Windows Analysis Report vZ1WZMpxTY

AV Detection:

Multi AV Scanner detection for submitted file

Source: vZ1WZMpxTY.dll	Virustotal: Detection: 65%			Perma Link
Source: vZ1WZMpxTY.dll	Metadefender: Detection: 62%			Perma Link
Source: vZ1WZMpxTY.dll	ReversingLabs: Detection: 75%

Antivirus / Scanner detection for submitted sample

Source: vZ1WZMpxTY.dll

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\GXNcBGCPE\XmlLite.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\3EDBT6em\MFC42u.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\GXNcBGCPE\XmlLite.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\5vkpef\WTSAPI32.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\41zCY4W\dwmapi.dll	Avira: detection malicious, Label: HEUR/AGEN.1114452
Source: C:\Users\user\AppData\Local\1QHnh\UxTheme.dll	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen

Machine Learning detection for sample

Source: vZ1WZMpxTY.dll

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\GXNcBGCPE\XmlLite.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\3EDBT6em\MFC42u.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\GXNcBGCPE\XmlLite.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\5vkpef\WTSAPI32.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\41zCY4W\dwmapi.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\1QHnh\UxTheme.dll	Joe Sandbox ML: detected

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.6:49815 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vZ1WZMpxTY.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: slui.pdb source: slui.exe, 00000014.00000000.453312108.00007FF69ED5C000.00000002.00020000.sdmp
Source:	Binary string: Magnify.pdb source: Magnify.exe, 00000020.00000000.544075713.00007FF7A1D3B000.00000002.00020000.sdmp
Source:	Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe, 0000001A.00000000.488508007.00007FF6D606F000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesAdvanced.pdb source: SystemPropertiesAdvanced.exe, 0000001C.00000000.515761449.00007FF6683D2000.00000002.00020000.sdmp
Source:	Binary string: Magnify.pdbGCTL source: Magnify.exe, 00000020.00000000.544075713.00007FF7A1D3B000.00000002.00020000.sdmp
Source:	Binary string: FileHistory.pdbGCTL source: FileHistory.exe, 00000017.00000000.480278453.00007FF7B5969000.00000002.00020000.sdmp
Source:	Binary string: PresentationHost.pdb source: PresentationHost.exe, 0000001A.00000000.488508007.00007FF6D606F000.00000002.00020000.sdmp
Source:	Binary string: slui.pdbUGP source: slui.exe, 00000014.00000000.453312108.00007FF69ED5C000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesAdvanced.pdbGCTL source: SystemPropertiesAdvanced.exe, 0000001C.00000000.515761449.00007FF6683D2000.00000002.00020000.sdmp
Source:	Binary string: FileHistory.pdb source: FileHistory.exe, 00000017.00000000.480278453.00007FF7B5969000.00000002.00020000.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,		0_2_000000014005D290
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52155D290 FindFirstFileExW,		26_2_000001B52155D290
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6061280 SHGetFolderPathW,FindFirstFileW,FindClose,GetLastError,		26_2_00007FF6D6061280
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606B2F4 FindFirstFileW,LoadLibraryExW,GetProcAddress,FreeLibrary,FindClose,		26_2_00007FF6D606B2F4

Software Vulnerabilities:

Allocates a big amount of memory (probably used for heap spraying)

Source: iexplore.exe

Memory has grown: Private usage: 2MB later: 157MB

Networking:

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443

Found strings which match to known social media urls

Source: explorer.exe, 00000008.00000000.364309790.000000000D44B000.00000004.00000001.sdmp	String found in binary or memory: :2021092920210930: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365 equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000008.00000000.382865563.0000000008430000.00000004.00000001.sdmp	String found in binary or memory: :2021092920210930: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 3650PX equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000008.00000000.382865563.0000000008430000.00000004.00000001.sdmp	String found in binary or memory: :2021092920210930: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 3656 equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000008.00000000.364309790.000000000D44B000.00000004.00000001.sdmp	String found in binary or memory: :2021092920210930: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz | Sign in Hotmail, Outlook Login, Windows Live, Office 365EB equals www.hotmail.com (Hotmail)

URLs found in memory or binary data

Source: Magnify.exe	String found in binary or memory: http://schemas.mi
Source: explorer.exe, 00000008.00000000.352012607.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000008.00000000.383215979.0000000008552000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehpM
Source: explorer.exe, 00000008.00000000.382865563.0000000008430000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehpMSN
Source: explorer.exe, 00000008.00000000.383215979.0000000008552000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehpX

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.msn.com

Contains functionality to download additional files from the internet

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_00007FF6D606BB2C CoInternetCombineUrl,CoCreateInstance,URLDownloadToCacheFileW,CoCreateInstance,

26_2_00007FF6D606BB2C

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: geolocation.onetrust.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tag?o=6208086025961472&upapi=true HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: btloader.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /lo/api/res/1.2/0XpuUmHG5cpKtbzOUv9Rmg--~A/Zmk9Zml0O3c9NjIyO2g9MzY4O2FwcGlkPWdlbWluaTtxPTEwMA--/https://s.yimg.com/av/ads/1632725880101-6365.jpg HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5Referer: https://www.msn.com/de-ch/?ocid=iehpAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: s.yimg.comConnection: Keep-Alive

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.6.139:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.248.118.22:443 -> 192.168.2.6:49815 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Potential key logger detected (key state polling based)

Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe

Code function: 32_2_00007FF7A1D15700 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,memset,SendInput,

32_2_00007FF7A1D15700

Contains functionality to retrieve information about pressed keystrokes

Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe

Code function: 32_2_00007FF7A1CF2950 GetAsyncKeyState,GetAsyncKeyState,FindWindowW,PostMessageW,CallNextHookEx,

32_2_00007FF7A1CF2950

E-Banking Fraud:

Yara detected Dridex unpacked file

Source: Yara match	File source: 0000000A.00000002.365502864.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.632076850.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.565898043.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.445132804.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.484447780.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.349426378.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.696876273.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.511241527.000001B521501000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.659564097.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371714871.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.351510328.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.592767391.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.538817965.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.475371299.0000000140001000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.358519886.0000000140001000.00000020.00020000.sdmp, type: MEMORY

System Summary:

Detected potential crypto function

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140034870		0_2_0000000140034870
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035270		0_2_0000000140035270
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140048AC0		0_2_0000000140048AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005C340		0_2_000000014005C340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140065B80		0_2_0000000140065B80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0		0_2_000000014006A4B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400524B0		0_2_00000001400524B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140026CC0		0_2_0000000140026CC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004BD40		0_2_000000014004BD40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400495B0		0_2_00000001400495B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140036F30		0_2_0000000140036F30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069010		0_2_0000000140069010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001010		0_2_0000000140001010
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140066020		0_2_0000000140066020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002F840		0_2_000000014002F840
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D850		0_2_000000014005D850
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064080		0_2_0000000140064080
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140010880		0_2_0000000140010880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400688A0		0_2_00000001400688A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002D0D0		0_2_000000014002D0D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400018D0		0_2_00000001400018D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016100		0_2_0000000140016100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D100		0_2_000000014001D100
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002A110		0_2_000000014002A110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001D910		0_2_000000014001D910
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140015120		0_2_0000000140015120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000B120		0_2_000000014000B120
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004F940		0_2_000000014004F940
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140039140		0_2_0000000140039140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023140		0_2_0000000140023140
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140057950		0_2_0000000140057950
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014001E170		0_2_000000014001E170
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140002980		0_2_0000000140002980
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400611A0		0_2_00000001400611A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400389A0		0_2_00000001400389A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400381A0		0_2_00000001400381A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002E1B0		0_2_000000014002E1B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400139D0		0_2_00000001400139D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400319F0		0_2_00000001400319F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EA00		0_2_000000014002EA00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022A00		0_2_0000000140022A00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003B220		0_2_000000014003B220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140067A40		0_2_0000000140067A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140069A50		0_2_0000000140069A50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007A60		0_2_0000000140007A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003AAC0		0_2_000000014003AAC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003A2E0		0_2_000000014003A2E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140062B00		0_2_0000000140062B00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018300		0_2_0000000140018300
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FB20		0_2_000000014002FB20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031340		0_2_0000000140031340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022340		0_2_0000000140022340
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140017B40		0_2_0000000140017B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000BB40		0_2_000000014000BB40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014004EB60		0_2_000000014004EB60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005370		0_2_0000000140005370
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002CB80		0_2_000000014002CB80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B390		0_2_000000014006B390
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140054BA0		0_2_0000000140054BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033BB0		0_2_0000000140033BB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400263C0		0_2_00000001400263C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400123C0		0_2_00000001400123C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140063BD0		0_2_0000000140063BD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400663F0		0_2_00000001400663F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023BF0		0_2_0000000140023BF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B41B		0_2_000000014006B41B
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B424		0_2_000000014006B424
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B42D		0_2_000000014006B42D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B436		0_2_000000014006B436
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B43D		0_2_000000014006B43D
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140024440		0_2_0000000140024440
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140005C40		0_2_0000000140005C40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006B446		0_2_000000014006B446
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005F490		0_2_000000014005F490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022D00		0_2_0000000140022D00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140035520		0_2_0000000140035520
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019D20		0_2_0000000140019D20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140030530		0_2_0000000140030530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140023530		0_2_0000000140023530
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031540		0_2_0000000140031540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140033540		0_2_0000000140033540
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014007BD50		0_2_000000014007BD50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140078570		0_2_0000000140078570
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140019580		0_2_0000000140019580
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400205A0		0_2_00000001400205A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140025DB0		0_2_0000000140025DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140071DC0		0_2_0000000140071DC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000C5C0		0_2_000000014000C5C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002DDE0		0_2_000000014002DDE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140031DF0		0_2_0000000140031DF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014000DDF0		0_2_000000014000DDF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140001620		0_2_0000000140001620
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018630		0_2_0000000140018630
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140032650		0_2_0000000140032650
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140064E80		0_2_0000000140064E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140016E80		0_2_0000000140016E80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140007EA0		0_2_0000000140007EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400286B0		0_2_00000001400286B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140006EB0		0_2_0000000140006EB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400276C0		0_2_00000001400276C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002FEC0		0_2_000000014002FEC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002EED0		0_2_000000014002EED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014002B6E0		0_2_000000014002B6E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140053F20		0_2_0000000140053F20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140022730		0_2_0000000140022730
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140029780		0_2_0000000140029780
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140018F80		0_2_0000000140018F80
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014003EFB0		0_2_000000014003EFB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400067B0		0_2_00000001400067B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001400667D0		0_2_00000001400667D0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140060FE0		0_2_0000000140060FE0
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED331D0		20_2_00007FF69ED331D0
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED52128		20_2_00007FF69ED52128
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED356F4		20_2_00007FF69ED356F4
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED362F4		20_2_00007FF69ED362F4
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED346C0		20_2_00007FF69ED346C0
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED342A0		20_2_00007FF69ED342A0
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED31A80		20_2_00007FF69ED31A80
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156A4B0		26_2_000001B52156A4B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215524B0		26_2_000001B5215524B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521526CC0		26_2_000001B521526CC0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521565B80		26_2_000001B521565B80
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52155C340		26_2_000001B52155C340
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521535520		26_2_000001B521535520
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52154BD40		26_2_000001B52154BD40
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215495B0		26_2_000001B5215495B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521534870		26_2_000001B521534870
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521536F30		26_2_000001B521536F30
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521535270		26_2_000001B521535270
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153B220		26_2_000001B52153B220
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153A2E0		26_2_000001B52153A2E0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521548AC0		26_2_000001B521548AC0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52155F490		26_2_000001B52155F490
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B42D		26_2_000001B52156B42D
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B41B		26_2_000001B52156B41B
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B424		26_2_000001B52156B424
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B446		26_2_000001B52156B446
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B436		26_2_000001B52156B436
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521524440		26_2_000001B521524440
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521505C40		26_2_000001B521505C40
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B43D		26_2_000001B52156B43D
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521522D00		26_2_000001B521522D00
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521505370		26_2_000001B521505370
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521579360		26_2_000001B521579360
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52154EB60		26_2_000001B52154EB60
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156B390		26_2_000001B52156B390
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152CB80		26_2_000001B52152CB80
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152FB20		26_2_000001B52152FB20
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521531340		26_2_000001B521531340
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521522340		26_2_000001B521522340
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521517B40		26_2_000001B521517B40
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52150BB40		26_2_000001B52150BB40
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521523BF0		26_2_000001B521523BF0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215663F0		26_2_000001B5215663F0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521533BB0		26_2_000001B521533BB0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521554BA0		26_2_000001B521554BA0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521563BD0		26_2_000001B521563BD0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215263C0		26_2_000001B5215263C0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215123C0		26_2_000001B5215123C0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521550E60		26_2_000001B521550E60
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521516E80		26_2_000001B521516E80
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521579681		26_2_000001B521579681
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521564E80		26_2_000001B521564E80
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521518630		26_2_000001B521518630
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521501620		26_2_000001B521501620
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521532650		26_2_000001B521532650
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152B6E0		26_2_000001B52152B6E0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215286B0		26_2_000001B5215286B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521506EB0		26_2_000001B521506EB0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521507EA0		26_2_000001B521507EA0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152EED0		26_2_000001B52152EED0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521578EBB		26_2_000001B521578EBB
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152FEC0		26_2_000001B52152FEC0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215276C0		26_2_000001B5215276C0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521578570		26_2_000001B521578570
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521519580		26_2_000001B521519580
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521530530		26_2_000001B521530530
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521523530		26_2_000001B521523530
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521519D20		26_2_000001B521519D20
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52157BD50		26_2_000001B52157BD50
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521531540		26_2_000001B521531540
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521533540		26_2_000001B521533540
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521578D3F		26_2_000001B521578D3F
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52157D5F0		26_2_000001B52157D5F0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521531DF0		26_2_000001B521531DF0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52150DDF0		26_2_000001B52150DDF0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152DDE0		26_2_000001B52152DDE0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521525DB0		26_2_000001B521525DB0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215205A0		26_2_000001B5215205A0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52150C5C0		26_2_000001B52150C5C0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521571DC0		26_2_000001B521571DC0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521510880		26_2_000001B521510880
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521564080		26_2_000001B521564080
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521566020		26_2_000001B521566020
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52155D850		26_2_000001B52155D850
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152F840		26_2_000001B52152F840
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52151D910		26_2_000001B52151D910
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152A110		26_2_000001B52152A110
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52151D100		26_2_000001B52151D100
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521516100		26_2_000001B521516100
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215688A0		26_2_000001B5215688A0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152D0D0		26_2_000001B52152D0D0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215018D0		26_2_000001B5215018D0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521529780		26_2_000001B521529780
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521518F80		26_2_000001B521518F80
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521522730		26_2_000001B521522730
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521553F20		26_2_000001B521553F20
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521560FE0		26_2_000001B521560FE0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521501010		26_2_000001B521501010
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521569010		26_2_000001B521569010
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215067B0		26_2_000001B5215067B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153EFB0		26_2_000001B52153EFB0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215667D0		26_2_000001B5215667D0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521507A60		26_2_000001B521507A60
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521569A50		26_2_000001B521569A50
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521567A40		26_2_000001B521567A40
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521518300		26_2_000001B521518300
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521562B00		26_2_000001B521562B00
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153AAC0		26_2_000001B52153AAC0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52151E170		26_2_000001B52151E170
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521502980		26_2_000001B521502980
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521515120		26_2_000001B521515120
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52150B120		26_2_000001B52150B120
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521557950		26_2_000001B521557950
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521539140		26_2_000001B521539140
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521523140		26_2_000001B521523140
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52154F940		26_2_000001B52154F940
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215319F0		26_2_000001B5215319F0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152EA00		26_2_000001B52152EA00
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521522A00		26_2_000001B521522A00
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52152E1B0		26_2_000001B52152E1B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215389A0		26_2_000001B5215389A0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215381A0		26_2_000001B5215381A0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215611A0		26_2_000001B5215611A0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B5215139D0		26_2_000001B5215139D0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52157C9D0		26_2_000001B52157C9D0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6062B60		26_2_00007FF6D6062B60
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D60687C0		26_2_00007FF6D60687C0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606487C		26_2_00007FF6D606487C
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6067CB0		26_2_00007FF6D6067CB0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606CCD0		26_2_00007FF6D606CCD0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606A0BC		26_2_00007FF6D606A0BC
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6065940		26_2_00007FF6D6065940
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6063DC8		26_2_00007FF6D6063DC8
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6066A70		26_2_00007FF6D6066A70
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6067328		26_2_00007FF6D6067328
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6061334		26_2_00007FF6D6061334
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D0EAFC		32_2_00007FF7A1D0EAFC
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D142C0		32_2_00007FF7A1D142C0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D04A9C		32_2_00007FF7A1D04A9C
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D002BC		32_2_00007FF7A1D002BC
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D05268		32_2_00007FF7A1D05268
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D12A88		32_2_00007FF7A1D12A88
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CFBA88		32_2_00007FF7A1CFBA88
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF2A00		32_2_00007FF7A1CF2A00
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D239D0		32_2_00007FF7A1D239D0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D2DCEC		32_2_00007FF7A1D2DCEC
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CFB4B4		32_2_00007FF7A1CFB4B4
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D094BC		32_2_00007FF7A1D094BC
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D0CCC0		32_2_00007FF7A1D0CCC0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D01CD0		32_2_00007FF7A1D01CD0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CFFC70		32_2_00007FF7A1CFFC70
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF8484		32_2_00007FF7A1CF8484
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D18C40		32_2_00007FF7A1D18C40
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D2BC08		32_2_00007FF7A1D2BC08
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D22BB0		32_2_00007FF7A1D22BB0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D19B44		32_2_00007FF7A1D19B44
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D27EF4		32_2_00007FF7A1D27EF4
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D0064C		32_2_00007FF7A1D0064C
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF9DEC		32_2_00007FF7A1CF9DEC
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D2A5B8		32_2_00007FF7A1D2A5B8
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D02DA4		32_2_00007FF7A1D02DA4
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF9594		32_2_00007FF7A1CF9594
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D1C560		32_2_00007FF7A1D1C560
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D0158C		32_2_00007FF7A1D0158C
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D2ED6C		32_2_00007FF7A1D2ED6C
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D218F0		32_2_00007FF7A1D218F0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D390C0		32_2_00007FF7A1D390C0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D1B0A0		32_2_00007FF7A1D1B0A0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF7864		32_2_00007FF7A1CF7864
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CFE860		32_2_00007FF7A1CFE860
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D37058		32_2_00007FF7A1D37058
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D1F070		32_2_00007FF7A1D1F070
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D20010		32_2_00007FF7A1D20010
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CFAFA8		32_2_00007FF7A1CFAFA8
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D00F34		32_2_00007FF7A1D00F34
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF5720		32_2_00007FF7A1CF5720

Contains functionality to launch a process as a different user

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_00007FF6D6064030 GetCurrentProcess,OpenProcessToken,CreateRestrictedToken,memset,GetStartupInfoW,GetCommandLineW,GetModuleFileNameW,CreateProcessAsUserW,WaitForInputIdle,CloseHandle,CloseHandle,GetLastError,CloseHandle,GetLastError,CloseHandle,GetLastError,

26_2_00007FF6D6064030

Contains functionality to call native functions

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140046C90 NtClose,		0_2_0000000140046C90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014006A4B0 NtQuerySystemInformation,RtlAllocateHeap,		0_2_000000014006A4B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521546C90 NtClose,		26_2_000001B521546C90
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52156A4B0 NtQuerySystemInformation,		26_2_000001B52156A4B0
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521525330 NtCreateSection,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,		26_2_000001B521525330
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153BC10 CreateFileMappingW,NtMapViewOfSection,NtUnmapViewOfSection,NtDuplicateObject,NtDuplicateObject,		26_2_000001B52153BC10
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521535520 RtlAddVectoredExceptionHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose,		26_2_000001B521535520
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153B220 NtReadVirtualMemory,		26_2_000001B52153B220
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52153A2E0 NtDuplicateObject,NtQueueApcThread,		26_2_000001B52153A2E0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D10BA4 NtQueryWnfStateData,		32_2_00007FF7A1D10BA4
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D06B5C NtQueryWnfStateData,RtlSubscribeWnfStateChangeNotification,GetLastError,RtlUnsubscribeWnfNotificationWaitForCompletion,SetLastError,		32_2_00007FF7A1D06B5C

PE file contains strange resources

Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: slui.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FileHistory.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FileHistory.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FileHistory.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FileHistory.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FileHistory.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FileHistory.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: PresentationHost.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesAdvanced.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesAdvanced.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SystemPropertiesAdvanced.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Magnify.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Magnify.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Magnify.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: msinfo32.exe.8.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Windows\System32\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

PE file contains more sections than normal

Source: WTSAPI32.dll.8.dr	Static PE information: Number of sections : 38 > 10
Source: WINSTA.dll.8.dr	Static PE information: Number of sections : 38 > 10
Source: vZ1WZMpxTY.dll	Static PE information: Number of sections : 37 > 10
Source: SYSDM.CPL.8.dr	Static PE information: Number of sections : 38 > 10
Source: VERSION.dll.8.dr	Static PE information: Number of sections : 38 > 10
Source: XmlLite.dll.8.dr	Static PE information: Number of sections : 38 > 10
Source: OLEACC.dll.8.dr	Static PE information: Number of sections : 38 > 10
Source: UxTheme.dll.8.dr	Static PE information: Number of sections : 38 > 10
Source: MFC42u.dll.8.dr	Static PE information: Number of sections : 38 > 10

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: vZ1WZMpxTY.dll	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WTSAPI32.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UxTheme.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: VERSION.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SYSDM.CPL.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: OLEACC.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: XmlLite.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: MFC42u.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: WINSTA.dll.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: vZ1WZMpxTY.dll	Virustotal: Detection: 65%
Source: vZ1WZMpxTY.dll	Metadefender: Detection: 62%
Source: vZ1WZMpxTY.dll	ReversingLabs: Detection: 75%

PE file has an executable .text section and no other executable section

Source: vZ1WZMpxTY.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll'
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\vZ1WZMpxTY.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll',#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vZ1WZMpxTY.dll,BeginBufferedAnimation
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vZ1WZMpxTY.dll,BeginBufferedPaint
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vZ1WZMpxTY.dll,BeginPanningFeedback
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\slui.exe C:\Windows\system32\slui.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\qklwjLaE\slui.exe C:\Users\user\AppData\Local\qklwjLaE\slui.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\FileHistory.exe C:\Windows\system32\FileHistory.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe C:\Users\user\AppData\Local\1QHnh\FileHistory.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\PresentationHost.exe C:\Windows\system32\PresentationHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe C:\Users\user\AppData\Local\gKsll\PresentationHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesAdvanced.exe C:\Windows\system32\SystemPropertiesAdvanced.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\Magnify.exe C:\Windows\system32\Magnify.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe C:\Users\user\AppData\Local\N8qUdj\Magnify.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\omadmclient.exe C:\Windows\system32\omadmclient.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\MfH2kGhD\omadmclient.exe C:\Users\user\AppData\Local\MfH2kGhD\omadmclient.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\3EDBT6em\msinfo32.exe C:\Users\user\AppData\Local\3EDBT6em\msinfo32.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\RdpSa.exe C:\Windows\system32\RdpSa.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\px153\RdpSa.exe C:\Users\user\AppData\Local\px153\RdpSa.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\PasswordOnWakeSettingFlyout.exe C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\rM4q\PasswordOnWakeSettingFlyout.exe C:\Users\user\AppData\Local\rM4q\PasswordOnWakeSettingFlyout.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll',#1			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\vZ1WZMpxTY.dll			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vZ1WZMpxTY.dll,BeginBufferedAnimation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vZ1WZMpxTY.dll,BeginBufferedPaint			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\vZ1WZMpxTY.dll,BeginPanningFeedback			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll',#1			Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2288 CREDAT:17410 /prefetch:2			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\slui.exe C:\Windows\system32\slui.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\qklwjLaE\slui.exe C:\Users\user\AppData\Local\qklwjLaE\slui.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\FileHistory.exe C:\Windows\system32\FileHistory.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe C:\Users\user\AppData\Local\1QHnh\FileHistory.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\PresentationHost.exe C:\Windows\system32\PresentationHost.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe C:\Users\user\AppData\Local\gKsll\PresentationHost.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\SystemPropertiesAdvanced.exe C:\Windows\system32\SystemPropertiesAdvanced.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\Magnify.exe C:\Windows\system32\Magnify.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe C:\Users\user\AppData\Local\N8qUdj\Magnify.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\omadmclient.exe C:\Windows\system32\omadmclient.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\MfH2kGhD\omadmclient.exe C:\Users\user\AppData\Local\MfH2kGhD\omadmclient.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\msinfo32.exe C:\Windows\system32\msinfo32.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\3EDBT6em\msinfo32.exe C:\Users\user\AppData\Local\3EDBT6em\msinfo32.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\RdpSa.exe C:\Windows\system32\RdpSa.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\px153\RdpSa.exe C:\Users\user\AppData\Local\px153\RdpSa.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\PasswordOnWakeSettingFlyout.exe C:\Windows\system32\PasswordOnWakeSettingFlyout.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\rM4q\PasswordOnWakeSettingFlyout.exe C:\Users\user\AppData\Local\rM4q\PasswordOnWakeSettingFlyout.exe			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1A69F8BE-20FD-11EC-90E5-ECF4BB2D2496}.dat

Jump to behavior

Creates temporary files

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF9E1A0A52EBCE6F97.TMP

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winDLL@59/109@11/4

Contains functionality to instantiate COM classes

Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe

Code function: 20_2_00007FF69ED3687C CoCreateInstance,

20_2_00007FF69ED3687C

Reads ini files

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Contains functionality to enum processes or threads

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_000001B52153C240 GetProcessId,CreateToolhelp32Snapshot,Thread32First,

26_2_000001B52153C240

Runs a DLL by calling functions

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll',#1

Creates mutexes

Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Mutant created: \Sessions\1\BaseNamedObjects\{b4fe735d-1a92-66ad-0bff-6d7db6afbc9f}
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Mutant created: \Sessions\1\BaseNamedObjects\{4baa440b-b993-bda0-a2c0-ecb41388489f}

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_00007FF6D6067CB0 LoadLibraryExW,FindResourceExW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,free,free,

26_2_00007FF6D6067CB0

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE file has a high image base, often used for DLLs

Source: vZ1WZMpxTY.dll

Static PE information: Image base 0x140000000 > 0x60000000

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Submission file is bigger than most known malware samples

Source: vZ1WZMpxTY.dll

Static file information: File size 2093056 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: vZ1WZMpxTY.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Source:	Binary string: slui.pdb source: slui.exe, 00000014.00000000.453312108.00007FF69ED5C000.00000002.00020000.sdmp
Source:	Binary string: Magnify.pdb source: Magnify.exe, 00000020.00000000.544075713.00007FF7A1D3B000.00000002.00020000.sdmp
Source:	Binary string: PresentationHost.pdbGCTL source: PresentationHost.exe, 0000001A.00000000.488508007.00007FF6D606F000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesAdvanced.pdb source: SystemPropertiesAdvanced.exe, 0000001C.00000000.515761449.00007FF6683D2000.00000002.00020000.sdmp
Source:	Binary string: Magnify.pdbGCTL source: Magnify.exe, 00000020.00000000.544075713.00007FF7A1D3B000.00000002.00020000.sdmp
Source:	Binary string: FileHistory.pdbGCTL source: FileHistory.exe, 00000017.00000000.480278453.00007FF7B5969000.00000002.00020000.sdmp
Source:	Binary string: PresentationHost.pdb source: PresentationHost.exe, 0000001A.00000000.488508007.00007FF6D606F000.00000002.00020000.sdmp
Source:	Binary string: slui.pdbUGP source: slui.exe, 00000014.00000000.453312108.00007FF69ED5C000.00000002.00020000.sdmp
Source:	Binary string: SystemPropertiesAdvanced.pdbGCTL source: SystemPropertiesAdvanced.exe, 0000001C.00000000.515761449.00007FF6683D2000.00000002.00020000.sdmp
Source:	Binary string: FileHistory.pdb source: FileHistory.exe, 00000017.00000000.480278453.00007FF7B5969000.00000002.00020000.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000140056A4D push rdi; ret		0_2_0000000140056A4E
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521556A4D push rdi; ret		26_2_000001B521556A4E

PE file contains sections with non-standard names

Source: vZ1WZMpxTY.dll	Static PE information: section name: .qkm
Source: vZ1WZMpxTY.dll	Static PE information: section name: .cvjb
Source: vZ1WZMpxTY.dll	Static PE information: section name: .tlmkv
Source: vZ1WZMpxTY.dll	Static PE information: section name: .wucsxe
Source: vZ1WZMpxTY.dll	Static PE information: section name: .fltwtj
Source: vZ1WZMpxTY.dll	Static PE information: section name: .sfplio
Source: vZ1WZMpxTY.dll	Static PE information: section name: .rpg
Source: vZ1WZMpxTY.dll	Static PE information: section name: .bewzc
Source: vZ1WZMpxTY.dll	Static PE information: section name: .vksvaw
Source: vZ1WZMpxTY.dll	Static PE information: section name: .wmhg
Source: vZ1WZMpxTY.dll	Static PE information: section name: .nfuu
Source: vZ1WZMpxTY.dll	Static PE information: section name: .cqcgue
Source: vZ1WZMpxTY.dll	Static PE information: section name: .edydzn
Source: vZ1WZMpxTY.dll	Static PE information: section name: .fgoks
Source: vZ1WZMpxTY.dll	Static PE information: section name: .fdf
Source: vZ1WZMpxTY.dll	Static PE information: section name: .vlyui
Source: vZ1WZMpxTY.dll	Static PE information: section name: .onihaq
Source: vZ1WZMpxTY.dll	Static PE information: section name: .dnoygv
Source: vZ1WZMpxTY.dll	Static PE information: section name: .ejopd
Source: vZ1WZMpxTY.dll	Static PE information: section name: .ech
Source: vZ1WZMpxTY.dll	Static PE information: section name: .euhsb
Source: vZ1WZMpxTY.dll	Static PE information: section name: .tym
Source: vZ1WZMpxTY.dll	Static PE information: section name: .nhtbzp
Source: vZ1WZMpxTY.dll	Static PE information: section name: .ujern
Source: vZ1WZMpxTY.dll	Static PE information: section name: .cuhy
Source: vZ1WZMpxTY.dll	Static PE information: section name: .qqrro
Source: vZ1WZMpxTY.dll	Static PE information: section name: .mcqw
Source: vZ1WZMpxTY.dll	Static PE information: section name: .xvhbg
Source: vZ1WZMpxTY.dll	Static PE information: section name: .pjphmh
Source: vZ1WZMpxTY.dll	Static PE information: section name: .lgwynn
Source: vZ1WZMpxTY.dll	Static PE information: section name: .dyw
Source: FileHistory.exe.8.dr	Static PE information: section name: .nep
Source: omadmclient.exe.8.dr	Static PE information: section name: .didat
Source: PasswordOnWakeSettingFlyout.exe.8.dr	Static PE information: section name: .imrsiv
Source: DisplaySwitch.exe.8.dr	Static PE information: section name: .imrsiv
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .qkm
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .cvjb
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .tlmkv
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .wucsxe
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .fltwtj
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .sfplio
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .rpg
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .bewzc
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .vksvaw
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .wmhg
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .nfuu
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .cqcgue
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .edydzn
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .fgoks
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .fdf
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .vlyui
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .onihaq
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .dnoygv
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .ejopd
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .ech
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .euhsb
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .tym
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .nhtbzp
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .ujern
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .cuhy
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .qqrro
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .mcqw
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .xvhbg
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .pjphmh
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .lgwynn
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .dyw
Source: WTSAPI32.dll.8.dr	Static PE information: section name: .jptrj
Source: UxTheme.dll.8.dr	Static PE information: section name: .qkm
Source: UxTheme.dll.8.dr	Static PE information: section name: .cvjb
Source: UxTheme.dll.8.dr	Static PE information: section name: .tlmkv
Source: UxTheme.dll.8.dr	Static PE information: section name: .wucsxe
Source: UxTheme.dll.8.dr	Static PE information: section name: .fltwtj
Source: UxTheme.dll.8.dr	Static PE information: section name: .sfplio
Source: UxTheme.dll.8.dr	Static PE information: section name: .rpg
Source: UxTheme.dll.8.dr	Static PE information: section name: .bewzc
Source: UxTheme.dll.8.dr	Static PE information: section name: .vksvaw
Source: UxTheme.dll.8.dr	Static PE information: section name: .wmhg
Source: UxTheme.dll.8.dr	Static PE information: section name: .nfuu
Source: UxTheme.dll.8.dr	Static PE information: section name: .cqcgue
Source: UxTheme.dll.8.dr	Static PE information: section name: .edydzn
Source: UxTheme.dll.8.dr	Static PE information: section name: .fgoks
Source: UxTheme.dll.8.dr	Static PE information: section name: .fdf
Source: UxTheme.dll.8.dr	Static PE information: section name: .vlyui
Source: UxTheme.dll.8.dr	Static PE information: section name: .onihaq
Source: UxTheme.dll.8.dr	Static PE information: section name: .dnoygv
Source: UxTheme.dll.8.dr	Static PE information: section name: .ejopd
Source: UxTheme.dll.8.dr	Static PE information: section name: .ech
Source: UxTheme.dll.8.dr	Static PE information: section name: .euhsb
Source: UxTheme.dll.8.dr	Static PE information: section name: .tym
Source: UxTheme.dll.8.dr	Static PE information: section name: .nhtbzp
Source: UxTheme.dll.8.dr	Static PE information: section name: .ujern
Source: UxTheme.dll.8.dr	Static PE information: section name: .cuhy
Source: UxTheme.dll.8.dr	Static PE information: section name: .qqrro
Source: UxTheme.dll.8.dr	Static PE information: section name: .mcqw
Source: UxTheme.dll.8.dr	Static PE information: section name: .xvhbg
Source: UxTheme.dll.8.dr	Static PE information: section name: .pjphmh
Source: UxTheme.dll.8.dr	Static PE information: section name: .lgwynn
Source: UxTheme.dll.8.dr	Static PE information: section name: .dyw
Source: UxTheme.dll.8.dr	Static PE information: section name: .lrzd
Source: VERSION.dll.8.dr	Static PE information: section name: .qkm
Source: VERSION.dll.8.dr	Static PE information: section name: .cvjb
Source: VERSION.dll.8.dr	Static PE information: section name: .tlmkv
Source: VERSION.dll.8.dr	Static PE information: section name: .wucsxe
Source: VERSION.dll.8.dr	Static PE information: section name: .fltwtj
Source: VERSION.dll.8.dr	Static PE information: section name: .sfplio
Source: VERSION.dll.8.dr	Static PE information: section name: .rpg
Source: VERSION.dll.8.dr	Static PE information: section name: .bewzc
Source: VERSION.dll.8.dr	Static PE information: section name: .vksvaw
Source: VERSION.dll.8.dr	Static PE information: section name: .wmhg
Source: VERSION.dll.8.dr	Static PE information: section name: .nfuu
Source: VERSION.dll.8.dr	Static PE information: section name: .cqcgue
Source: VERSION.dll.8.dr	Static PE information: section name: .edydzn
Source: VERSION.dll.8.dr	Static PE information: section name: .fgoks
Source: VERSION.dll.8.dr	Static PE information: section name: .fdf
Source: VERSION.dll.8.dr	Static PE information: section name: .vlyui
Source: VERSION.dll.8.dr	Static PE information: section name: .onihaq
Source: VERSION.dll.8.dr	Static PE information: section name: .dnoygv
Source: VERSION.dll.8.dr	Static PE information: section name: .ejopd
Source: VERSION.dll.8.dr	Static PE information: section name: .ech
Source: VERSION.dll.8.dr	Static PE information: section name: .euhsb
Source: VERSION.dll.8.dr	Static PE information: section name: .tym
Source: VERSION.dll.8.dr	Static PE information: section name: .nhtbzp
Source: VERSION.dll.8.dr	Static PE information: section name: .ujern
Source: VERSION.dll.8.dr	Static PE information: section name: .cuhy
Source: VERSION.dll.8.dr	Static PE information: section name: .qqrro
Source: VERSION.dll.8.dr	Static PE information: section name: .mcqw
Source: VERSION.dll.8.dr	Static PE information: section name: .xvhbg
Source: VERSION.dll.8.dr	Static PE information: section name: .pjphmh
Source: VERSION.dll.8.dr	Static PE information: section name: .lgwynn
Source: VERSION.dll.8.dr	Static PE information: section name: .dyw
Source: VERSION.dll.8.dr	Static PE information: section name: .ozhu
Source: SYSDM.CPL.8.dr	Static PE information: section name: .qkm
Source: SYSDM.CPL.8.dr	Static PE information: section name: .cvjb
Source: SYSDM.CPL.8.dr	Static PE information: section name: .tlmkv
Source: SYSDM.CPL.8.dr	Static PE information: section name: .wucsxe
Source: SYSDM.CPL.8.dr	Static PE information: section name: .fltwtj
Source: SYSDM.CPL.8.dr	Static PE information: section name: .sfplio
Source: SYSDM.CPL.8.dr	Static PE information: section name: .rpg
Source: SYSDM.CPL.8.dr	Static PE information: section name: .bewzc
Source: SYSDM.CPL.8.dr	Static PE information: section name: .vksvaw
Source: SYSDM.CPL.8.dr	Static PE information: section name: .wmhg
Source: SYSDM.CPL.8.dr	Static PE information: section name: .nfuu
Source: SYSDM.CPL.8.dr	Static PE information: section name: .cqcgue
Source: SYSDM.CPL.8.dr	Static PE information: section name: .edydzn
Source: SYSDM.CPL.8.dr	Static PE information: section name: .fgoks
Source: SYSDM.CPL.8.dr	Static PE information: section name: .fdf
Source: SYSDM.CPL.8.dr	Static PE information: section name: .vlyui
Source: SYSDM.CPL.8.dr	Static PE information: section name: .onihaq
Source: SYSDM.CPL.8.dr	Static PE information: section name: .dnoygv
Source: SYSDM.CPL.8.dr	Static PE information: section name: .ejopd
Source: SYSDM.CPL.8.dr	Static PE information: section name: .ech
Source: SYSDM.CPL.8.dr	Static PE information: section name: .euhsb
Source: SYSDM.CPL.8.dr	Static PE information: section name: .tym
Source: SYSDM.CPL.8.dr	Static PE information: section name: .nhtbzp
Source: SYSDM.CPL.8.dr	Static PE information: section name: .ujern
Source: SYSDM.CPL.8.dr	Static PE information: section name: .cuhy
Source: SYSDM.CPL.8.dr	Static PE information: section name: .qqrro
Source: SYSDM.CPL.8.dr	Static PE information: section name: .mcqw
Source: SYSDM.CPL.8.dr	Static PE information: section name: .xvhbg
Source: SYSDM.CPL.8.dr	Static PE information: section name: .pjphmh
Source: SYSDM.CPL.8.dr	Static PE information: section name: .lgwynn
Source: SYSDM.CPL.8.dr	Static PE information: section name: .dyw
Source: SYSDM.CPL.8.dr	Static PE information: section name: .fhntj
Source: OLEACC.dll.8.dr	Static PE information: section name: .qkm
Source: OLEACC.dll.8.dr	Static PE information: section name: .cvjb
Source: OLEACC.dll.8.dr	Static PE information: section name: .tlmkv
Source: OLEACC.dll.8.dr	Static PE information: section name: .wucsxe
Source: OLEACC.dll.8.dr	Static PE information: section name: .fltwtj
Source: OLEACC.dll.8.dr	Static PE information: section name: .sfplio
Source: OLEACC.dll.8.dr	Static PE information: section name: .rpg
Source: OLEACC.dll.8.dr	Static PE information: section name: .bewzc
Source: OLEACC.dll.8.dr	Static PE information: section name: .vksvaw
Source: OLEACC.dll.8.dr	Static PE information: section name: .wmhg
Source: OLEACC.dll.8.dr	Static PE information: section name: .nfuu
Source: OLEACC.dll.8.dr	Static PE information: section name: .cqcgue
Source: OLEACC.dll.8.dr	Static PE information: section name: .edydzn
Source: OLEACC.dll.8.dr	Static PE information: section name: .fgoks
Source: OLEACC.dll.8.dr	Static PE information: section name: .fdf
Source: OLEACC.dll.8.dr	Static PE information: section name: .vlyui
Source: OLEACC.dll.8.dr	Static PE information: section name: .onihaq
Source: OLEACC.dll.8.dr	Static PE information: section name: .dnoygv
Source: OLEACC.dll.8.dr	Static PE information: section name: .ejopd
Source: OLEACC.dll.8.dr	Static PE information: section name: .ech
Source: OLEACC.dll.8.dr	Static PE information: section name: .euhsb
Source: OLEACC.dll.8.dr	Static PE information: section name: .tym
Source: OLEACC.dll.8.dr	Static PE information: section name: .nhtbzp
Source: OLEACC.dll.8.dr	Static PE information: section name: .ujern
Source: OLEACC.dll.8.dr	Static PE information: section name: .cuhy
Source: OLEACC.dll.8.dr	Static PE information: section name: .qqrro
Source: OLEACC.dll.8.dr	Static PE information: section name: .mcqw
Source: OLEACC.dll.8.dr	Static PE information: section name: .xvhbg
Source: OLEACC.dll.8.dr	Static PE information: section name: .pjphmh
Source: OLEACC.dll.8.dr	Static PE information: section name: .lgwynn
Source: OLEACC.dll.8.dr	Static PE information: section name: .dyw
Source: OLEACC.dll.8.dr	Static PE information: section name: .oxe
Source: XmlLite.dll.8.dr	Static PE information: section name: .qkm
Source: XmlLite.dll.8.dr	Static PE information: section name: .cvjb
Source: XmlLite.dll.8.dr	Static PE information: section name: .tlmkv
Source: XmlLite.dll.8.dr	Static PE information: section name: .wucsxe
Source: XmlLite.dll.8.dr	Static PE information: section name: .fltwtj
Source: XmlLite.dll.8.dr	Static PE information: section name: .sfplio
Source: XmlLite.dll.8.dr	Static PE information: section name: .rpg
Source: XmlLite.dll.8.dr	Static PE information: section name: .bewzc
Source: XmlLite.dll.8.dr	Static PE information: section name: .vksvaw
Source: XmlLite.dll.8.dr	Static PE information: section name: .wmhg
Source: XmlLite.dll.8.dr	Static PE information: section name: .nfuu
Source: XmlLite.dll.8.dr	Static PE information: section name: .cqcgue
Source: XmlLite.dll.8.dr	Static PE information: section name: .edydzn
Source: XmlLite.dll.8.dr	Static PE information: section name: .fgoks
Source: XmlLite.dll.8.dr	Static PE information: section name: .fdf
Source: XmlLite.dll.8.dr	Static PE information: section name: .vlyui
Source: XmlLite.dll.8.dr	Static PE information: section name: .onihaq
Source: XmlLite.dll.8.dr	Static PE information: section name: .dnoygv
Source: XmlLite.dll.8.dr	Static PE information: section name: .ejopd
Source: XmlLite.dll.8.dr	Static PE information: section name: .ech
Source: XmlLite.dll.8.dr	Static PE information: section name: .euhsb
Source: XmlLite.dll.8.dr	Static PE information: section name: .tym
Source: XmlLite.dll.8.dr	Static PE information: section name: .nhtbzp
Source: XmlLite.dll.8.dr	Static PE information: section name: .ujern
Source: XmlLite.dll.8.dr	Static PE information: section name: .cuhy
Source: XmlLite.dll.8.dr	Static PE information: section name: .qqrro
Source: XmlLite.dll.8.dr	Static PE information: section name: .mcqw
Source: XmlLite.dll.8.dr	Static PE information: section name: .xvhbg
Source: XmlLite.dll.8.dr	Static PE information: section name: .pjphmh
Source: XmlLite.dll.8.dr	Static PE information: section name: .lgwynn
Source: XmlLite.dll.8.dr	Static PE information: section name: .dyw
Source: XmlLite.dll.8.dr	Static PE information: section name: .bxz
Source: MFC42u.dll.8.dr	Static PE information: section name: .qkm
Source: MFC42u.dll.8.dr	Static PE information: section name: .cvjb
Source: MFC42u.dll.8.dr	Static PE information: section name: .tlmkv
Source: MFC42u.dll.8.dr	Static PE information: section name: .wucsxe
Source: MFC42u.dll.8.dr	Static PE information: section name: .fltwtj
Source: MFC42u.dll.8.dr	Static PE information: section name: .sfplio
Source: MFC42u.dll.8.dr	Static PE information: section name: .rpg
Source: MFC42u.dll.8.dr	Static PE information: section name: .bewzc
Source: MFC42u.dll.8.dr	Static PE information: section name: .vksvaw
Source: MFC42u.dll.8.dr	Static PE information: section name: .wmhg
Source: MFC42u.dll.8.dr	Static PE information: section name: .nfuu
Source: MFC42u.dll.8.dr	Static PE information: section name: .cqcgue
Source: MFC42u.dll.8.dr	Static PE information: section name: .edydzn
Source: MFC42u.dll.8.dr	Static PE information: section name: .fgoks
Source: MFC42u.dll.8.dr	Static PE information: section name: .fdf
Source: MFC42u.dll.8.dr	Static PE information: section name: .vlyui
Source: MFC42u.dll.8.dr	Static PE information: section name: .onihaq
Source: MFC42u.dll.8.dr	Static PE information: section name: .dnoygv
Source: MFC42u.dll.8.dr	Static PE information: section name: .ejopd
Source: MFC42u.dll.8.dr	Static PE information: section name: .ech
Source: MFC42u.dll.8.dr	Static PE information: section name: .euhsb
Source: MFC42u.dll.8.dr	Static PE information: section name: .tym
Source: MFC42u.dll.8.dr	Static PE information: section name: .nhtbzp
Source: MFC42u.dll.8.dr	Static PE information: section name: .ujern
Source: MFC42u.dll.8.dr	Static PE information: section name: .cuhy
Source: MFC42u.dll.8.dr	Static PE information: section name: .qqrro
Source: MFC42u.dll.8.dr	Static PE information: section name: .mcqw
Source: MFC42u.dll.8.dr	Static PE information: section name: .xvhbg
Source: MFC42u.dll.8.dr	Static PE information: section name: .pjphmh
Source: MFC42u.dll.8.dr	Static PE information: section name: .lgwynn
Source: MFC42u.dll.8.dr	Static PE information: section name: .dyw
Source: MFC42u.dll.8.dr	Static PE information: section name: .fefwo
Source: WINSTA.dll.8.dr	Static PE information: section name: .qkm
Source: WINSTA.dll.8.dr	Static PE information: section name: .cvjb
Source: WINSTA.dll.8.dr	Static PE information: section name: .tlmkv
Source: WINSTA.dll.8.dr	Static PE information: section name: .wucsxe
Source: WINSTA.dll.8.dr	Static PE information: section name: .fltwtj
Source: WINSTA.dll.8.dr	Static PE information: section name: .sfplio
Source: WINSTA.dll.8.dr	Static PE information: section name: .rpg
Source: WINSTA.dll.8.dr	Static PE information: section name: .bewzc
Source: WINSTA.dll.8.dr	Static PE information: section name: .vksvaw
Source: WINSTA.dll.8.dr	Static PE information: section name: .wmhg
Source: WINSTA.dll.8.dr	Static PE information: section name: .nfuu
Source: WINSTA.dll.8.dr	Static PE information: section name: .cqcgue
Source: WINSTA.dll.8.dr	Static PE information: section name: .edydzn
Source: WINSTA.dll.8.dr	Static PE information: section name: .fgoks
Source: WINSTA.dll.8.dr	Static PE information: section name: .fdf
Source: WINSTA.dll.8.dr	Static PE information: section name: .vlyui
Source: WINSTA.dll.8.dr	Static PE information: section name: .onihaq
Source: WINSTA.dll.8.dr	Static PE information: section name: .dnoygv
Source: WINSTA.dll.8.dr	Static PE information: section name: .ejopd
Source: WINSTA.dll.8.dr	Static PE information: section name: .ech
Source: WINSTA.dll.8.dr	Static PE information: section name: .euhsb
Source: WINSTA.dll.8.dr	Static PE information: section name: .tym
Source: WINSTA.dll.8.dr	Static PE information: section name: .nhtbzp
Source: WINSTA.dll.8.dr	Static PE information: section name: .ujern
Source: WINSTA.dll.8.dr	Static PE information: section name: .cuhy
Source: WINSTA.dll.8.dr	Static PE information: section name: .qqrro
Source: WINSTA.dll.8.dr	Static PE information: section name: .mcqw
Source: WINSTA.dll.8.dr	Static PE information: section name: .xvhbg
Source: WINSTA.dll.8.dr	Static PE information: section name: .pjphmh
Source: WINSTA.dll.8.dr	Static PE information: section name: .lgwynn
Source: WINSTA.dll.8.dr	Static PE information: section name: .dyw
Source: WINSTA.dll.8.dr	Static PE information: section name: .cprp

PE file contains an invalid checksum

Source: WTSAPI32.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20fbb5
Source: WINSTA.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x208be1
Source: vZ1WZMpxTY.dll	Static PE information: real checksum: 0x7d786c40 should be: 0x20dc17
Source: SYSDM.CPL.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20e653
Source: VERSION.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x205a32
Source: XmlLite.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x20e9b1
Source: OLEACC.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x206a01
Source: UxTheme.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x2052bd
Source: MFC42u.dll.8.dr	Static PE information: real checksum: 0x7d786c40 should be: 0x206c72

Binary contains a suspicious time stamp

Source: slui.exe.8.dr

Static PE information: 0x7B68B14F [Sat Aug 11 15:25:03 2035 UTC]

Registers a DLL

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\vZ1WZMpxTY.dll

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679
Source: initial sample	Static PE information: section name: .text entropy: 7.73364605679

Persistence and Installation Behavior:

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\rUhH1WSzx\SYSDM.CPL

Jump to dropped file

Drops PE files

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\3EDBT6em\MFC42u.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\px153\RdpSa.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\MfH2kGhD\omadmclient.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\qklwjLaE\WTSAPI32.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\MfH2kGhD\XmlLite.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rM4q\DUI70.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rUhH1WSzx\SYSDM.CPL			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\GXNcBGCPE\XmlLite.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\N8qUdj\OLEACC.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\GXNcBGCPE\printfilterpipelinesvc.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\5vkpef\WTSAPI32.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rM4q\PasswordOnWakeSettingFlyout.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\3EDBT6em\msinfo32.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\1QHnh\UxTheme.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\gKsll\VERSION.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\5vkpef\BdeUISrv.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\px153\WINSTA.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\41zCY4W\DisplaySwitch.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\41zCY4W\dwmapi.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\qklwjLaE\slui.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D01CD0 SendMessageW,SetEvent,?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ,StrToID,?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z,?SetContentString@Element@DirectUI@@QEAAJPEBG@Z,IsIconic,GetWindowRect,WinSqmAddToStream,CoCreateInstance,PostMessageW,SendMessageW,SetWindowPos,SetForegroundWindow,PostMessageW,		32_2_00007FF7A1D01CD0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D02480 SetWindowPos,KillTimer,ShowWindow,ShowWindow,KillTimer,SetLayeredWindowAttributes,IsIconic,GetForegroundWindow,GetCapture,KillTimer,KillTimer,KillTimer,KillTimer,		32_2_00007FF7A1D02480
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D018AC IsRectEmpty,IsRectEmpty,IsRectEmpty,IsIconic,GetCapture,GetPhysicalCursorPos,GetWindowRect,PtInRect,SetWindowPos,GetForegroundWindow,		32_2_00007FF7A1D018AC
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D0386C IsIconic,		32_2_00007FF7A1D0386C
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D017DC IsIconic,GetWindowRect,PtInRect,GetCapture,GetWindowRect,PtInRect,		32_2_00007FF7A1D017DC

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 5032

Thread sleep count: 44 > 30

Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\3EDBT6em\MFC42u.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MfH2kGhD\XmlLite.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\GXNcBGCPE\XmlLite.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\GXNcBGCPE\printfilterpipelinesvc.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\5vkpef\BdeUISrv.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\px153\WINSTA.dll			Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\41zCY4W\DisplaySwitch.exe			Jump to dropped file

Queries a list of all running processes

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to query system information

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000014005C340 GetSystemInfo,

0_2_000000014005C340

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000014005D290 FindFirstFileExW,		0_2_000000014005D290
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B52155D290 FindFirstFileExW,		26_2_000001B52155D290
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6061280 SHGetFolderPathW,FindFirstFileW,FindClose,GetLastError,		26_2_00007FF6D6061280
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606B2F4 FindFirstFileW,LoadLibraryExW,GetProcAddress,FreeLibrary,FindClose,		26_2_00007FF6D606B2F4

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000008.00000000.361844666.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000008.00000000.382865563.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000008.00000000.374004308.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.361844666.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000008.00000000.374004308.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.382659655.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000008.00000000.382659655.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000008.00000000.382865563.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000008.00000000.352012607.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_00007FF6D606487C HeapSetInformation,GetModuleHandleW,GetProcAddress,RegisterTraceGuidsW,OutputDebugStringW,CoInitialize,CoInitialize,IsDebuggerPresent,RegOpenKeyExW,RegCloseKey,CreateTimerQueueTimer,GetLastError,CoInitialize,OpenEventW,SetEvent,CloseHandle,TranslateMessage,DispatchMessageW,GetMessageW,GetModuleHandleW,GetModuleHandleW,CoEEShutDownCOM,CoUninitialize,

26_2_00007FF6D606487C

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_00007FF6D606487C HeapSetInformation,GetModuleHandleW,GetProcAddress,RegisterTraceGuidsW,OutputDebugStringW,CoInitialize,CoInitialize,IsDebuggerPresent,RegOpenKeyExW,RegCloseKey,CreateTimerQueueTimer,GetLastError,CoInitialize,OpenEventW,SetEvent,CloseHandle,TranslateMessage,DispatchMessageW,GetMessageW,GetModuleHandleW,GetModuleHandleW,CoEEShutDownCOM,CoUninitialize,

26_2_00007FF6D606487C

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe

Code function: 20_2_00007FF69ED3202C GetProcessHeap,HeapFree,

20_2_00007FF69ED3202C

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000140048AC0 LdrLoadDll,FindClose,

0_2_0000000140048AC0

Creates guard pages, often used to prevent reverse usering and debugging

Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe

Memory allocated: page read and write | page guard

Contains functionality to register its own exception handler

Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED4D918 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		20_2_00007FF69ED4D918
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Code function: 23_2_00007FF7B5967570 SetUnhandledExceptionFilter,		23_2_00007FF7B5967570
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Code function: 23_2_00007FF7B59677EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		23_2_00007FF7B59677EC
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_000001B521535520 RtlAddVectoredExceptionHandler,VirtualProtect,VirtualProtect,RtlCreateUserThread,NtClose,		26_2_000001B521535520
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606DC70 SetUnhandledExceptionFilter,		26_2_00007FF6D606DC70
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D606D964 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		26_2_00007FF6D606D964
Source: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe	Code function: 28_2_00007FF6683D16B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		28_2_00007FF6683D16B4
Source: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe	Code function: 28_2_00007FF6683D1430 SetUnhandledExceptionFilter,		28_2_00007FF6683D1430
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D38274 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		32_2_00007FF7A1D38274
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D38CB8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		32_2_00007FF7A1D38CB8
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1D38E94 SetUnhandledExceptionFilter,		32_2_00007FF7A1D38E94

HIPS / PFW / Operating System Protection Evasion:

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: WTSAPI32.dll.8.dr

Jump to dropped file

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\System32\regsvr32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFD88ECEFE0 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFD88ECE000 protect: page execute read			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory protected: C:\Windows\explorer.exe base: 7FFD88912A20 protect: page execute and read and write			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\System32\regsvr32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Uses Atom Bombing / ProGate to inject into other processes

Source: C:\Windows\System32\regsvr32.exe

Atom created: 405553565741544156488D6C24D14881EC98 0x00000000 inc eax 0x00000001 push ebp 0x00000002 push ebx 0x00000003 push esi 0x00000004 push edi 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 push esi 0x00000009 dec eax 0x0000000a lea ebp, dword ptr [esp-2Fh] 0x0000000e dec eax 0x0000000f sub esp, 00000098h

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\vZ1WZMpxTY.dll',#1

Jump to behavior

Contains functionality to create a new security descriptor

Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe

Code function: 32_2_00007FF7A1D14708 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

32_2_00007FF7A1D14708

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000008.00000000.355462139.0000000004F80000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.387648778.00000000008B8000.00000004.00000020.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.388029569.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000008.00000000.388029569.0000000000EE0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe	Queries volume information: C:\Users\user\AppData\Local\1QHnh\FileHistory.exe VolumeInformation
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\rUhH1WSzx\SystemPropertiesAdvanced.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Queries volume information: unknown VolumeInformation

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: LoadLibraryExW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary,

26_2_00007FF6D606CCD0

Queries the installation date of Windows

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe

Code function: 20_2_00007FF69ED356F4 memset,~SyncLockT,SystemTimeToFileTime,GetLastError,GetSystemTime,SystemTimeToFileTime,WinSqmSetDWORD,SLGetGenuineInformation,

20_2_00007FF69ED356F4

Contains functionality to query windows version

Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe

Code function: 26_2_00007FF6D606C7D8 memset,GetVersionExW,GetVersionExW,

26_2_00007FF6D606C7D8

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Local\qklwjLaE\slui.exe	Code function: 20_2_00007FF69ED37390 CreateBindCtx,StringFromGUID2,CoTaskMemAlloc,~SyncLockT,memcpy,MkParseDisplayName,~SyncLockT,		20_2_00007FF69ED37390
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D6062B60 CLSIDFromProgID,CoCreateInstance,CreateURLMonikerEx,CreateBindCtx,		26_2_00007FF6D6062B60
Source: C:\Users\user\AppData\Local\gKsll\PresentationHost.exe	Code function: 26_2_00007FF6D60687C0 CoInternetParseUrl,_wcsnicmp,CreateURLMonikerEx,CreateBindCtx,RegisterBindStatusCallback,SetEvent,PostMessageW,GetModuleHandleW,GetModuleHandleW,LocalFree,CoTaskMemFree,		26_2_00007FF6D60687C0
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CFCF08 PostMessageW,UiaClientsAreListening,UiaRaiseAutomationEvent,		32_2_00007FF7A1CFCF08
Source: C:\Users\user\AppData\Local\N8qUdj\Magnify.exe	Code function: 32_2_00007FF7A1CF9DEC GetPointerDeviceRects,SetWindowPos,SetWindowRgn,SetLayeredWindowAttributes,GetPointerDeviceRects,SetWindowPos,CreateRectRgn,CreateRectRgn,CombineRgn,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,CreateRectRgn,CombineRgn,DeleteObject,SetWindowRgn,DeleteObject,SetLayeredWindowAttributes,UiaClientsAreListening,UiaRaiseStructureChangedEvent,InvalidateRect,		32_2_00007FF7A1CF9DEC