The DLL contains Windows API functions related to the Windows user interface. For example, when you print Screen and paste it into Paint, change the current video resolution, minimize and maximize ...

Next, it loads Windows API functions and starts communicating with the C&C center to send the victim’s hardware identifier and build name. The malware will then receive a set of instructions.

Static analysis shows that the malware imports numerous Windows API functions, enabling it to manipulate files, modify the registry, access the clipboard, execute additional payloads, and evade ...