Edit tour

Windows Analysis Report
https://ortelia.com/download-ortelia-curator/

Overview

General Information

Sample URL:	https://ortelia.com/download-ortelia-curator/
Analysis ID:	1431415
Infos:

Detection

Havoc

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Havoc

Yara detected Generic Downloader

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://ortelia.com/download-ortelia-curator/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1952,i,16433353149473485546,11441211816697710933,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4324 --field-trial-handle=1952,i,16433353149473485546,11441211816697710933,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

CuratorSetup.exe (PID: 7976 cmdline: "C:\Users\user\Downloads\CuratorSetup.exe" MD5: C9ADE8D7F83B0C6A7B2A2C1C17F48E7C)

vc_redist.x64.exe (PID: 8188 cmdline: "C:\Program Files\Ortelia Curator\vc_redist.x64.exe" /silent MD5: 27B141AACC2777A82BB3FA9F6E5E5C1C)

vc_redist.x64.exe (PID: 1284 cmdline: "C:\Program Files\Ortelia Curator\vc_redist.x64.exe" /silent -burn.unelevated BurnPipe.{43283AE4-5BB8-44FA-9263-CFC3EA715B84} {2CADAC6A-0855-4F21-A415-28FC270B2FA9} 8188 MD5: 27B141AACC2777A82BB3FA9F6E5E5C1C)

OrteliaCurator.exe (PID: 7600 cmdline: "C:\Program Files\Ortelia Curator\OrteliaCurator.exe" MD5: F42024F641F5FA36B4EC8B7646CD737F)

UnityCrashHandler64.exe (PID: 7592 cmdline: "C:\Program Files\Ortelia Curator\UnityCrashHandler64.exe" --attach 7600 2993575759872 MD5: 49EA482DBE2AB3DA2A0768821AB77B03)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Havoc	Havoc is a modern and malleable post-exploitation command and control framework, created by @C5pider.	No Attribution	https://4pfsec.com/havoc-c2-first-look/ https://checkmarx.com/blog/first-known-targeted-oss-supply-chain-attacks-against-the-banking-sector/ https://github.com/HavocFramework/Havoc https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\Downloads\Unconfirmed 530961.crdownload	JoeSecurity_Havoc_1	Yara detected Havoc	Joe Security
C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\Downloads\Unconfirmed 530961.crdownload	JoeSecurity_Havoc_1	Yara detected Havoc	Joe Security
C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\Downloads\Unconfirmed 530961.crdownload	JoeSecurity_Havoc_1	Yara detected Havoc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000002.2623375955.000002BA62DC0000.00000002.00000001.00040000.00000019.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\AccentBeamShaper.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\AccentBeamSpot.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\AstralAxial18-34Zoomspot.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\AstralAxial22-44Zoomspot.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\Aureal_26_50_BeamShaper.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\Aureal_FrescoFlood.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\ellipsoidalFixedFL.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\ellipsoidalZoom.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\FrescoLEDWallWasher.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\fresnel.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\LEDWallWasher.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\PL1LEDLuminaire.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\PL1_20_50_Beam.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\PL3_NarrowBeam.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\PL3_WideBeamLED.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\scoop.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\SeleconDisplayLEDProfile.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\SeleconDisplayProfile_15_35.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\SeleconDisplayProfile_25_50.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\SeleconWingCDM.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\SeleconWingLinear.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Lights\SeleconWingTuneable.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Deep White.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Deep White.json
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Ornate 1.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Ornate 1.json
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Ornate 2.png
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Ornate 2.json
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Rustic Wood.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Rustic Wood.json
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Simple Maple.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Simple Maple.json
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Simple Oak.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Frames\Simple Oak.json
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\EmbedRuntime
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\EmbedRuntime\MonoPosixHelper.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0\Browsers
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0\Browsers\Compat.browser
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0\DefaultWsdlHelpGenerator.aspx
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0\machine.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0\settings.map
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\2.0\web.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0\Browsers
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0\Browsers\Compat.browser
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0\DefaultWsdlHelpGenerator.aspx
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0\machine.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0\settings.map
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.0\web.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5\Browsers
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5\machine.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5\settings.map
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\4.5\web.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\browscap.ini
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\mconfig
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\MonoBleedingEdge\etc\mono\mconfig\config.xml
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator.exe
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\blank.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\freeimage-license.txt
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\FFmpeg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\FFmpeg\blank.jpg
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\FFmpeg\ffmpeg-20160530-git-d74cc61.tar.xz
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\FFmpeg\ffmpeg.exe
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\pdf
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\pdf\elevation.css
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\pdf\source
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\pdf\source\libwkhtmltox-0.11.0_rc1.zip
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\pdf\wkhtmltopdf.exe
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\app.info
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\boot.config
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\globalgamemanagers
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\globalgamemanagers.assets
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\level0
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\level1
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\level2
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\level3
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Accessibility.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\AGM.EdgeDetection.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Assembly-CSharp-firstpass.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Assembly-CSharp.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Autodesk.Fbx.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\BakeryRuntimeAssembly.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Byn.Awrtc.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Byn.Awrtc.Native.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\CTCommon.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\FreeImageNET.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\I18N.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\I18N.West.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\ICSharpCode.SharpZipLib.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Mono.Data.Sqlite.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Mono.Posix.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Mono.Security.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Mono.WebBrowser.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\MoodkieSecurity.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\mscorlib.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\netstandard.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Ookii.Dialogs.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Photon3Unity3D.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PhotonChat.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PhotonRealtime.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PhotonUnityNetworking.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PhotonUnityNetworking.Utilities.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PhotonWebSocket.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PLUSManaged.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\PLUSManaged.XmlSerializers.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.ComponentModel.Composition.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.ComponentModel.DataAnnotations.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Configuration.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Core.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Data.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Design.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Diagnostics.StackTrace.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Drawing.Design.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Drawing.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.EnterpriseServices.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Globalization.Extensions.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.IO.Compression.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.IO.Compression.FileSystem.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Net.Http.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Numerics.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Runtime.Serialization.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Runtime.Serialization.Formatters.Soap.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Runtime.Serialization.Xml.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Security.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.ServiceModel.Internals.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Transactions.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Web.ApplicationServices.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Web.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Web.Services.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Windows.Forms.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Xml.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Xml.Linq.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.Xml.XPath.XDocument.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.Analytics.DataPrivacy.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.Formats.Fbx.Runtime.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.Postprocessing.Runtime.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.ProBuilder.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.ProBuilder.KdTree.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.ProBuilder.Poly2Tri.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.ProBuilder.Stl.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.Recorder.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.Recorder.Base.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.ScriptableBuildPipeline.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.TextMeshPro.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Unity.Timeline.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.AccessibilityModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.Advertisements.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.AIModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.AndroidJNIModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.AnimationModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ARModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.AssetBundleModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.AudioModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ClothModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ClusterInputModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ClusterRendererModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.CoreModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.CrashReportingModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.DirectorModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.DSPGraphModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.GameCenterModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.GridModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.HotReloadModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ImageConversionModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.IMGUIModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.InputLegacyModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.InputModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.JSONSerializeModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.LouserzationModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.Monetization.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ParticleSystemModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.PerformanceReportingModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.Physics2DModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.PhysicsModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ProfilerModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.Purchasing.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.ScreenCaptureModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.SharedInternalsModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.SpatialTracking.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.SpriteMaskModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.SpriteShapeModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.StreamingModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.SubstanceModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.SubsystemsModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.TerrainModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.TerrainPhysicsModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.TextCoreModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.TextRenderingModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.TilemapModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.TLSModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UI.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UIElementsModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UIModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UmbraModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UNETModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityAnalyticsModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityConnectModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityTestProtocolModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityWebRequestAssetBundleModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityWebRequestAudioModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityWebRequestModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityWebRequestTextureModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.UnityWebRequestWWWModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.VehiclesModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.VFXModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.VideoModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.VRModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.WindModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.XR.LegacyInputHelpers.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\UnityEngine.XRModule.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\Vectrosity.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\WebRtcCSharp.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\wrtc.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\assimp.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\FreeImage.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\libbrotli.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\libfastlz.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\liblz4.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\liblzma.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\libzipw.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\ProResToolbox.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\ProResWrapper.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\UnityFbxSdkNative.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Plugins\webrtccsharpwrap.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Resources
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Resources\unity default resources
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Resources\unity_builtin_extra
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\resources.assets
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\resources.assets.resS
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets0.assets
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets0.assets.resS
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets0.resource
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets1.assets
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets1.assets.resS
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets2.assets
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets2.assets.resS
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\sharedassets3.assets
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Spaces
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Spaces\Default.ocs
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Exh
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Exh\OrteliaDemo.exh
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\UnityCrashHandler64.exe
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\vc_redist.x64.exe
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\UnityPlayer.dll
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\Ortelia Curator.url
Source: C:\Users\user\Downloads\CuratorSetup.exe	Directory created: C:\Program Files\Ortelia Curator\uninst.exe

Source: C:\Users\user\Downloads\CuratorSetup.exe	File created: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\addons\freeimage-license.txt
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1028\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1029\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1031\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1036\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1040\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1041\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1042\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1045\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1046\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1049\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1055\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\2052\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\3082\license.rtf
Source: C:\Program Files\Ortelia Curator\vc_redist.x64.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\license.rtf

Source: unknown	HTTPS traffic detected: 23.46.188.128:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.188.128:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49749 version: TLS 1.2

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files\Ortelia Curator\OrteliaCurator_Data\Managed\System.dll, type: DROPPED
Source: Yara match	File source: 00000013.00000002.2623375955.000002BA62DC0000.00000002.00000001.00040000.00000019.sdmp, type: MEMORY

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.188.128
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	DNS traffic detected: DNS query: ortelia.com
Source: global traffic	DNS traffic detected: DNS query: d1f8f9xcsvx3ha.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.46.188.128:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.46.188.128:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49749 version: TLS 1.2

Source: classification engine

Classification label: mal52.troj.win@27/333@16/136