5C9EzCB7A.dll	Metadefender: Detection: 57%
Source: X5C9EzCB7A.dll	ReversingLabs: Detection: 75%

PE file has an executable .text section and no other executable section

Source: X5C9EzCB7A.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\X5C9EzCB7A.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\X5C9EzCB7A.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AddGadgetMessageHandler
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\X5C9EzCB7A.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AddLayeredRef
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AdjustClipInsideRef
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AttachWndProcA
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AttachWndProcW
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AutoTrace
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BeginHideInputPaneAnimation
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BeginShowInputPaneAnimation
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BuildAnimation
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BuildDropTarget
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BuildInterpolation
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,CacheDWriteRenderTarget
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,ChangeCurrentAnimationScenario
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,ClearPushedOpacitiesFromGadgetTree
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\M5A\wermgr.exe C:\Users\user\AppData\Local\M5A\wermgr.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,ClearTopmostVisual
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\WFS.exe C:\Windows\system32\WFS.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\QEkvVts\WFS.exe C:\Users\user\AppData\Local\QEkvVts\WFS.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,CreateAction
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wusa.exe C:\Windows\system32\wusa.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\8FwY\wusa.exe C:\Users\user\AppData\Local\8FwY\wusa.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\X5C9EzCB7A.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AddGadgetMessageHandler			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AddLayeredRef			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AdjustClipInsideRef			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AttachWndProcA			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AttachWndProcW			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AutoTrace			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BeginHideInputPaneAnimation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BeginShowInputPaneAnimation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BuildAnimation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BuildDropTarget			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,BuildInterpolation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,CacheDWriteRenderTarget			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,ChangeCurrentAnimationScenario			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,ClearPushedOpacitiesFromGadgetTree			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,ClearTopmostVisual			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,CreateAction			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\X5C9EzCB7A.dll',#1			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\M5A\wermgr.exe C:\Users\user\AppData\Local\M5A\wermgr.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\WFS.exe C:\Windows\system32\WFS.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\QEkvVts\WFS.exe C:\Users\user\AppData\Local\QEkvVts\WFS.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wusa.exe C:\Windows\system32\wusa.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\8FwY\wusa.exe C:\Users\user\AppData\Local\8FwY\wusa.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\8FwY\wusa.exe C:\Users\user\AppData\Local\8FwY\wusa.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\AppData\Local\8FwY\wusa.exe

Code function: 40_2_00007FF6EE1F5438 LookupPrivilegeValueW,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,LocalFree,

40_2_00007FF6EE1F5438

Creates files inside the user directory

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\eb42b1a5c308fc11edf1ddbdd25c8486_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winDLL@91/45@0/0

Contains functionality to instantiate COM classes

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF740978F2C CoInitializeEx,CoCreateInstance,SysAllocString,SysFreeString,CoUninitialize,

31_2_00007FF740978F2C

Contains functionality to create services

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: RtlInitUnicodeString,RtlCreateBoundaryDescriptor,RtlInitUnicodeString,RtlCreateServiceSid,GetProcessHeap,HeapAlloc,RtlCreateServiceSid,RtlAddSIDToBoundaryDescriptor,OpenPrivateNamespaceW,GetLastError,GetProcessHeap,HeapFree,RtlDeleteBoundaryDescriptor,

31_2_00007FF74097DE98

Contains functionality for error logging

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe

Code function: 34_2_00007FF7D5C9541C SendDlgItemMessageW,memset,memset,LoadStringW,FormatMessageW,SetDlgItemTextW,GetLastError,GetLastError,PeekMessageW,TranslateMessage,DispatchMessageW,#5065,#5065,PeekMessageW,

34_2_00007FF7D5C9541C

Contains functionality to enum processes or threads

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000014003C240 GetProcessId,CreateToolhelp32Snapshot,Thread32First,

0_2_000000014003C240

Runs a DLL by calling functions

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\X5C9EzCB7A.dll,AddGadgetMessageHandler

Creates mutexes

Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Mutant created: \Sessions\1\BaseNamedObjects\{f4c92513-81b4-e2bc-e5ad-0bbbd5f6a12c}
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{3baca1ad-f576-2ca5-ab39-dd9076560d1e}

Sample might require command line arguments

Source: wusa.exe	String found in binary or memory: Failed to display update-installed message box
Source: wusa.exe	String found in binary or memory: Failed to display update-not-installed message box

PE file exports many functions

Source: X5C9EzCB7A.dll

Static PE information: More than 149 > 100 exports found

PE file has a high image base, often used for DLLs

Source: X5C9EzCB7A.dll

Static PE information: Image base 0x140000000 > 0x60000000

Submission file is bigger than most known malware samples

Source: X5C9EzCB7A.dll

Static file information: File size 2117632 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: X5C9EzCB7A.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: wusa.pdbGCTL source: wusa.exe, 00000028.00000000.367767741.00007FF6EE207000.00000002.00020000.sdmp
Source:	Binary string: wusa.pdb source: wusa.exe, 00000028.00000000.367767741.00007FF6EE207000.00000002.00020000.sdmp
Source:	Binary string: Wfs.pdbGCTL source: WFS.exe, 00000022.00000002.365079762.00007FF7D5CDC000.00000002.00020000.sdmp
Source:	Binary string: WerMgr.pdb source: wermgr.exe, 0000001F.00000000.351011301.00007FF740985000.00000002.00020000.sdmp
Source:	Binary string: Wfs.pdb source: WFS.exe, 00000022.00000002.365079762.00007FF7D5CDC000.00000002.00020000.sdmp
Source:	Binary string: WerMgr.pdbGCTL source: wermgr.exe, 0000001F.00000000.351011301.00007FF740985000.00000002.00020000.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140056A4D push rdi; ret		0_2_0000000140056A4E
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE201964 push rbx; iretd		40_2_00007FF6EE201965
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE2015F8 push rbx; retf		40_2_00007FF6EE2015F9

PE file contains sections with non-standard names

Source: X5C9EzCB7A.dll	Static PE information: section name: .qkm
Source: X5C9EzCB7A.dll	Static PE information: section name: .cvjb
Source: X5C9EzCB7A.dll	Static PE information: section name: .tlmkv
Source: X5C9EzCB7A.dll	Static PE information: section name: .wucsxe
Source: X5C9EzCB7A.dll	Static PE information: section name: .fltwtj
Source: X5C9EzCB7A.dll	Static PE information: section name: .sfplio
Source: X5C9EzCB7A.dll	Static PE information: section name: .rpg
Source: X5C9EzCB7A.dll	Static PE information: section name: .bewzc
Source: X5C9EzCB7A.dll	Static PE information: section name: .vksvaw
Source: X5C9EzCB7A.dll	Static PE information: section name: .wmhg
Source: X5C9EzCB7A.dll	Static PE information: section name: .kswemc
Source: X5C9EzCB7A.dll	Static PE information: section name: .kaxfk
Source: X5C9EzCB7A.dll	Static PE information: section name: .pjf
Source: X5C9EzCB7A.dll	Static PE information: section name: .favk
Source: X5C9EzCB7A.dll	Static PE information: section name: .vhtukj
Source: X5C9EzCB7A.dll	Static PE information: section name: .hmbyox
Source: X5C9EzCB7A.dll	Static PE information: section name: .txms
Source: X5C9EzCB7A.dll	Static PE information: section name: .vqqm
Source: X5C9EzCB7A.dll	Static PE information: section name: .cbwb
Source: X5C9EzCB7A.dll	Static PE information: section name: .cti
Source: X5C9EzCB7A.dll	Static PE information: section name: .ktfjac
Source: X5C9EzCB7A.dll	Static PE information: section name: .hvmici
Source: X5C9EzCB7A.dll	Static PE information: section name: .bvyyd
Source: X5C9EzCB7A.dll	Static PE information: section name: .qhjn
Source: X5C9EzCB7A.dll	Static PE information: section name: .bsvkca
Source: X5C9EzCB7A.dll	Static PE information: section name: .nvpgx
Source: X5C9EzCB7A.dll	Static PE information: section name: .yaa
Source: X5C9EzCB7A.dll	Static PE information: section name: .qsimby
Source: X5C9EzCB7A.dll	Static PE information: section name: .dibg
Source: X5C9EzCB7A.dll	Static PE information: section name: .odxfk
Source: X5C9EzCB7A.dll	Static PE information: section name: .zczpdd
Source: X5C9EzCB7A.dll	Static PE information: section name: .iceycz
Source: X5C9EzCB7A.dll	Static PE information: section name: .lwp
Source: X5C9EzCB7A.dll	Static PE information: section name: .ejt
Source: X5C9EzCB7A.dll	Static PE information: section name: .gzpi
Source: X5C9EzCB7A.dll	Static PE information: section name: .oima
Source: wermgr.exe.4.dr	Static PE information: section name: .imrsiv
Source: wermgr.exe.4.dr	Static PE information: section name: .didat
Source: WFS.exe.4.dr	Static PE information: section name: .didat
Source: SndVol.exe.4.dr	Static PE information: section name: .imrsiv
Source: SndVol.exe.4.dr	Static PE information: section name: .didat
Source: wlrmdr.exe.4.dr	Static PE information: section name: .imrsiv
Source: ProximityUxHost.exe.4.dr	Static PE information: section name: .imrsiv
Source: wermgr.exe0.4.dr	Static PE information: section name: .imrsiv
Source: wermgr.exe0.4.dr	Static PE information: section name: .didat
Source: LicensingUI.exe.4.dr	Static PE information: section name: .imrsiv
Source: wer.dll.4.dr	Static PE information: section name: .qkm
Source: wer.dll.4.dr	Static PE information: section name: .cvjb
Source: wer.dll.4.dr	Static PE information: section name: .tlmkv
Source: wer.dll.4.dr	Static PE information: section name: .wucsxe
Source: wer.dll.4.dr	Static PE information: section name: .fltwtj
Source: wer.dll.4.dr	Static PE information: section name: .sfplio
Source: wer.dll.4.dr	Static PE information: section name: .rpg
Source: wer.dll.4.dr	Static PE information: section name: .bewzc
Source: wer.dll.4.dr	Static PE information: section name: .vksvaw
Source: wer.dll.4.dr	Static PE information: section name: .wmhg
Source: wer.dll.4.dr	Static PE information: section name: .kswemc
Source: wer.dll.4.dr	Static PE information: section name: .kaxfk
Source: wer.dll.4.dr	Static PE information: section name: .pjf
Source: wer.dll.4.dr	Static PE information: section name: .favk
Source: wer.dll.4.dr	Static PE information: section name: .vhtukj
Source: wer.dll.4.dr	Static PE information: section name: .hmbyox
Source: wer.dll.4.dr	Static PE information: section name: .txms
Source: wer.dll.4.dr	Static PE information: section name: .vqqm
Source: wer.dll.4.dr	Static PE information: section name: .cbwb
Source: wer.dll.4.dr	Static PE information: section name: .cti
Source: wer.dll.4.dr	Static PE information: section name: .ktfjac
Source: wer.dll.4.dr	Static PE information: section name: .hvmici
Source: wer.dll.4.dr	Static PE information: section name: .bvyyd
Source: wer.dll.4.dr	Static PE information: section name: .qhjn
Source: wer.dll.4.dr	Static PE information: section name: .bsvkca
Source: wer.dll.4.dr	Static PE information: section name: .nvpgx
Source: wer.dll.4.dr	Static PE information: section name: .yaa
Source: wer.dll.4.dr	Static PE information: section name: .qsimby
Source: wer.dll.4.dr	Static PE information: section name: .dibg
Source: wer.dll.4.dr	Static PE information: section name: .odxfk
Source: wer.dll.4.dr	Static PE information: section name: .zczpdd
Source: wer.dll.4.dr	Static PE information: section name: .iceycz
Source: wer.dll.4.dr	Static PE information: section name: .lwp
Source: wer.dll.4.dr	Static PE information: section name: .ejt
Source: wer.dll.4.dr	Static PE information: section name: .gzpi
Source: wer.dll.4.dr	Static PE information: section name: .oima
Source: wer.dll.4.dr	Static PE information: section name: .akm
Source: WINMM.dll.4.dr	Static PE information: section name: .qkm
Source: WINMM.dll.4.dr	Static PE information: section name: .cvjb
Source: WINMM.dll.4.dr	Static PE information: section name: .tlmkv
Source: WINMM.dll.4.dr	Static PE information: section name: .wucsxe
Source: WINMM.dll.4.dr	Static PE information: section name: .fltwtj
Source: WINMM.dll.4.dr	Static PE information: section name: .sfplio
Source: WINMM.dll.4.dr	Static PE information: section name: .rpg
Source: WINMM.dll.4.dr	Static PE information: section name: .bewzc
Source: WINMM.dll.4.dr	Static PE information: section name: .vksvaw
Source: WINMM.dll.4.dr	Static PE information: section name: .wmhg
Source: WINMM.dll.4.dr	Static PE information: section name: .kswemc
Source: WINMM.dll.4.dr	Static PE information: section name: .kaxfk
Source: WINMM.dll.4.dr	Static PE information: section name: .pjf
Source: WINMM.dll.4.dr	Static PE information: section name: .favk
Source: WINMM.dll.4.dr	Static PE information: section name: .vhtukj
Source: WINMM.dll.4.dr	Static PE information: section name: .hmbyox
Source: WINMM.dll.4.dr	Static PE information: section name: .txms
Source: WINMM.dll.4.dr	Static PE information: section name: .vqqm
Source: WINMM.dll.4.dr	Static PE information: section name: .cbwb
Source: WINMM.dll.4.dr	Static PE information: section name: .cti
Source: WINMM.dll.4.dr	Static PE information: section name: .ktfjac
Source: WINMM.dll.4.dr	Static PE information: section name: .hvmici
Source: WINMM.dll.4.dr	Static PE information: section name: .bvyyd
Source: WINMM.dll.4.dr	Static PE information: section name: .qhjn
Source: WINMM.dll.4.dr	Static PE information: section name: .bsvkca
Source: WINMM.dll.4.dr	Static PE information: section name: .nvpgx
Source: WINMM.dll.4.dr	Static PE information: section name: .yaa
Source: WINMM.dll.4.dr	Static PE information: section name: .qsimby
Source: WINMM.dll.4.dr	Static PE information: section name: .dibg
Source: WINMM.dll.4.dr	Static PE information: section name: .odxfk
Source: WINMM.dll.4.dr	Static PE information: section name: .zczpdd
Source: WINMM.dll.4.dr	Static PE information: section name: .iceycz
Source: WINMM.dll.4.dr	Static PE information: section name: .lwp
Source: WINMM.dll.4.dr	Static PE information: section name: .ejt
Source: WINMM.dll.4.dr	Static PE information: section name: .gzpi
Source: WINMM.dll.4.dr	Static PE information: section name: .oima
Source: WINMM.dll.4.dr	Static PE information: section name: .saaaq
Source: dpx.dll.4.dr	Static PE information: section name: .qkm
Source: dpx.dll.4.dr	Static PE information: section name: .cvjb
Source: dpx.dll.4.dr	Static PE information: section name: .tlmkv
Source: dpx.dll.4.dr	Static PE information: section name: .wucsxe
Source: dpx.dll.4.dr	Static PE information: section name: .fltwtj
Source: dpx.dll.4.dr	Static PE information: section name: .sfplio
Source: dpx.dll.4.dr	Static PE information: section name: .rpg
Source: dpx.dll.4.dr	Static PE information: section name: .bewzc
Source: dpx.dll.4.dr	Static PE information: section name: .vksvaw
Source: dpx.dll.4.dr	Static PE information: section name: .wmhg
Source: dpx.dll.4.dr	Static PE information: section name: .kswemc
Source: dpx.dll.4.dr	Static PE information: section name: .kaxfk
Source: dpx.dll.4.dr	Static PE information: section name: .pjf
Source: dpx.dll.4.dr	Static PE information: section name: .favk
Source: dpx.dll.4.dr	Static PE information: section name: .vhtukj
Source: dpx.dll.4.dr	Static PE information: section name: .hmbyox
Source: dpx.dll.4.dr	Static PE information: section name: .txms
Source: dpx.dll.4.dr	Static PE information: section name: .vqqm
Source: dpx.dll.4.dr	Static PE information: section name: .cbwb
Source: dpx.dll.4.dr	Static PE information: section name: .cti
Source: dpx.dll.4.dr	Static PE information: section name: .ktfjac
Source: dpx.dll.4.dr	Static PE information: section name: .hvmici
Source: dpx.dll.4.dr	Static PE information: section name: .bvyyd
Source: dpx.dll.4.dr	Static PE information: section name: .qhjn
Source: dpx.dll.4.dr	Static PE information: section name: .bsvkca
Source: dpx.dll.4.dr	Static PE information: section name: .nvpgx
Source: dpx.dll.4.dr	Static PE information: section name: .yaa
Source: dpx.dll.4.dr	Static PE information: section name: .qsimby
Source: dpx.dll.4.dr	Static PE information: section name: .dibg
Source: dpx.dll.4.dr	Static PE information: section name: .odxfk
Source: dpx.dll.4.dr	Static PE information: section name: .zczpdd
Source: dpx.dll.4.dr	Static PE information: section name: .iceycz
Source: dpx.dll.4.dr	Static PE information: section name: .lwp
Source: dpx.dll.4.dr	Static PE information: section name: .ejt
Source: dpx.dll.4.dr	Static PE information: section name: .gzpi
Source: dpx.dll.4.dr	Static PE information: section name: .oima
Source: dpx.dll.4.dr	Static PE information: section name: .hmoki
Source: UxTheme.dll.4.dr	Static PE information: section name: .qkm
Source: UxTheme.dll.4.dr	Static PE information: section name: .cvjb
Source: UxTheme.dll.4.dr	Static PE information: section name: .tlmkv
Source: UxTheme.dll.4.dr	Static PE information: section name: .wucsxe
Source: UxTheme.dll.4.dr	Static PE information: section name: .fltwtj
Source: UxTheme.dll.4.dr	Static PE information: section name: .sfplio
Source: UxTheme.dll.4.dr	Static PE information: section name: .rpg
Source: UxTheme.dll.4.dr	Static PE information: section name: .bewzc
Source: UxTheme.dll.4.dr	Static PE information: section name: .vksvaw
Source: UxTheme.dll.4.dr	Static PE information: section name: .wmhg
Source: UxTheme.dll.4.dr	Static PE information: section name: .kswemc
Source: UxTheme.dll.4.dr	Static PE information: section name: .kaxfk
Source: UxTheme.dll.4.dr	Static PE information: section name: .pjf
Source: UxTheme.dll.4.dr	Static PE information: section name: .favk
Source: UxTheme.dll.4.dr	Static PE information: section name: .vhtukj
Source: UxTheme.dll.4.dr	Static PE information: section name: .hmbyox
Source: UxTheme.dll.4.dr	Static PE information: section name: .txms
Source: UxTheme.dll.4.dr	Static PE information: section name: .vqqm
Source: UxTheme.dll.4.dr	Static PE information: section name: .cbwb
Source: UxTheme.dll.4.dr	Static PE information: section name: .cti
Source: UxTheme.dll.4.dr	Static PE information: section name: .ktfjac
Source: UxTheme.dll.4.dr	Static PE information: section name: .hvmici
Source: UxTheme.dll.4.dr	Static PE information: section name: .bvyyd
Source: UxTheme.dll.4.dr	Static PE information: section name: .qhjn
Source: UxTheme.dll.4.dr	Static PE information: section name: .bsvkca
Source: UxTheme.dll.4.dr	Static PE information: section name: .nvpgx
Source: UxTheme.dll.4.dr	Static PE information: section name: .yaa
Source: UxTheme.dll.4.dr	Static PE information: section name: .qsimby
Source: UxTheme.dll.4.dr	Static PE information: section name: .dibg
Source: UxTheme.dll.4.dr	Static PE information: section name: .odxfk
Source: UxTheme.dll.4.dr	Static PE information: section name: .zczpdd
Source: UxTheme.dll.4.dr	Static PE information: section name: .iceycz
Source: UxTheme.dll.4.dr	Static PE information: section name: .lwp
Source: UxTheme.dll.4.dr	Static PE information: section name: .ejt
Source: UxTheme.dll.4.dr	Static PE information: section name: .gzpi
Source: UxTheme.dll.4.dr	Static PE information: section name: .oima
Source: UxTheme.dll.4.dr	Static PE information: section name: .sbt
Source: DUI70.dll.4.dr	Static PE information: section name: .qkm
Source: DUI70.dll.4.dr	Static PE information: section name: .cvjb
Source: DUI70.dll.4.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll.4.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll.4.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll.4.dr	Static PE information: section name: .sfplio
Source: DUI70.dll.4.dr	Static PE information: section name: .rpg
Source: DUI70.dll.4.dr	Static PE information: section name: .bewzc
Source: DUI70.dll.4.dr	Static PE information: section name: .vksvaw
Source: DUI70.dll.4.dr	Static PE information: section name: .wmhg
Source: DUI70.dll.4.dr	Static PE information: section name: .kswemc
Source: DUI70.dll.4.dr	Static PE information: section name: .kaxfk
Source: DUI70.dll.4.dr	Static PE information: section name: .pjf
Source: DUI70.dll.4.dr	Static PE information: section name: .favk
Source: DUI70.dll.4.dr	Static PE information: section name: .vhtukj
Source: DUI70.dll.4.dr	Static PE information: section name: .hmbyox
Source: DUI70.dll.4.dr	Static PE information: section name: .txms
Source: DUI70.dll.4.dr	Static PE information: section name: .vqqm
Source: DUI70.dll.4.dr	Static PE information: section name: .cbwb
Source: DUI70.dll.4.dr	Static PE information: section name: .cti
Source: DUI70.dll.4.dr	Static PE information: section name: .ktfjac
Source: DUI70.dll.4.dr	Static PE information: section name: .hvmici
Source: DUI70.dll.4.dr	Static PE information: section name: .bvyyd
Source: DUI70.dll.4.dr	Static PE information: section name: .qhjn
Source: DUI70.dll.4.dr	Static PE information: section name: .bsvkca
Source: DUI70.dll.4.dr	Static PE information: section name: .nvpgx
Source: DUI70.dll.4.dr	Static PE information: section name: .yaa
Source: DUI70.dll.4.dr	Static PE information: section name: .qsimby
Source: DUI70.dll.4.dr	Static PE information: section name: .dibg
Source: DUI70.dll.4.dr	Static PE information: section name: .odxfk
Source: DUI70.dll.4.dr	Static PE information: section name: .zczpdd
Source: DUI70.dll.4.dr	Static PE information: section name: .iceycz
Source: DUI70.dll.4.dr	Static PE information: section name: .lwp
Source: DUI70.dll.4.dr	Static PE information: section name: .ejt
Source: DUI70.dll.4.dr	Static PE information: section name: .gzpi
Source: DUI70.dll.4.dr	Static PE information: section name: .oima
Source: DUI70.dll.4.dr	Static PE information: section name: .iokrmu
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .qkm
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .cvjb
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .tlmkv
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .wucsxe
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .fltwtj
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .sfplio
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .rpg
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .bewzc
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vksvaw
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .wmhg
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .kswemc
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .kaxfk
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .pjf
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .favk
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vhtukj
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .hmbyox
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .txms
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .vqqm
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .cbwb
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .cti
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .ktfjac
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .hvmici
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .bvyyd
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .qhjn
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .bsvkca
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .nvpgx
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .yaa
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .qsimby
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .dibg
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .odxfk
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .zczpdd
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .iceycz
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .lwp
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .ejt
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .gzpi
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .oima
Source: WTSAPI32.dll.4.dr	Static PE information: section name: .bxvwc
Source: UxTheme.dll0.4.dr	Static PE information: section name: .qkm
Source: UxTheme.dll0.4.dr	Static PE information: section name: .cvjb
Source: UxTheme.dll0.4.dr	Static PE information: section name: .tlmkv
Source: UxTheme.dll0.4.dr	Static PE information: section name: .wucsxe
Source: UxTheme.dll0.4.dr	Static PE information: section name: .fltwtj
Source: UxTheme.dll0.4.dr	Static PE information: section name: .sfplio
Source: UxTheme.dll0.4.dr	Static PE information: section name: .rpg
Source: UxTheme.dll0.4.dr	Static PE information: section name: .bewzc
Source: UxTheme.dll0.4.dr	Static PE information: section name: .vksvaw
Source: UxTheme.dll0.4.dr	Static PE information: section name: .wmhg
Source: UxTheme.dll0.4.dr	Static PE information: section name: .kswemc
Source: UxTheme.dll0.4.dr	Static PE information: section name: .kaxfk
Source: UxTheme.dll0.4.dr	Static PE information: section name: .pjf
Source: UxTheme.dll0.4.dr	Static PE information: section name: .favk
Source: UxTheme.dll0.4.dr	Static PE information: section name: .vhtukj
Source: UxTheme.dll0.4.dr	Static PE information: section name: .hmbyox
Source: UxTheme.dll0.4.dr	Static PE information: section name: .txms
Source: UxTheme.dll0.4.dr	Static PE information: section name: .vqqm
Source: UxTheme.dll0.4.dr	Static PE information: section name: .cbwb
Source: UxTheme.dll0.4.dr	Static PE information: section name: .cti
Source: UxTheme.dll0.4.dr	Static PE information: section name: .ktfjac
Source: UxTheme.dll0.4.dr	Static PE information: section name: .hvmici
Source: UxTheme.dll0.4.dr	Static PE information: section name: .bvyyd
Source: UxTheme.dll0.4.dr	Static PE information: section name: .qhjn
Source: UxTheme.dll0.4.dr	Static PE information: section name: .bsvkca
Source: UxTheme.dll0.4.dr	Static PE information: section name: .nvpgx
Source: UxTheme.dll0.4.dr	Static PE information: section name: .yaa
Source: UxTheme.dll0.4.dr	Static PE information: section name: .qsimby
Source: UxTheme.dll0.4.dr	Static PE information: section name: .dibg
Source: UxTheme.dll0.4.dr	Static PE information: section name: .odxfk
Source: UxTheme.dll0.4.dr	Static PE information: section name: .zczpdd
Source: UxTheme.dll0.4.dr	Static PE information: section name: .iceycz
Source: UxTheme.dll0.4.dr	Static PE information: section name: .lwp
Source: UxTheme.dll0.4.dr	Static PE information: section name: .ejt
Source: UxTheme.dll0.4.dr	Static PE information: section name: .gzpi
Source: UxTheme.dll0.4.dr	Static PE information: section name: .oima
Source: UxTheme.dll0.4.dr	Static PE information: section name: .zpg
Source: DUI70.dll0.4.dr	Static PE information: section name: .qkm
Source: DUI70.dll0.4.dr	Static PE information: section name: .cvjb
Source: DUI70.dll0.4.dr	Static PE information: section name: .tlmkv
Source: DUI70.dll0.4.dr	Static PE information: section name: .wucsxe
Source: DUI70.dll0.4.dr	Static PE information: section name: .fltwtj
Source: DUI70.dll0.4.dr	Static PE information: section name: .sfplio
Source: DUI70.dll0.4.dr	Static PE information: section name: .rpg
Source: DUI70.dll0.4.dr	Static PE information: section name: .bewzc
Source: DUI70.dll0.4.dr	Static PE information: section name: .vksvaw
Source: DUI70.dll0.4.dr	Static PE information: section name: .wmhg
Source: DUI70.dll0.4.dr	Static PE information: section name: .kswemc
Source: DUI70.dll0.4.dr	Static PE information: section name: .kaxfk
Source: DUI70.dll0.4.dr	Static PE information: section name: .pjf
Source: DUI70.dll0.4.dr	Static PE information: section name: .favk
Source: DUI70.dll0.4.dr	Static PE information: section name: .vhtukj
Source: DUI70.dll0.4.dr	Static PE information: section name: .hmbyox
Source: DUI70.dll0.4.dr	Static PE information: section name: .txms
Source: DUI70.dll0.4.dr	Static PE information: section name: .vqqm
Source: DUI70.dll0.4.dr	Static PE information: section name: .cbwb
Source: DUI70.dll0.4.dr	Static PE information: section name: .cti
Source: DUI70.dll0.4.dr	Static PE information: section name: .ktfjac
Source: DUI70.dll0.4.dr	Static PE information: section name: .hvmici
Source: DUI70.dll0.4.dr	Static PE information: section name: .bvyyd
Source: DUI70.dll0.4.dr	Static PE information: section name: .qhjn
Source: DUI70.dll0.4.dr	Static PE information: section name: .bsvkca
Source: DUI70.dll0.4.dr	Static PE information: section name: .nvpgx
Source: DUI70.dll0.4.dr	Static PE information: section name: .yaa
Source: DUI70.dll0.4.dr	Static PE information: section name: .qsimby
Source: DUI70.dll0.4.dr	Static PE information: section name: .dibg
Source: DUI70.dll0.4.dr	Static PE information: section name: .odxfk
Source: DUI70.dll0.4.dr	Static PE information: section name: .zczpdd
Source: DUI70.dll0.4.dr	Static PE information: section name: .iceycz
Source: DUI70.dll0.4.dr	Static PE information: section name: .lwp
Source: DUI70.dll0.4.dr	Static PE information: section name: .ejt
Source: DUI70.dll0.4.dr	Static PE information: section name: .gzpi
Source: DUI70.dll0.4.dr	Static PE information: section name: .oima
Source: DUI70.dll0.4.dr	Static PE information: section name: .cltwqt
Source: XmlLite.dll.4.dr	Static PE information: section name: .qkm
Source: XmlLite.dll.4.dr	Static PE information: section name: .cvjb
Source: XmlLite.dll.4.dr	Static PE information: section name: .tlmkv
Source: XmlLite.dll.4.dr	Static PE information: section name: .wucsxe
Source: XmlLite.dll.4.dr	Static PE information: section name: .fltwtj
Source: XmlLite.dll.4.dr	Static PE information: section name: .sfplio
Source: XmlLite.dll.4.dr	Static PE information: section name: .rpg
Source: XmlLite.dll.4.dr	Static PE information: section name: .bewzc
Source: XmlLite.dll.4.dr	Static PE information: section name: .vksvaw
Source: XmlLite.dll.4.dr	Static PE information: section name: .wmhg
Source: XmlLite.dll.4.dr	Static PE information: section name: .kswemc
Source: XmlLite.dll.4.dr	Static PE information: section name: .kaxfk
Source: XmlLite.dll.4.dr	Static PE information: section name: .pjf
Source: XmlLite.dll.4.dr	Static PE information: section name: .favk
Source: XmlLite.dll.4.dr	Static PE information: section name: .vhtukj
Source: XmlLite.dll.4.dr	Static PE information: section name: .hmbyox
Source: XmlLite.dll.4.dr	Static PE information: section name: .txms
Source: XmlLite.dll.4.dr	Static PE information: section name: .vqqm
Source: XmlLite.dll.4.dr	Static PE information: section name: .cbwb
Source: XmlLite.dll.4.dr	Static PE information: section name: .cti
Source: XmlLite.dll.4.dr	Static PE information: section name: .ktfjac
Source: XmlLite.dll.4.dr	Static PE information: section name: .hvmici
Source: XmlLite.dll.4.dr	Static PE information: section name: .bvyyd
Source: XmlLite.dll.4.dr	Static PE information: section name: .qhjn
Source: XmlLite.dll.4.dr	Static PE information: section name: .bsvkca
Source: XmlLite.dll.4.dr	Static PE information: section name: .nvpgx
Source: XmlLite.dll.4.dr	Static PE information: section name: .yaa
Source: XmlLite.dll.4.dr	Static PE information: section name: .qsimby
Source: XmlLite.dll.4.dr	Static PE information: section name: .dibg
Source: XmlLite.dll.4.dr	Static PE information: section name: .odxfk
Source: XmlLite.dll.4.dr	Static PE information: section name: .zczpdd
Source: XmlLite.dll.4.dr	Static PE information: section name: .iceycz
Source: XmlLite.dll.4.dr	Static PE information: section name: .lwp
Source: XmlLite.dll.4.dr	Static PE information: section name: .ejt
Source: XmlLite.dll.4.dr	Static PE information: section name: .gzpi
Source: XmlLite.dll.4.dr	Static PE information: section name: .oima
Source: XmlLite.dll.4.dr	Static PE information: section name: .yhjpr
Source: MFC42u.dll.4.dr	Static PE information: section name: .qkm
Source: MFC42u.dll.4.dr	Static PE information: section name: .cvjb
Source: MFC42u.dll.4.dr	Static PE information: section name: .tlmkv
Source: MFC42u.dll.4.dr	Static PE information: section name: .wucsxe
Source: MFC42u.dll.4.dr	Static PE information: section name: .fltwtj
Source: MFC42u.dll.4.dr	Static PE information: section name: .sfplio
Source: MFC42u.dll.4.dr	Static PE information: section name: .rpg
Source: MFC42u.dll.4.dr	Static PE information: section name: .bewzc
Source: MFC42u.dll.4.dr	Static PE information: section name: .vksvaw
Source: MFC42u.dll.4.dr	Static PE information: section name: .wmhg
Source: MFC42u.dll.4.dr	Static PE information: section name: .kswemc
Source: MFC42u.dll.4.dr	Static PE information: section name: .kaxfk
Source: MFC42u.dll.4.dr	Static PE information: section name: .pjf
Source: MFC42u.dll.4.dr	Static PE information: section name: .favk
Source: MFC42u.dll.4.dr	Static PE information: section name: .vhtukj
Source: MFC42u.dll.4.dr	Static PE information: section name: .hmbyox
Source: MFC42u.dll.4.dr	Static PE information: section name: .txms
Source: MFC42u.dll.4.dr	Static PE information: section name: .vqqm
Source: MFC42u.dll.4.dr	Static PE information: section name: .cbwb
Source: MFC42u.dll.4.dr	Static PE information: section name: .cti
Source: MFC42u.dll.4.dr	Static PE information: section name: .ktfjac
Source: MFC42u.dll.4.dr	Static PE information: section name: .hvmici
Source: MFC42u.dll.4.dr	Static PE information: section name: .bvyyd
Source: MFC42u.dll.4.dr	Static PE information: section name: .qhjn
Source: MFC42u.dll.4.dr	Static PE information: section name: .bsvkca
Source: MFC42u.dll.4.dr	Static PE information: section name: .nvpgx
Source: MFC42u.dll.4.dr	Static PE information: section name: .yaa
Source: MFC42u.dll.4.dr	Static PE information: section name: .qsimby
Source: MFC42u.dll.4.dr	Static PE information: section name: .dibg
Source: MFC42u.dll.4.dr	Static PE information: section name: .odxfk
Source: MFC42u.dll.4.dr	Static PE information: section name: .zczpdd
Source: MFC42u.dll.4.dr	Static PE information: section name: .iceycz
Source: MFC42u.dll.4.dr	Static PE information: section name: .lwp
Source: MFC42u.dll.4.dr	Static PE information: section name: .ejt
Source: MFC42u.dll.4.dr	Static PE information: section name: .gzpi
Source: MFC42u.dll.4.dr	Static PE information: section name: .oima
Source: MFC42u.dll.4.dr	Static PE information: section name: .hpnemo
Source: VERSION.dll.4.dr	Static PE information: section name: .qkm
Source: VERSION.dll.4.dr	Static PE information: section name: .cvjb
Source: VERSION.dll.4.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll.4.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll.4.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll.4.dr	Static PE information: section name: .sfplio
Source: VERSION.dll.4.dr	Static PE information: section name: .rpg
Source: VERSION.dll.4.dr	Static PE information: section name: .bewzc
Source: VERSION.dll.4.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll.4.dr	Static PE information: section name: .wmhg
Source: VERSION.dll.4.dr	Static PE information: section name: .kswemc
Source: VERSION.dll.4.dr	Static PE information: section name: .kaxfk
Source: VERSION.dll.4.dr	Static PE information: section name: .pjf
Source: VERSION.dll.4.dr	Static PE information: section name: .favk
Source: VERSION.dll.4.dr	Static PE information: section name: .vhtukj
Source: VERSION.dll.4.dr	Static PE information: section name: .hmbyox
Source: VERSION.dll.4.dr	Static PE information: section name: .txms
Source: VERSION.dll.4.dr	Static PE information: section name: .vqqm
Source: VERSION.dll.4.dr	Static PE information: section name: .cbwb
Source: VERSION.dll.4.dr	Static PE information: section name: .cti
Source: VERSION.dll.4.dr	Static PE information: section name: .ktfjac
Source: VERSION.dll.4.dr	Static PE information: section name: .hvmici
Source: VERSION.dll.4.dr	Static PE information: section name: .bvyyd
Source: VERSION.dll.4.dr	Static PE information: section name: .qhjn
Source: VERSION.dll.4.dr	Static PE information: section name: .bsvkca
Source: VERSION.dll.4.dr	Static PE information: section name: .nvpgx
Source: VERSION.dll.4.dr	Static PE information: section name: .yaa
Source: VERSION.dll.4.dr	Static PE information: section name: .qsimby
Source: VERSION.dll.4.dr	Static PE information: section name: .dibg
Source: VERSION.dll.4.dr	Static PE information: section name: .odxfk
Source: VERSION.dll.4.dr	Static PE information: section name: .zczpdd
Source: VERSION.dll.4.dr	Static PE information: section name: .iceycz
Source: VERSION.dll.4.dr	Static PE information: section name: .lwp
Source: VERSION.dll.4.dr	Static PE information: section name: .ejt
Source: VERSION.dll.4.dr	Static PE information: section name: .gzpi
Source: VERSION.dll.4.dr	Static PE information: section name: .oima
Source: VERSION.dll.4.dr	Static PE information: section name: .wgfpbw
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .qkm
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .cvjb
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .tlmkv
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .wucsxe
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .fltwtj
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .sfplio
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .rpg
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .bewzc
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .vksvaw
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .wmhg
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .kswemc
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .kaxfk
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .pjf
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .favk
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .vhtukj
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .hmbyox
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .txms
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .vqqm
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .cbwb
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .cti
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .ktfjac
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .hvmici
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .bvyyd
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .qhjn
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .bsvkca
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .nvpgx
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .yaa
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .qsimby
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .dibg
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .odxfk
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .zczpdd
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .iceycz
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .lwp
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .ejt
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .gzpi
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .oima
Source: ACTIVEDS.dll.4.dr	Static PE information: section name: .ajokiy
Source: SppExtComObj.Exe.4.dr	Static PE information: section name: ?g_Encry

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe

Code function: 34_2_00007FF7D5C84858 LoadLibraryW,GetProcAddress,FreeLibrary,

34_2_00007FF7D5C84858

PE file contains an invalid checksum

Source: ACTIVEDS.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2158d9
Source: WTSAPI32.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20a536
Source: DUI70.dll0.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x256371
Source: UxTheme.dll0.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x207aff
Source: wer.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2121a1
Source: XmlLite.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20c257
Source: VERSION.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x21343c
Source: DUI70.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x256c7c
Source: WINMM.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2111d5
Source: X5C9EzCB7A.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x207a12
Source: dpx.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20f2f8
Source: UxTheme.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20c755
Source: MFC42u.dll.4.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x21abc9

Binary contains a suspicious time stamp

Source: wermgr.exe.4.dr

Static PE information: 0xA7D9A170 [Fri Mar 28 06:15:12 2059 UTC]

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.59477523886

Persistence and Installation Behavior:

Windows Update Standalone Installer command line found (may be used to bypass UAC)

Source: wusa.exe, 00000028.00000000.367767741.00007FF6EE207000.00000002.00020000.sdmp

Memory string: DWS;zWusaHiddenFailed to allocate and initialize Administrators group SID.WusaIsUserAdminFailed to check token membership.Failed to get message text for id %uWusaLoadMessageWusaMessageBoxFailed: TaskDialog()Failed to get message for error 0x%xWusaGetErrorMessageWusaCreateLockFileFailed to allocate memory for lock file path.Failed to create lock file %SFailed: GetFullPathName() failed for %SWusaGetFullPathNameFailed to allocate memory for full path.Failed to create extract job for location: %SWusaExtractAllFilesFromCabinetFailed to add container for cabinet: %SFailed: ExtractAllFiles()Failed to extract files from cabinet %SFailed: LookupPrivilegeValue()EnablePrivilegeFailed: OpenProcessToken()Failed: AdjustTokenPrivileges()Failed: AdjustTokenPrivileges(); not all token privileges were assignedFailed: GetTokenInformation()WusaGetUserSIDFailed: CopySid()Failed to PostMessage to progress window, error code %uWusaPostMessagewusa.lockFailed to create eventAppModule::InitFailed to initialize COM securityFailed to initialize critical sectionFailed to show welcome dialogFailed to show non administrator dialogUser is not a member of the Administrators group.Failed to show multiple instance dialogError: Another instance of wusa.exe is running.Failed to create sandboxCreated sandbox %lsFailed: AppModule::SetScanCabPath()Failed to get application title text, id %uFailed to allocate BSTR for application titleFailure returned by InitCommonControlsEx()Failure returned by CreateFont()Failed to get STR_EXPAND_START textFailed to get STR_EXPAND_START_UNINSTALL textFailed to get STR_SEARCH_START textFailed to get STR_COPY_START textFailed to get STR_UNINSTALL_START textFailed to set done event to release shutdown blockAppModule::UninitDeleting sandbox %SAppModule::DeleteSandBoxFailed to delete sandboxCommandLineToArgvW() failed.AppModule::ParseCommandLineError: Too few arguments.Failed to get command line length.Failed to allocate memory for ignored arguments.Failed. Restart mode was supplied multiple times30Failed to parse switchFailed. /warnrestart has invalid formatFailed. /kb was supplied multiple timesFailed. /kb has invalid formatKBFailed to prefix KB numberFailed. /log was supplied multiple timesFailed. /gpmode was supplied multiple timesFailed. /gpmode has invalid formatFailed to allocate memory for product codeFailed to set product code to %lsFailed to add an argument to the ignored list Failed to add a blank space to the ignored argument listUnrecognized argument %SFailed to get MSU file nameFailed to get MSU file name or KB numberFailed: /uninstall with /kb and /quiet options is not supportedFailed to show /extract not supported message boxFailed: /extract is not a supported optionCommand line is %lsFailed to get source lengthAppModule::CopyStringWithQuoteFailed to allocate temp buffer"%s"Failed to copy stringFailure returned by SystemParametersInfo()AppModule::CreateFontWFailure returned by CreateFontIndirectW()Failure returned by DeleteObject()Failure r

Drops PE files

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\0Nty\recdisc.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ySbBY3WaF\UxTheme.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\2vl\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\9Krbbc\SppExtComObj.Exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\ySbBY3WaF\SndVol.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\T6Vn91tw0\slui.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\4DETSU\MFC42u.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\gxzS7\credui.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\B8nn\XmlLite.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Nom\mblctr.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\SB1jY1h\AtBroker.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\8FwY\dpx.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\h1G\ACTIVEDS.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\8FwY\wusa.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Bun\MFC42u.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\LnjKLu\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\9Krbbc\ACTIVEDS.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\O8JNmHZW\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\T6Vn91tw0\SLC.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\O8JNmHZW\cmstp.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\kkXbTNX3S\wscript.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Mnd\wextract.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\QEkvVts\WFS.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\SB1jY1h\UxTheme.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\h1G\AgentService.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\gxzS7\perfmon.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\iU8z5\wermgr.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\QEkvVts\WINMM.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Mnd\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\0Nty\ReAgent.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\kOjpxXR\dwmapi.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\kOjpxXR\SnippingTool.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Nom\WTSAPI32.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\4DETSU\FXSCOVER.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\byYs\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\B8nn\Dxpserver.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Bun\DevicePairingWizard.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\kkXbTNX3S\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\iU8z5\wer.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\byYs\wlrmdr.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\LnjKLu\ProximityUxHost.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\M5A\wer.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\M5A\wermgr.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\2vl\LicensingUI.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe

Code function: 34_2_00007FF7D5C74CD4 FindWindowW,#2906,SetForegroundWindow,SendMessageW,GetCommandLineW,memset,IsWindowVisible,#4124,GetLastError,SetForegroundWindow,SendMessageW,#6610,GetLastError,#6632,IsWindowVisible,PostMessageW,GetLastActivePopup,#2906,IsIconic,#6632,SetForegroundWindow,PostMessageW,PostMessageW,PostMessageW,

34_2_00007FF7D5C74CD4

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\loaddll64.exe TID: 5420

Thread sleep time: -60000s >= -30000s

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\0Nty\recdisc.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\2vl\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\9Krbbc\SppExtComObj.Exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\T6Vn91tw0\slui.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ySbBY3WaF\SndVol.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\B8nn\XmlLite.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nom\mblctr.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SB1jY1h\AtBroker.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\h1G\ACTIVEDS.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\LnjKLu\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\9Krbbc\ACTIVEDS.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\O8JNmHZW\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\T6Vn91tw0\SLC.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\O8JNmHZW\cmstp.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Mnd\wextract.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\kkXbTNX3S\wscript.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\h1G\AgentService.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\gxzS7\perfmon.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Mnd\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\0Nty\ReAgent.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\kOjpxXR\dwmapi.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\kOjpxXR\SnippingTool.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\4DETSU\FXSCOVER.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\B8nn\Dxpserver.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\byYs\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Bun\DevicePairingWizard.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\kkXbTNX3S\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\byYs\wlrmdr.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\LnjKLu\ProximityUxHost.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\2vl\LicensingUI.exe			Jump to dropped file

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF740977BC4 GetSystemTimeAsFileTime followed by cmp: cmp ebx, 01h and CTI: jne 00007FF740977CE0h

31_2_00007FF740977BC4

Queries a list of all running processes

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to query system information

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000014005C340 GetSystemInfo,

0_2_000000014005C340

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,		0_2_000000014005D290
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740981BA0 FindFirstFileExW,_wcsicmp,_wcsicmp,FindNextFileW,GetLastError,GetLastError,FindClose,		31_2_00007FF740981BA0
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF74097BE54 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,CompareStringW,FindNextFileW,FindClose,FindClose,		31_2_00007FF74097BE54
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C871B0 #626,memset,#6887,#1122,#1287,FindFirstFileW,GetLastError,#6886,#1122,#1287,#1287,#624,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,GetLastError,FindClose,#6887,#1040,SendMessageW,		34_2_00007FF7D5C871B0
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CA30D8 SendMessageW,GetLastError,wcschr,#626,#2846,FindFirstFileW,GetLastError,#1040,#626,memset,GetLastError,ReadFile,GetLastError,CloseHandle,FindNextFileW,GetLastError,FindClose,GetLastError,#1040,CloseHandle,SendMessageW,#4262,#640,#1122,#1040,#6395,#6395,		34_2_00007FF7D5CA30D8
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C7F0AC GetTempPathW,GetLastError,wcsrchr,_wcsnset,GetCurrentProcessId,FindFirstFileW,GetLastError,DeleteFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,FindClose,		34_2_00007FF7D5C7F0AC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CB89BC wcscpy_s,wcscat_s,FindFirstFileW,_wcsicmp,FindNextFileW,GetLastError,FindClose,		34_2_00007FF7D5CB89BC
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5C85B40 #626,#626,memset,memset,#6887,#620,#1122,#1040,#1287,FindFirstFileW,GetLastError,#6886,#620,#1122,#1040,#1287,#1287,#620,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,GetLastError,FindClose,#6887,#1040,#1040,SendMessageW,		34_2_00007FF7D5C85B40
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F1BC0 memset,memset,CoInitializeEx,FindFirstFileW,GetLastError,lstrcmpiW,FindNextFileW,GetLastError,GetCommandLineW,EventWrite,FindClose,CoUninitialize,LocalFree,		40_2_00007FF6EE1F1BC0
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE1F8D04 memset,memset,memset,FindFirstFileW,GetLastError,lstrcmpW,lstrcmpW,DeleteFileW,GetLastError,MoveFileExW,GetLastError,FindNextFileW,GetLastError,FindClose,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,GetLastError,LocalFree,		40_2_00007FF6EE1F8D04

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000004.00000000.273225971.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.273225971.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000004.00000000.257633536.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.257633536.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000004.00000000.265986163.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.297757063.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000004.00000000.257633536.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000004.00000000.297757063.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000004.00000000.268458783.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 00000004.00000000.298268024.0000000008C73000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oft.Mic

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF7409749DC GetCurrentThreadId,memset,IsDebuggerPresent,OutputDebugStringW,

31_2_00007FF7409749DC

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe

Code function: 34_2_00007FF7D5C84858 LoadLibraryW,GetProcAddress,FreeLibrary,

34_2_00007FF7D5C84858

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF740976BC0 WaitForSingleObjectEx,GetLastError,ReleaseMutex,SetLastError,GetProcessHeap,HeapFree,ReleaseMutex,

31_2_00007FF740976BC0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140048AC0 LdrLoadDll,FindClose,

0_2_0000000140048AC0

Contains functionality to register its own exception handler

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740983140 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		31_2_00007FF740983140
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Code function: 31_2_00007FF740982B00 SetUnhandledExceptionFilter,		31_2_00007FF740982B00
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CD48F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		34_2_00007FF7D5CD48F4
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: 34_2_00007FF7D5CD4CF0 SetUnhandledExceptionFilter,		34_2_00007FF7D5CD4CF0
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE206AA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		40_2_00007FF6EE206AA4
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Code function: 40_2_00007FF6EE206830 SetUnhandledExceptionFilter,		40_2_00007FF6EE206830

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: wer.dll.4.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\System32\loaddll64.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CEFE0 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CE000 protect: page execute read			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAC2B2A20 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CEFE0 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAE1CE000 protect: page execute read			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFFAC2B2A20 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory protected: unknown base: 7FFFAE1CEFE0 protect: page execute and read and write
Source: C:\Windows\System32\rundll32.exe	Memory protected: unknown base: 7FFFAE1CE000 protect: page execute read
Source: C:\Windows\System32\rundll32.exe	Memory protected: unknown base: 7FFFAC2B2A20 protect: page execute and read and write

DLL side loading technique detected

Source: C:\Windows\explorer.exe

Section loaded: C:\Windows\System32\wer.dll

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\System32\loaddll64.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Uses Atom Bombing / ProGate to inject into other processes

Source: C:\Windows\System32\loaddll64.exe	Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Contains functionality to execute programs as a different user

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe

Code function: 34_2_00007FF7D5CBD58C memset,memset,CredUIParseUserNameW,LogonUserW,GetLastError,DuplicateToken,GetLastError,CloseHandle,

34_2_00007FF7D5CBD58C

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\X5C9EzCB7A.dll',#1

Jump to behavior

Contains functionality to add an ACL to a security descriptor

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF74097AE50 GetFileSecurityW,GetLastError,GetFileSecurityW,GetLastError,GetSecurityDescriptorDacl,GetLastError,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetLastError,GetTokenInformation,GetLastError,SetEntriesInAclW,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,SetFileSecurityW,GetLastError,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,LocalFree,CloseHandle,

31_2_00007FF74097AE50

Contains functionality to create a new security descriptor

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF740981750 AllocateAndInitializeSid,CheckTokenMembership,RegOpenKeyExW,RegCloseKey,FreeSid,

31_2_00007FF740981750

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000004.00000000.306969877.0000000001400000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000004.00000000.306969877.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.306969877.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.306969877.0000000001400000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.263442469.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000004.00000000.297757063.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\M5A\wermgr.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\8FwY\wusa.exe	Queries volume information: unknown VolumeInformation

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: #1568,GetLocaleInfoW,GetLastError,#1471,PostMessageW,#1567,#626,#2846,		34_2_00007FF7D5CA5814
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: GetLocaleInfoEx,		34_2_00007FF7D5C7E120
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: GetUserPreferredUILanguages,GetLastError,GetUserPreferredUILanguages,GetLocaleInfoEx,free,		34_2_00007FF7D5C7DA70
Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe	Code function: #2846,GetNumberFormatW,GetLastError,GetLocaleInfoW,GetLastError,wcsstr,memset,#2846,		34_2_00007FF7D5C84934

Queries the installation date of Windows

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\AppData\Local\M5A\wermgr.exe

Code function: 31_2_00007FF740977BC4 GetSystemTimeAsFileTime,RegSetValueExW,GetLastError,RegCloseKey,

31_2_00007FF740977BC4

Contains functionality to query windows version

Source: C:\Users\user\AppData\Local\QEkvVts\WFS.exe

Code function: 34_2_00007FF7D5C748FC GetVersion,#1441,LoadIconW,GetLastError,#1471,PostMessageW,ShellAboutW,#1471,#337,#626,memset,memset,#1471,PostMessageW,#1471,#1443,#2517,#1040,#852,

34_2_00007FF7D5C748FC