Edit tour

Windows Analysis Report
start.exe

Overview

General Information

Sample name:	start.exe
Analysis ID:	1632627
MD5:	9bd30c73e3652e947d51bf577da5b0f6
SHA1:	37ba3977a205ec4431c6fbea7cdb3a3f9ee7c866
SHA256:	b36a7ff87354b13aef46513945abf0aa8cef9bf6be7b81a00a694a7a695e0625
Tags:	exeuser-BastianHein
Infos:

Detection

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect debuggers (CloseHandle check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to evade analysis by execution special instruction (VM detection)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Uses shutdown.exe to shutdown or reboot the system

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Execution of Shutdown to Log Out

Sigma detected: Suspicious Schtasks From Env Var Folder

Spawns drivers

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

start.exe (PID: 7812 cmdline: "C:\Users\user\Desktop\start.exe" MD5: 9BD30C73E3652E947D51BF577DA5B0F6)

powershell.exe (PID: 8028 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Aim.exe (PID: 7652 cmdline: "C:\Users\user\AppData\Local\Temp\Aim.exe" MD5: 8A22241E33ED1F6E6054C67270E5D847)

cmd.exe (PID: 8084 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8036 cmdline: schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 8108 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4248 cmdline: schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7616 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1320 cmdline: schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 5688 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7440 cmdline: schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1020 cmdline: "C:\Windows\System32\cmd.exe" /c Shutdown /l /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

shutdown.exe (PID: 7700 cmdline: Shutdown /l /f MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

catlavan (4).exe (PID: 7560 cmdline: "C:\Users\user\AppData\Local\Temp\catlavan (4).exe" MD5: DB718CE479F0DCE3B97BDFA0A7D2D097)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6072 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\System23.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

System23.exe (PID: 3152 cmdline: "C:\Users\user\AppData\Local\Temp\System23.exe" MD5: F18A37264FA5FE97685CFF0CC5682AB8)

cmd.exe (PID: 2896 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4212 cmdline: schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

winplay.exe (PID: 7200 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe MD5: 8A22241E33ED1F6E6054C67270E5D847)

Commonuodate.exe (PID: 1464 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe MD5: 8A22241E33ED1F6E6054C67270E5D847)

Aim.exe (PID: 8092 cmdline: "C:\Users\user\AppData\Local\Temp\Aim.exe" MD5: 8A22241E33ED1F6E6054C67270E5D847)

Aim.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Local\Temp\Aim.exe" MD5: 8A22241E33ED1F6E6054C67270E5D847)

Commonuodate.exe (PID: 3616 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe MD5: 8A22241E33ED1F6E6054C67270E5D847)

System23.exe (PID: 408 cmdline: "C:\Users\user\AppData\Local\Temp\System23.exe" MD5: F18A37264FA5FE97685CFF0CC5682AB8)

System23.exe (PID: 4956 cmdline: "C:\Users\user\AppData\Local\Temp\System23.exe" MD5: F18A37264FA5FE97685CFF0CC5682AB8)

LogonUI.exe (PID: 3944 cmdline: "LogonUI.exe" /flags:0x4 /state0:0xa3825855 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

LogonUI.exe (PID: 7432 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa382a855 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

fontdrvhost.exe (PID: 2104 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

cdd.dll (PID: 4 cmdline: MD5: 9B684213A399B4E286982BDAD6CF3D07)

LogonUI.exe (PID: 1900 cmdline: "LogonUI.exe" /flags:0x2 /state0:0xa3832055 /state1:0x41c64e6d MD5: 893144FE49AA16124B5BD3034E79BBC6)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2193496091.00000267FE640000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x354b1:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x35400:$s2: L2Mgc2NodGFza3MgL2
0000001E.00000002.1549661324.0000023F76D00000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x179e1:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17a2f:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17a7d:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
00000025.00000002.1729025242.000001F2D0D60000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17a49:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17a97:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17ae5:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}

Unpacked PEs

Source	Rule	Description	Author	Strings
30.2.Aim.exe.23f1006d9e8.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x15be1:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15c2f:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15c7d:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
30.2.Aim.exe.23f76d00000.3.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x15be1:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15c2f:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15c7d:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
37.2.System23.exe.1f2d0d60000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17a49:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17a97:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17ae5:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
37.2.System23.exe.1f2e261d9e8.3.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x15c49:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15c97:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15ce5:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
37.2.System23.exe.1f2d0d60000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x15c49:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15c97:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15ce5:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
30.2.Aim.exe.23f76d00000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x179e1:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17a2f:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17a7d:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
10.2.Aim.exe.267fe640000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x354b1:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x35400:$s2: L2Mgc2NodGFza3MgL2
10.2.Aim.exe.267901e91b0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x354b1:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x35400:$s2: L2Mgc2NodGFza3MgL2
10.2.Aim.exe.267901e91b0.2.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x336b1:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x33600:$s2: L2Mgc2NodGFza3MgL2
10.2.Aim.exe.267fe640000.3.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x336b1:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x33600:$s2: L2Mgc2NodGFza3MgL2
37.2.System23.exe.1f2e261d9e8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x17a49:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17a97:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17ae5:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
30.2.Aim.exe.23f1006d9e8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x179e1:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17a2f:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17a7d:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Aim.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\start.exe, ProcessId: 7812, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aim

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\start.exe", ParentImage: C:\Users\user\Desktop\start.exe, ParentProcessId: 7812, ParentProcessName: start.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\start.exe", ParentImage: C:\Users\user\Desktop\start.exe, ParentProcessId: 7812, ParentProcessName: start.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\start.exe", ParentImage: C:\Users\user\Desktop\start.exe, ParentProcessId: 7812, ParentProcessName: start.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\start.exe", ParentImage: C:\Users\user\Desktop\start.exe, ParentProcessId: 7812, ParentProcessName: start.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Aim.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\start.exe, ProcessId: 7812, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aim

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\System32\userinit.exe,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\Aim.exe, ProcessId: 7652, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cdd.dll, NewProcessName: C:\Windows\System32\cdd.dll, OriginalFileName: C:\Windows\System32\cdd.dll, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: cdd.dll

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Execution of Shutdown to Log Out

Source: Process started

Author: frack113: Data: Command: Shutdown /l /f, CommandLine: Shutdown /l /f, CommandLine|base64offset|contains: Jv', Image: C:\Windows\System32\shutdown.exe, NewProcessName: C:\Windows\System32\shutdown.exe, OriginalFileName: C:\Windows\System32\shutdown.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c Shutdown /l /f, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1020, ParentProcessName: cmd.exe, ProcessCommandLine: Shutdown /l /f, ProcessId: 7700, ProcessName: shutdown.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" , CommandLine: schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" , CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8084, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" , ProcessId: 8036, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\start.exe", ParentImage: C:\Users\user\Desktop\start.exe, ParentProcessId: 7812, ParentProcessName: start.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe', ProcessId: 8028, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Sheet RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-08T14:51:17.428762+0100	2058998	1	A Network Trojan was detected	192.168.2.4	49722	147.185.221.26	43378	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: start.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://fpsuabooster.ru/opencl.dllAC:	Avira URL Cloud: Label: malware
Source: http://fpsuabooster.ru/opencl.dll	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Avira: detection malicious, Label: HEUR/AGEN.1315477
Source: C:\Windows\System32\Wincall.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: start.exe	ReversingLabs: Detection: 57%
Source: start.exe	Virustotal: Detection: 56%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: start.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: start.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2058998 - Severity 1 - ET MALWARE Sheet RAT CnC Checkin : 192.168.2.4:49722 -> 147.185.221.26:43378

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1448
Source: unknown	Network traffic detected: HTTP traffic on port 1448 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1448
Source: unknown	Network traffic detected: HTTP traffic on port 1448 -> 49721

Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 147.185.221.22:33793
Source: global traffic	TCP traffic: 192.168.2.4:49721 -> 185.17.0.102:1448
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 147.185.221.26:43378

Source: Joe Sandbox View	IP Address: 147.185.221.22 147.185.221.22
Source: Joe Sandbox View	IP Address: 147.185.221.26 147.185.221.26

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.0.102

Source: global traffic	HTTP traffic detected: GET /api/getKeys HTTP/1.1User-Agent: HTTPGETHost: 185.17.0.102:1448Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpC HTTP/1.1User-Agent: HTTPGETHost: 185.17.0.102:1448Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: northern-tigers.gl.at.ply.gg
Source: global traffic	DNS traffic detected: DNS query: apply-rage.gl.at.ply.gg
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: catlavan (4).exe, 0000000C.00000002.2118697081.000000000045B000.00000004.00000020.00020000.00000000.sdmp, catlavan (4).exe, 0000000C.00000002.2118697081.000000000040C000.00000004.00000020.00020000.00000000.sdmp, catlavan (4).exe, 0000000C.00000002.2118697081.0000000000423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/getKeys
Source: catlavan (4).exe, 0000000C.00000002.2118697081.000000000040C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/getKeysF
Source: catlavan (4).exe, 0000000C.00000002.2118697081.0000000000436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpC
Source: catlavan (4).exe, 0000000C.00000002.2118697081.0000000000471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpC%
Source: catlavan (4).exe, 0000000C.00000002.2118697081.0000000000471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpC(
Source: catlavan (4).exe, 0000000C.00000002.2118697081.000000000045B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpC9
Source: catlavan (4).exe, 0000000C.00000002.2118697081.0000000000471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpCP
Source: catlavan (4).exe, 0000000C.00000002.2118697081.0000000000471000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.17.0.102:1448/api/version?version=UWdJWjVaazVQNHJ3SklrODBGYVZDeE5SUHpCn
Source: powershell.exe, 00000002.00000002.1327897245.00000227695D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: Aim.exe, 0000000A.00000002.2119874133.00000267803E2000.00000004.00000800.00020000.00000000.sdmp, Aim.exe, 0000000A.00000002.2119874133.0000026780001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fpsuabooster.ru/opencl.dll
Source: Aim.exe, 0000000A.00000002.2171388163.0000026790143000.00000004.00000800.00020000.00000000.sdmp, Aim.exe, 0000000A.00000002.2193496091.00000267FE640000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://fpsuabooster.ru/opencl.dllAC:
Source: powershell.exe, 00000002.00000002.1314781000.0000022761086000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1549673558.000001CBBC3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000E.00000002.1424632859.000001CBAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1265604420.000002275123B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1424632859.000001CBAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1265604420.0000022751011000.00000004.00000800.00020000.00000000.sdmp, Aim.exe, 0000000A.00000002.2119874133.0000026780001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1424632859.000001CBAC331000.00000004.00000800.00020000.00000000.sdmp, winplay.exe, 0000001C.00000002.1662950595.000002D2B8CA1000.00000004.00000800.00020000.00000000.sdmp, Commonuodate.exe, 0000001D.00000002.1658475412.0000011286D51000.00000004.00000800.00020000.00000000.sdmp, Aim.exe, 0000001E.00000002.1523189191.0000023F00001000.00000004.00000800.00020000.00000000.sdmp, Aim.exe, 0000001F.00000002.1599313298.000001C8377F4000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D4061000.00000004.00000800.00020000.00000000.sdmp, Commonuodate.exe, 00000024.00000002.1712574629.0000027200001000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000025.00000002.1729918351.000001F2D25B1000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000026.00000002.1814391280.000001F52A073000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1265604420.000002275123B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1424632859.000001CBAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000E.00000002.1424632859.000001CBAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1265604420.0000022751011000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1424632859.000001CBAC331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000E.00000002.1549673558.000001CBBC3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.1549673558.000001CBBC3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.1549673558.000001CBBC3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.1424632859.000001CBAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1314781000.0000022761086000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.1549673558.000001CBBC3A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 30.2.Aim.exe.23f1006d9e8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 30.2.Aim.exe.23f76d00000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 37.2.System23.exe.1f2d0d60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 37.2.System23.exe.1f2e261d9e8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 37.2.System23.exe.1f2d0d60000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 30.2.Aim.exe.23f76d00000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 10.2.Aim.exe.267901e91b0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 10.2.Aim.exe.267fe640000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 37.2.System23.exe.1f2e261d9e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 30.2.Aim.exe.23f1006d9e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 0000000A.00000002.2193496091.00000267FE640000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 0000001E.00000002.1549661324.0000023F76D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 00000025.00000002.1729025242.000001F2D0D60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen

.NET source code contains very large strings

Source: System23.exe.0.dr, _Logger_DoWork.cs	Long String: Length: 148824
Source: Aim.exe.0.dr, Invoke.cs	Long String: Length: 148824
Source: Commonuodate.exe.10.dr, Invoke.cs	Long String: Length: 148824
Source: winplay.exe.10.dr, Invoke.cs	Long String: Length: 148824
Source: 30.2.Aim.exe.23f10088e20.1.raw.unpack, Invoke.cs	Long String: Length: 148824

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\shutdown.exe Shutdown /l /f

Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC3361B NtProtectVirtualMemory,	10_2_00007FFC3DC3361B
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC31810 NtQueryInformationProcess,	10_2_00007FFC3DC31810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC21810 NtQueryInformationProcess,	28_2_00007FFC3DC21810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC2361B NtProtectVirtualMemory,	28_2_00007FFC3DC2361B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC41810 NtQueryInformationProcess,	29_2_00007FFC3DC41810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC43605 NtProtectVirtualMemory,	29_2_00007FFC3DC43605
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC41810 NtQueryInformationProcess,	30_2_00007FFC3DC41810
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC43605 NtProtectVirtualMemory,	30_2_00007FFC3DC43605
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC11810 NtQueryInformationProcess,	31_2_00007FFC3DC11810
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC13605 NtProtectVirtualMemory,	31_2_00007FFC3DC13605
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC53615 NtProtectVirtualMemory,	32_2_00007FFC3DC53615
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC51810 NtQueryInformationProcess,	32_2_00007FFC3DC51810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC31810 NtQueryInformationProcess,	36_2_00007FFC3DC31810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC3361B NtProtectVirtualMemory,	36_2_00007FFC3DC3361B
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC31810 NtQueryInformationProcess,	37_2_00007FFC3DC31810
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC3362B NtProtectVirtualMemory,	37_2_00007FFC3DC3362B
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC21810 NtQueryInformationProcess,	38_2_00007FFC3DC21810
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC2362B NtProtectVirtualMemory,	38_2_00007FFC3DC2362B

Source: C:\Users\user\AppData\Local\Temp\System23.exe

File created: C:\Windows\System32\Wincall.exe

Source: C:\Users\user\Desktop\start.exe	Code function: 0_2_00007FFC3DC50AAD	0_2_00007FFC3DC50AAD
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC31538	10_2_00007FFC3DC31538
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC68CD0	10_2_00007FFC3DC68CD0
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC32CAB	10_2_00007FFC3DC32CAB
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC3A060	10_2_00007FFC3DC3A060
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC31810	10_2_00007FFC3DC31810
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC49030	10_2_00007FFC3DC49030
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC57F50	10_2_00007FFC3DC57F50
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC33F10	10_2_00007FFC3DC33F10
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC41722	10_2_00007FFC3DC41722
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC3CA50	10_2_00007FFC3DC3CA50
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC40976	10_2_00007FFC3DC40976
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC3A110	10_2_00007FFC3DC3A110
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC308AD	10_2_00007FFC3DC308AD
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC4444B	10_2_00007FFC3DC4444B
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC38A7D	10_2_00007FFC3DC38A7D
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC338D8	10_2_00007FFC3DC338D8
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC395AB	10_2_00007FFC3DC395AB
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC33FF0	10_2_00007FFC3DC33FF0
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC34E95	10_2_00007FFC3DC34E95
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC3CA31	10_2_00007FFC3DC3CA31
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC491D3	10_2_00007FFC3DC491D3
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC333BB	10_2_00007FFC3DC333BB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC21810	28_2_00007FFC3DC21810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC23F10	28_2_00007FFC3DC23F10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC21538	28_2_00007FFC3DC21538
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC208AD	28_2_00007FFC3DC208AD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC26A7B	28_2_00007FFC3DC26A7B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC21FF1	28_2_00007FFC3DC21FF1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC23FF0	28_2_00007FFC3DC23FF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC233BB	28_2_00007FFC3DC233BB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC24E95	28_2_00007FFC3DC24E95
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC22CAB	28_2_00007FFC3DC22CAB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC41810	29_2_00007FFC3DC41810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC43F10	29_2_00007FFC3DC43F10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC41538	29_2_00007FFC3DC41538
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC408AD	29_2_00007FFC3DC408AD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC46A19	29_2_00007FFC3DC46A19
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC41FF1	29_2_00007FFC3DC41FF1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC43FF0	29_2_00007FFC3DC43FF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC43386	29_2_00007FFC3DC43386
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC44E95	29_2_00007FFC3DC44E95
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC42C9D	29_2_00007FFC3DC42C9D
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC41810	30_2_00007FFC3DC41810
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC463B0	30_2_00007FFC3DC463B0
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC43F10	30_2_00007FFC3DC43F10
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC41538	30_2_00007FFC3DC41538
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC408AD	30_2_00007FFC3DC408AD
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC43FF0	30_2_00007FFC3DC43FF0
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC43386	30_2_00007FFC3DC43386
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC44E95	30_2_00007FFC3DC44E95
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC42C9D	30_2_00007FFC3DC42C9D
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC11810	31_2_00007FFC3DC11810
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC16A19	31_2_00007FFC3DC16A19
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC11538	31_2_00007FFC3DC11538
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC108AD	31_2_00007FFC3DC108AD
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC13FF0	31_2_00007FFC3DC13FF0
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC11FF1	31_2_00007FFC3DC11FF1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC13386	31_2_00007FFC3DC13386
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC14E95	31_2_00007FFC3DC14E95
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC12C9D	31_2_00007FFC3DC12C9D
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC53908	32_2_00007FFC3DC53908
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC51538	32_2_00007FFC3DC51538
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC60126	32_2_00007FFC3DC60126
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC508AD	32_2_00007FFC3DC508AD
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC52C9D	32_2_00007FFC3DC52C9D
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC5B053	32_2_00007FFC3DC5B053
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC5A858	32_2_00007FFC3DC5A858
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC54070	32_2_00007FFC3DC54070
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC51810	32_2_00007FFC3DC51810
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC60F1B	32_2_00007FFC3DC60F1B
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC53F20	32_2_00007FFC3DC53F20
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC5A6D0	32_2_00007FFC3DC5A6D0
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC56E2A	32_2_00007FFC3DC56E2A
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC590FF	32_2_00007FFC3DC590FF
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC54000	32_2_00007FFC3DC54000
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC59BE6	32_2_00007FFC3DC59BE6
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC53396	32_2_00007FFC3DC53396
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC54EA5	32_2_00007FFC3DC54EA5
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC31810	36_2_00007FFC3DC31810
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC33F10	36_2_00007FFC3DC33F10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC31538	36_2_00007FFC3DC31538
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC308AD	36_2_00007FFC3DC308AD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC36A7B	36_2_00007FFC3DC36A7B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC33FF0	36_2_00007FFC3DC33FF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC31FF1	36_2_00007FFC3DC31FF1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC333BB	36_2_00007FFC3DC333BB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC34E95	36_2_00007FFC3DC34E95
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 36_2_00007FFC3DC32CAB	36_2_00007FFC3DC32CAB
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC34070	37_2_00007FFC3DC34070
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC31810	37_2_00007FFC3DC31810
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC3710B	37_2_00007FFC3DC3710B
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC31538	37_2_00007FFC3DC31538
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC308AD	37_2_00007FFC3DC308AD
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC34000	37_2_00007FFC3DC34000
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC333CB	37_2_00007FFC3DC333CB
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC34EA5	37_2_00007FFC3DC34EA5
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 37_2_00007FFC3DC32CAB	37_2_00007FFC3DC32CAB
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC21810	38_2_00007FFC3DC21810
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC26A29	38_2_00007FFC3DC26A29
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC21538	38_2_00007FFC3DC21538
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC208AD	38_2_00007FFC3DC208AD
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC24000	38_2_00007FFC3DC24000
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC233CB	38_2_00007FFC3DC233CB
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC24EA5	38_2_00007FFC3DC24EA5
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 38_2_00007FFC3DC22CAB	38_2_00007FFC3DC22CAB

Source: start.exe, 00000000.00000002.1610552707.0000000004BF1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCriptor.exe0 vs start.exe

Source: unknown

Driver loaded: C:\Windows\System32\cdd.dll

Source: start.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 30.2.Aim.exe.23f1006d9e8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 30.2.Aim.exe.23f76d00000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 37.2.System23.exe.1f2d0d60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 37.2.System23.exe.1f2e261d9e8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 37.2.System23.exe.1f2d0d60000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 30.2.Aim.exe.23f76d00000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 10.2.Aim.exe.267901e91b0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 10.2.Aim.exe.267fe640000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 37.2.System23.exe.1f2e261d9e8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 30.2.Aim.exe.23f1006d9e8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 0000000A.00000002.2193496091.00000267FE640000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 0000001E.00000002.1549661324.0000023F76D00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 00000025.00000002.1729025242.000001F2D0D60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI

Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskSchedulerSnapshot.cs	Task registration methods: 'InternalCreate', 'Create'
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'

Source: System23.exe.0.dr, _Logger_DoWork.cs	Base64 encoded string: 'idDzLKeCwT++hrFCdPQmfRSvMpwfHPb1SxFDTVIrsH/t7qEKYGMReKNAVyihHHC+/W/7WDx356P5SK9/jw3EUjxyicYcurT34MSxMoE8MbXJkbvL+BUNOgU5nQrDYMq9zEQ99MfZgSifyzd1E1lfwd8nghpbCvl5PRCAGMrimapeTK2E9+sPNmcKD2BXbbgV49id0fiKqJogiA8nr/gi8RbWhVmGRSb1jYdZsIoWYVkM4aH2FS4GvyR2xOpFT7HCC712y5T3ZcMAiuHQV3y9c/ZmhEQJTiBR17mzDUv1ctCuqFnETsTQ1ku2t6e11o5IQCOCWsRnVVOusp7xPFpqf3ARjEQ8RlWLZObZjcB2Mca0Za9QAj6svslqxfcmAnQgMpn3B3Sjdx3lLCnFvK5LK5Vpkt73WMY02bWg/ORdr6oFgonfMYIyss6usKsJjfJH+mutoToYU1SenmX2bbACTXPktYHirf0Xsg9W1b9TuWQ1xEIphYf2QTZoMYbXRJY2hnyZLck+z6OzykWhPmdegQDLw8C3C3IPc9qOpaJZz5qvwymN5hwgl6l9dNrCc0k5qUcOt5vpdWvqoCLt5LOsIZZejMmqZHAX/v65jloXS3lFo8A1kcyPqBxKoBVlV5b5EFKOCUAFYz5gobnBPVoi41KwxhFVXydv89cshr5tx7SNjS3e0cqAd6ef0LWPh9B26qSbmZiwdzus18dtqPnEtwhpc2t2ktQsii3jk5sq5fJmDUvu7wx1/ZBKxHb6SVkAve4nUMNzkbeZjVJFFFmyaETC/CSalWy6atgko62tmy8pY4Ol0mt1DjznhrfJk4CXpJfEsV+/o4eeDobM+6rLAmoDafVpSSXI4gV3asKUPeGhEf/pAv8LCd8xdLT/BY59oV3khr1Y8YF9OHduqLDGfrrYtKKq8nOGdYSHecTGpW+45xbC1mcspfQ/usdZ8soyyov3auNto04pQ1Vo1dO5xipdHcV4zbLCWdXGmezTD8FAE13jW0XaDo4eN3/ITT7ksslmouqxlFon7ZoEhOPFAHkwNiprrJ0W0VHIc8Mb1w/kvmNshOJ7JAVWgfaZm2qOokOW2obNqlynZe6TJO7sWLV+QR6oLeB/1AwF3RbB7QjvwVWhCDsoOYqtyEZr2v38wVxPk5oyCLDE5vRdy0WEsqcysEK8e7jvXbvILQ5GUutbnFruy9Xh2cyoKoWOh7Unki31DjrbQP6woJ4xxU6i2U8eJJx63fJzgtuOMFPqR29K5DWvRjGcuRLYR7505457QcTjUW70TAAF2Um3kLJEz2e3ryVQr5fwv09V44aZyI92RJzJLivS+qMWLPnPKeFwFT+5r58ofadQ9hS0KaeEJkgYpr72WXnsCjfsda571Tq3UYZs+YvtxYK7GkAp+b/x1QpMDXtcpHWDPyylAA3S493WO9RnHLCSFMXhkSVH9TmouDQfsb2Z9yWe48ueDRvTeigljbeo1J0TtBn9D5fc2hKJtI0rmO8v8DVwcDXwopYcBQmv3yc1XemeRgRtNs3JtJX/DWvTQMZKgEW70kdZJvBKd+uvTZosN3vRaFURohf8mk1n13XShx6sgjdpUecgSs0VE0W0jZ8CouOSVYnXLuvJy+0dTaz3TumuVEY+BxYLL5FwhLo73fxKZo9zVq2Ly05Q2CMO1DBl1eIt+vUCV1FCNKfj1zBvcCRVdx8+UzJgdu/Asvd3/xIdEIF3ViZ8onCj11I8wKpfE+mf9nt5XHUeEbq8PqlpufoXKEN7V727+GwxkGzVnLieviRBHTnwghZo1/giwG2CJk4vFkpynNPUy3pDDbol+k+kP4SwkWTqbJqoDrjIrt9ofoAeVsxHRcm9Gmi2vXoP5q5XA6q+qX53zTz72JBeeYAlWHHew8cLW9y+Jt0HXUoHMDhZOB6WsyusqrFFgWQeS+KZe8Y6h/PZdKwhs61TLq5N+yqPCNLq4z/9UeEbd/8Fc5skLQmhbSEQaw2a3M9uiqoTLoyWaD9mRdWmZZAoLCwbvESBaFfgSuqGbN1sJVpBw9VvgQGKaDf5FHgY7JiGgkU0mFXzTiWZ7sInC/k+wWtVh0DRWoVWsUY5aKdIeeM3pBmeQnzEQtJIRlMX7uw8UPJaGzFhf+eoxiCrUQhHoWjCYwoSffBgIBzuXUAbOMLMErksYhp+M8u35ZfzPiZxP6mb5Jga2XLtRenHF/9xEDu5x563ddLTLLXdp0MLMNbqLTPCLM1tu7hh6rP/oSGXYOfVo4tpKV1fplYL7DSlxutkvZ5u859J6BZzqYM18WXAngT8cEhCWaEE4egYKNivtbirkbgjiwFfpruBpvFs38kBSNNCS3/Kuxr1qkbz5YNIPPHRcECGkAjJ/Z8jMdWCRqjYr71lqsGeetKUXm3gUQbcWVt74p8M0JrfFgCFQ6f9e0ZHxvWMm9rhs1RDpoxLB/M/UGY0ZeheXlWY6NdmRhIA2gS8H3kT81S7F+5MXvaFTFiJfgOsgDlGBivl/mrNTulxsVgo5zVBzuFx+q7a/P8GW41L13fMg5IzOG1qz2MkF6QUIKM1Z/lX19pyF0mz+Wqr8AzKJWDy2rYzwVtw1hOQOuWf/FJQcnY2eXi7t9xtAzQ+Hvh3oYgcMt10Z/w12FWMSsMki/WvysUuGA6N+Pkj3z6RS5KXys9PT69DR79dIakfkat9UdWr3W8TI0iwd6LAqbEt6U6jEjlnpTzmtqK42SUw6abbdIv1ncDQhCdg8FMerbCJ58dQqS8hBTGF7ILbOQmXbitXNpqYn3BncChK7cnHQz/35VtJ7ywEXs/n7X/Nf3z08Q4mYFOIfZZB37m2+doT+QxlU3lOaXHpExhvqCi/Vb2d+ODcfF16Y5sISc0TG3gshp01paJH71f50nH7drx+MX8r4y8Ke9FBARIfX12OVmTG1xLco+g/YoQ7qJYxq1IXq87akMpCkctIXnQ/lbsJaIzP5YmEtowFlsusyvdwVoBP5YI3MC64gcZ
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, HandleNormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, HandleNormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, HandleUninstall.cs	Security API names: File.GetAccessControl
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, HandleUninstall.cs	Security API names: Directory.GetAccessControl
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, HandleUninstall.cs	Security API names: File.SetAccessControl
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, HandleUninstall.cs	Security API names: Directory.SetAccessControl
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, HandleUninstall.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, Methods.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, HandleUninstall.cs	Security API names: File.GetAccessControl
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, HandleUninstall.cs	Security API names: Directory.GetAccessControl
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, HandleUninstall.cs	Security API names: File.SetAccessControl
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, HandleUninstall.cs	Security API names: Directory.SetAccessControl
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, HandleUninstall.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, Packet.cs	Suspicious URL: 'http://fpsuabooster.ru/opencl.dll'
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, Packet.cs	Suspicious URL: 'http://fpsuabooster.ru/opencl.dll'

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@55/23@3/3

Source: C:\Users\user\Desktop\start.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\start.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Mutant created: \Sessions\1\BaseNamedObjects\hleamywbcfmcirfvtj
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Users\user\Desktop\start.exe	Mutant created: \Sessions\1\BaseNamedObjects\Vgxw1mdTafPmyxUQ0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3272:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Mutant created: \Sessions\1\BaseNamedObjects\gwqfglmzuptycegqs

Source: C:\Users\user\Desktop\start.exe

File created: C:\Users\user\AppData\Local\Temp\Aim.exe

Jump to behavior

Source: start.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: start.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\start.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\start.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: start.exe	ReversingLabs: Detection: 57%
Source: start.exe	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\start.exe "C:\Users\user\Desktop\start.exe"
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\Aim.exe "C:\Users\user\AppData\Local\Temp\Aim.exe"
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\catlavan (4).exe "C:\Users\user\AppData\Local\Temp\catlavan (4).exe"
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\System23.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Aim.exe "C:\Users\user\AppData\Local\Temp\Aim.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Aim.exe "C:\Users\user\AppData\Local\Temp\Aim.exe"
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\System23.exe "C:\Users\user\AppData\Local\Temp\System23.exe"
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\System23.exe "C:\Users\user\AppData\Local\Temp\System23.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\System23.exe "C:\Users\user\AppData\Local\Temp\System23.exe"
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c Shutdown /l /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\shutdown.exe Shutdown /l /f
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x4 /state0:0xa3825855 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa382a855 /state1:0x41c64e6d
Source: unknown	Process created: C:\Windows\System32\fontdrvhost.exe "fontdrvhost.exe"
Source: unknown	Process created: C:\Windows\System32\LogonUI.exe "LogonUI.exe" /flags:0x2 /state0:0xa3832055 /state1:0x41c64e6d
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe'	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\Aim.exe "C:\Users\user\AppData\Local\Temp\Aim.exe"	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\catlavan (4).exe "C:\Users\user\AppData\Local\Temp\catlavan (4).exe"	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\System23.exe'	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\System23.exe "C:\Users\user\AppData\Local\Temp\System23.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c Shutdown /l /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\shutdown.exe Shutdown /l /f

Source: C:\Users\user\Desktop\start.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: devenum.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: msdmo.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.logon.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wincorlib.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dcomp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xamlhost.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: languageoverlayutil.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: directmanipulation.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: windows.ui.xaml.controls.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uiautomationcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: logoncontroller.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: slc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\LogonUI.exe	Section loaded: winsta.dll

Source: C:\Users\user\Desktop\start.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\start.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: start.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: start.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: start.exe

Static file information: File size 29322240 > 1048576

Source: start.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1bf6200

Source: start.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: System23.exe.0.dr, get_Plugins.cs	.Net Code: Broadcast System.Reflection.Assembly.Load(byte[])
Source: Aim.exe.0.dr, get_Groups.cs	.Net Code: LogError System.Reflection.Assembly.Load(byte[])
Source: Commonuodate.exe.10.dr, get_Groups.cs	.Net Code: LogError System.Reflection.Assembly.Load(byte[])
Source: winplay.exe.10.dr, get_Groups.cs	.Net Code: LogError System.Reflection.Assembly.Load(byte[])
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.Aim.exe.267901e91b0.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 30.2.Aim.exe.23f10088e20.1.raw.unpack, get_Groups.cs	.Net Code: LogError System.Reflection.Assembly.Load(byte[])

Source: System23.exe.0.dr

Static PE information: 0xEC762775 [Sun Sep 18 06:38:45 2095 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .mtx412

Source: catlavan (4).exe.0.dr	Static PE information: section name: .mtx410
Source: catlavan (4).exe.0.dr	Static PE information: section name: .mtx411
Source: catlavan (4).exe.0.dr	Static PE information: section name: .mtx412

Source: C:\Users\user\Desktop\start.exe	Code function: 0_2_00007FFC3DC500BD pushad ; iretd	0_2_00007FFC3DC500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFC3DB2D2A5 pushad ; iretd	2_2_00007FFC3DB2D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFC3DC400BD pushad ; iretd	2_2_00007FFC3DC400C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFC3DD12316 push 8B485F92h; iretd	2_2_00007FFC3DD1231B
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC308AD push FC3DCB30h; retf	10_2_00007FFC3DC3133A
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC33605 push ecx; retf	10_2_00007FFC3DC3361A
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC314E8 push E85CC1F7h; ret	10_2_00007FFC3DC314F9
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC300BD pushad ; iretd	10_2_00007FFC3DC300C1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 10_2_00007FFC3DC3043D push E95DB64Eh; ret	10_2_00007FFC3DC30459
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFC3DB1D2A5 pushad ; iretd	14_2_00007FFC3DB1D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FFC3DC300BD pushad ; iretd	14_2_00007FFC3DC300C1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC214FA push es; ret	28_2_00007FFC3DC214D6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC208AD push FC3DCA30h; retf FC3Dh	28_2_00007FFC3DC2133A
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC2147A push es; ret	28_2_00007FFC3DC214D6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC200BD pushad ; iretd	28_2_00007FFC3DC200C1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Code function: 28_2_00007FFC3DC214E7 push E85CC2F7h; ret	28_2_00007FFC3DC214F9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC414FA push E85CC0F7h; ret	29_2_00007FFC3DC414F9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC4147A push E85CC0F7h; ret	29_2_00007FFC3DC414F9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Code function: 29_2_00007FFC3DC400BD pushad ; iretd	29_2_00007FFC3DC400C1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC4147A push E85CC0F7h; ret	30_2_00007FFC3DC414F9
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC400BD pushad ; iretd	30_2_00007FFC3DC400C1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 30_2_00007FFC3DC414FA push E85CC0F7h; ret	30_2_00007FFC3DC414F9
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC100BD pushad ; iretd	31_2_00007FFC3DC100C1
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Code function: 31_2_00007FFC3DC114E8 push E85CC3F7h; ret	31_2_00007FFC3DC114F9
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC5C1CD push ds; iretd	32_2_00007FFC3DC5C1EA
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC5C118 push ds; iretd	32_2_00007FFC3DC5C11A
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC63534 push edx; iretd	32_2_00007FFC3DC6353A
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC500BD pushad ; iretd	32_2_00007FFC3DC500C1
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC514FA push E85CBFF7h; ret	32_2_00007FFC3DC514F9
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC6347D push ecx; iretd	32_2_00007FFC3DC6349A
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Code function: 32_2_00007FFC3DC5043D push E95DB44Eh; ret	32_2_00007FFC3DC50459

Source: C:\Users\user\AppData\Local\Temp\System23.exe	File created: C:\Windows\System32\Wincall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\start.exe	File created: C:\Users\user\AppData\Local\Temp\System23.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Jump to dropped file
Source: C:\Users\user\Desktop\start.exe	File created: C:\Users\user\AppData\Local\Temp\Aim.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\start.exe	File created: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\System23.exe

File created: C:\Windows\System32\Wincall.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\start.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Aim			Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run System23			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"

Source: C:\Users\user\Desktop\start.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Aim	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Aim	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run System23	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run System23	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Memory written: PID: 7560 base: 7FFCC3890008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Memory written: PID: 7560 base: 7FFCC372D9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Memory written: PID: 7560 base: 7FFCC38A000D value: E9 BB CB EB FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Memory written: PID: 7560 base: 7FFCC375CBC0 value: E9 5A 34 14 00	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1448
Source: unknown	Network traffic detected: HTTP traffic on port 1448 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 1448
Source: unknown	Network traffic detected: HTTP traffic on port 1448 -> 49721

Source: C:\Users\user\AppData\Local\Temp\Aim.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{S15212246122658369340511724767566341002} C6C70330AEC2F0A565149C93CE8AF808BD898879090DB3F65F07933639039CC7

Jump to behavior

Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Aim.exe, 0000001E.00000002.1529781995.0000023F10007000.00000004.00000800.00020000.00000000.sdmp, Aim.exe, 0000001E.00000002.1549661324.0000023F76D00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: SUIUSSOFTWUIUSSARE\MICUIUSSROSOFT\WINDOWS DEBUTTONFENDER\EXBUTTONCLUSIBUTTONONS\PAUIUSSTHSSTASKMGR.EXE,PROCESSHACKER.EXE,PROCEXP.EXE
Source: System23.exe, 00000025.00000002.1732997410.000001F2E25B7000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000025.00000002.1729025242.000001F2D0D60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: SOFUIUSSTWAUIUSSRE\MICROUIUSSSOFT\WINDOWBUTTONS DEFUIUSSENDBUTTONER\EXUIUSSCLUSIBUTTONONS\PATUIUSSHSSTASKMGR.EXE,PROCESSHACKER.EXE,PROCEXP.EXE

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Special instruction interceptor: First address: 142B11EE5 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Special instruction interceptor: First address: 142B11EF3 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Users\user\Desktop\start.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Memory allocated: 1CBF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Memory allocated: 267FC430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Memory allocated: 267FDE70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Memory allocated: 2D2B73C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Memory allocated: 2D2D0CA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Memory allocated: 112853A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Memory allocated: 1129ED50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Memory allocated: 23F76CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Memory allocated: 23F78700000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Memory allocated: 1C835F50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Memory allocated: 1C84F7D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Memory allocated: 261D26C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Memory allocated: 261EC060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Memory allocated: 272679F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Memory allocated: 27269420000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Memory allocated: 1F2D0AA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Memory allocated: 1F2EA5B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Memory allocated: 1F528610000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Memory allocated: 1F542050000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\start.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 10000000
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 10000000
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6152	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3611	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Window / User API: threadDelayed 8449	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Window / User API: threadDelayed 802	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6438	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 476	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Window / User API: threadDelayed 9455

Source: C:\Users\user\Desktop\start.exe TID: 7960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe TID: 8068	Thread sleep count: 8449 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe TID: 700	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe TID: 8148	Thread sleep count: 802 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3432	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe TID: 7856	Thread sleep count: 300 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe TID: 8136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe TID: 5052	Thread sleep time: -10000000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe TID: 2180	Thread sleep count: 199 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe TID: 4508	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Aim.exe TID: 7996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Aim.exe TID: 5696	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\System23.exe TID: 2992	Thread sleep count: 9455 > 30
Source: C:\Users\user\AppData\Local\Temp\System23.exe TID: 4032	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\System23.exe TID: 2992	Thread sleep count: 335 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe TID: 748	Thread sleep time: -10000000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe TID: 5040	Thread sleep count: 200 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe TID: 3996	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\System23.exe TID: 5064	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\System23.exe TID: 4408	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\System23.exe TID: 4936	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\start.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 10000000
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 10000000
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	File opened: C:\Users\user\

Source: Aim.exe, 0000000A.00000002.2188943278.00000267FDD60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUc
Source: catlavan (4).exe, 0000000C.00000002.2119707325.00000001400B3000.00000020.00000001.01000000.0000000B.sdmp	Binary or memory string: 8QEmU
Source: catlavan (4).exe, 0000000C.00000002.2118697081.0000000000480000.00000004.00000020.00020000.00000000.sdmp, catlavan (4).exe, 0000000C.00000003.1497485121.0000000000480000.00000004.00000020.00020000.00000000.sdmp, catlavan (4).exe, 0000000C.00000002.2118697081.0000000000436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: catlavan (4).exe, 0000000C.00000002.2120918257.00000001415C8000.00000020.00000001.01000000.0000000B.sdmp, start.exe, catlavan (4).exe.0.dr	Binary or memory string: HGfsx
Source: System23.exe, 00000020.00000002.2173905762.00000261EC837000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect debuggers (CloseHandle check)

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe

Handle closed: DEADC0DE

Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process queried: DebugFlags
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process queried: DebugObjectHandle

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\start.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: System23.exe.0.dr, _Logger_DoWork.cs	Reference to suspicious API methods: VirtualProtect(new IntPtr(num3), 11u, (MemoryProtection)64, ref memoryProtection)
Source: System23.exe.0.dr, writeToConsole.cs	Reference to suspicious API methods: checkCommandMappings(_Logger_DoWork._003CInitialize_003Eb__13_0().Replace(_Logger_DoWork.UnloadPlugin(), _Logger_DoWork.GetPermissions()), _Logger_DoWork._003CAwake_003Eb__12_0().Replace(_Logger_DoWork.ParseString(), _Logger_DoWork.Reload()), typeof(Delegates.NtProtectVirtualMemory), ref Parameters)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: OpenProcessToken(hProcess, desiredAccess, out var TokenHandle)
Source: 10.2.Aim.exe.267fe640000.3.raw.unpack, ResourceReferenceValue.cs	Reference to suspicious API methods: NativeMethods.LoadLibrary(ResourceFilePath)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe'
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\System23.exe'
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe'	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\System23.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\start.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe'

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQueryInformationProcess: Direct from: 0x142AEF810	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x1415CE564	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQueryInformationProcess: Direct from: 0x142A88C93	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Indirect: 0x1415A3504	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x142AA51DE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x142A19C5B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtMapViewOfSection: Direct from: 0x142A712ED	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQuerySystemInformation: Direct from: 0x1418F9018	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtUnmapViewOfSection: Direct from: 0x142A8D486	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtSetInformationThread: Direct from: 0x142A353CC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x141895E6C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQueryInformationProcess: Direct from: 0x142AE3AFB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQueryInformationProcess: Direct from: 0x142ADA78D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtSetInformationThread: Direct from: 0x142A794A9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQuerySystemInformation: Direct from: 0x142A59BF7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x142AF566E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x142A07943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtOpenFile: Direct from: 0x142A4E705	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQuerySystemInformation: Direct from: 0x141889500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtClose: Direct from: 0x142A867DE
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x142ADEDF8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQuerySystemInformation: Direct from: 0x142AF7C94	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQuerySystemInformation: Direct from: 0x1418996BD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtSetInformationProcess: Direct from: 0x142A37CB2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtQueryInformationProcess: Direct from: 0x142A0359A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\catlavan (4).exe	NtProtectVirtualMemory: Direct from: 0x142A3B5AE	Jump to behavior

Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Aim.exe'	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\Aim.exe "C:\Users\user\AppData\Local\Temp\Aim.exe"	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\catlavan (4).exe "C:\Users\user\AppData\Local\Temp\catlavan (4).exe"	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\System23.exe'	Jump to behavior
Source: C:\Users\user\Desktop\start.exe	Process created: C:\Users\user\AppData\Local\Temp\System23.exe "C:\Users\user\AppData\Local\Temp\System23.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c Shutdown /l /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Chrome" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "GoogleUpdateMachineUA" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe" & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 3 /tn "MicrosoftEdgeUpdateMachineCore" /tr "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\shutdown.exe Shutdown /l /f

Source: Aim.exe, 0000000A.00000002.2118869310.000000D8E3235000.00000004.00000010.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D41C5000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D4318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Aim.exe, 0000000A.00000002.2119874133.0000026780001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerp^
Source: System23.exe, 00000020.00000002.2136002155.00000261D4318000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerXb
Source: System23.exe, 00000020.00000002.2136002155.00000261D4318000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D4061000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ### Program Manager ###
Source: System23.exe, 00000020.00000002.2136002155.00000261D41C5000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D43F5000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D4061000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager }
Source: System23.exe, 00000020.00000002.2136002155.00000261D41C5000.00000004.00000800.00020000.00000000.sdmp, System23.exe, 00000020.00000002.2136002155.00000261D42E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Users\user\Desktop\start.exe	Queries volume information: C:\Users\user\Desktop\start.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Aim.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\SysWOW64\winplay.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Aim.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Aim.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\System23.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Intel\Games\Common\Commonuodate.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\System23.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\System23.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\System23.exe VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\System32\LogonUI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation

Source: C:\Users\user\Desktop\start.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: System23.exe, 00000020.00000002.2178456711.00000261EC89E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s Defender\MsMpeng.exe
Source: System23.exe, 00000020.00000002.2173905762.00000261EC837000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\Aim.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\Aim.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\System23.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\System23.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 LSASS Driver	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 Credential API Hooking	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 LSASS Driver	1 Abuse Elevation Control Mechanism	LSASS Memory	113 System Information Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	1 DLL Side-Loading	11 Obfuscated Files or Information	Security Account Manager	631 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	21 Registry Run Keys / Startup Folder	12 Process Injection	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Scheduled Task/Job	1 Timestomp	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
start.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report start.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
start.exe