Edit tour

Windows Analysis Report
https://swishmax.en.download.it/

Overview

General Information

Sample URL:	https://swishmax.en.download.it/
Analysis ID:	1503745
Infos:

Detection

LummaC Stealer, PureLog Stealer

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Yara detected LummaC Stealer

Yara detected PureLog Stealer

Changes security center settings (notifications, updates, antivirus, firewall)

HTML page contains obfuscated javascript

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs Task Scheduler Managed Wrapper

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Potential browser exploit detected (process start blacklist hit)

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

query blbeacon for getting browser version

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://swishmax.en.download.it/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2032,i,1623904719579720976,13038655480931030212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6028 --field-trial-handle=2032,i,1623904719579720976,13038655480931030212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 5452 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 2972 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 1832 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3740 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1132 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 448 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 6372 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7352 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rundll32.exe (PID: 7980 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

swishmax_lYJ4-o1.exe (PID: 6404 cmdline: "C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" MD5: 4CEF35CB56164E4427C8890CF5CDFD85)

swishmax_lYJ4-o1.tmp (PID: 7684 cmdline: "C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp" /SL5="$3033E,1583588,832512,C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" MD5: 02B1D8FF84BCD4EBCB01156636269B99)

swishmax_lYJ4-o1.exe (PID: 8120 cmdline: "C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" /SPAWNWND=$802CA /NOTIFYWND=$3033E MD5: 4CEF35CB56164E4427C8890CF5CDFD85)

swishmax_lYJ4-o1.tmp (PID: 3916 cmdline: "C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp" /SL5="$5031E,1583588,832512,C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" /SPAWNWND=$802CA /NOTIFYWND=$3033E MD5: 02B1D8FF84BCD4EBCB01156636269B99)

prod0.exe (PID: 2424 cmdline: "C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100" -i -v -d -se=true MD5: 03228A9B975C727999E361D9CE6EBAA4)

fqkw4q2n.exe (PID: 2332 cmdline: "C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe" /silent MD5: 6F4BCF7A400733C5EF54E0211D6C76DA)

UnifiedStub-installer.exe (PID: 6416 cmdline: .\UnifiedStub-installer.exe /silent MD5: 493D5868E37861C6492F3AC509BED205)

rsSyncSvc.exe (PID: 4864 cmdline: "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10 MD5: F2738D0A3DF39A5590C243025D9ECBDA)

conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

swishmax.exe (PID: 2908 cmdline: "C:\Users\user\Downloads\swishmax.exe" MD5: 498BACF9A5D17343DB31F4E82B02A4E5)

SwishMax.exe (PID: 1312 cmdline: "C:\Program Files (x86)\SWiSHmax\SwishMax.exe" MD5: C5E1EF93015F08D704B6AFD75FEB1CAB)

chrome.exe (PID: 7484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://support.swishzone.com/unlock.asp?SC=KLW05TBPCE188293KCDN8CNDBW1J4CFF&AU=0&af_id=0&LI=(1000)&A=T MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1136 --field-trial-handle=1896,i,18019545214128525578,8279128784868571556,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://support.swishzone.com/unlock.asp?SC=KLW05TBPCE188293KCDN8CNDBW1J4CFF&AU=0&af_id=0&LI=(1000)&A=T MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4572 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1960,i,9594309237064165500,17486205616089957152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://support.swishzone.com/unlock.asp?SC=KLW05TBPCE188293KCDN8CNDBW1J4CFF&AU=0&af_id=0&LI=(1000)&A=T MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,13477816198588736164,16649535004875598353,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

iexplore.exe (PID: 7816 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" "http://www.swishzone.com/install.php?pid=4&unlockproc=3" MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 7532 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7816 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 2400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50326 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 8140 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50326 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2148,i,11689891289442087296,15668555040493983723,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 4912 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

chrome.exe (PID: 7892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://en.download.it/?typ=1 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1792,i,1724568342697156793,9729976537374896436,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WerFault.exe (PID: 5796 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1052 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3048 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 2548 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rsSyncSvc.exe (PID: 4060 cmdline: "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10 MD5: F2738D0A3DF39A5590C243025D9ECBDA)

svchost.exe (PID: 3436 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 8180 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3916 -ip 3916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1344 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3916 -ip 3916 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 3936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50326 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2140,i,15389772000054879268,6666458068428128636,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5816 --field-trial-handle=2140,i,15389772000054879268,6666458068428128636,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libGLESv2.dll	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.1838313020.0000000002F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000016.00000003.1838313020.0000000002F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000018.00000002.2752039203.000001B918477000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7816 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 7532, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 4912, ProcessName: ssvagent.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 5452, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Downloads\Unconfirmed 135410.crdownload

Avira: detection malicious, Label: PUA/OfferCore.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Downloads\Unconfirmed 135410.crdownload	ReversingLabs: Detection: 50%
Source: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	ReversingLabs: Detection: 17%

Phishing

HTML page contains obfuscated javascript

Source: https://cdn.download.it/js/ctp.js?v=1722518856266

HTTP Parser: function a0_0x129c(_0x18090f,_0x1c2176){var _0x2911f7=a0_0x2911();return a0_0x129c=function(_0x129c1

Source: https://swishmax.en.download.it/

HTTP Parser: Base64 decoded: 1725395422.000000

Source: https://swishmax.en.download.it/download	HTTP Parser: No favicon
Source: https://swishmax.en.download.it/download	HTTP Parser: No favicon
Source: https://swishmax.en.download.it/download	HTTP Parser: No favicon
Source: https://swishmax.en.download.it/downloading	HTTP Parser: No favicon
Source: https://swishmax.en.download.it/downloading	HTTP Parser: No favicon
Source: https://swishmax.en.download.it/downloading	HTTP Parser: No favicon
Source: https://swishmax.en.download.it/downloading	HTTP Parser: No favicon

Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.6
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.6\Stub.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\resources
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\chrome_100_percent.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\chrome_200_percent.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\icudtl.dat
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\LICENSE
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\LICENSES.chromium.html
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\af.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\am.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ar.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\bg.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\bn.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ca.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\cs.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\da.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\de.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\el.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\en-GB.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\en-US.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\es-419.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\es.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\et.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\fa.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\fi.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\fil.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\fr.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\gu.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\he.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\hi.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\hr.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\hu.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\id.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\it.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ja.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\kn.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ko.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\lt.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\lv.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ml.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\mr.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ms.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\nb.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\nl.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\pl.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\pt-BR.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\pt-PT.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ro.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ru.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\sk.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\sl.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\sr.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\sv.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\sw.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ta.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\te.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\th.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\tr.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\uk.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\ur.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\vi.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\zh-CN.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\locales\zh-TW.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\resources.pak
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\resources\app.asar
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\resources\app.asar.sig
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\snapshot_blob.bin
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\v8_context_snapshot.bin
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\version
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\vk_swiftshader_icd.json
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\d3dcompiler_47.dll
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libEGL.dll
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libGLESv2.dll
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe

Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.26.92:443 -> 192.168.2.16:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.16:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.16:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.88.65.152:443 -> 192.168.2.16:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.88.65.152:443 -> 192.168.2.16:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.189.105:443 -> 192.168.2.16:49969 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32

Source: C:\Users\user\Downloads\swishmax.exe	File opened: C:\Users\user
Source: C:\Users\user\Downloads\swishmax.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\Downloads\swishmax.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Users\user\Downloads\swishmax.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\Downloads\swishmax.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\Downloads\swishmax.exe	File opened: C:\Users\user\AppData

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 00000016.00000003.1838313020.0000000002F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 03 Sep 2024 20:31:07 GMTContent-Type: application/octet-streamContent-Length: 9798877Last-Modified: Thu, 28 Apr 2016 12:07:19 GMTConnection: keep-aliveETag: "5721fcf7-9584dd"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 42 b2 b3 39 06 d3 dd 6a 06 d3 dd 6a 06 d3 dd 6a 7d cf d1 6a 07 d3 dd 6a ee cc d7 6a 4e d3 dd 6a 85 cf d3 6a 12 d3 dd 6a f9 f3 d6 6a 07 d3 dd 6a f9 f3 d7 6a 01 d3 dd 6a 64 cc ce 6a 01 d3 dd 6a 06 d3 dc 6a 53 d3 dd 6a ee cc d6 6a 03 d3 dd 6a be d5 db 6a 07 d3 dd 6a 52 69 63 68 06 d3 dd 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e7 c9 6c 3e 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 c0 00 00 00 30 00 00 00 00 00 00 6b 64 00 00 00 10 00 00 00 d0 00 00 00 00 40 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 01 00 00 10 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d0 d5 00 00 50 00 00 00 00 00 01 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f5 b0 00 00 00 10 00 00 00 c0 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e 0d 00 00 00 d0 00 00 00 10 00 00 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ac 19 00 00 00 e0 00 00 00 10 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 00 01 00 00 10 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 51.124.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134

Source: global traffic

HTTP traffic detected: GET /US/swishmax.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: dl.jalecdn.com

Source: global traffic	DNS traffic detected: DNS query: swishmax.en.download.it
Source: global traffic	DNS traffic detected: DNS query: cdn.download.it
Source: global traffic	DNS traffic detected: DNS query: cmp.quantcast.com
Source: global traffic	DNS traffic detected: DNS query: www.statcounter.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: c.statcounter.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: cmp.inmobi.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ep1.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: ep2.adtrafficquality.google
Source: global traffic	DNS traffic detected: DNS query: d2jb0me8mxi5vc.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: 8proof.com
Source: global traffic	DNS traffic detected: DNS query: d1e9165hyidvf5.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: dl.jalecdn.com
Source: global traffic	DNS traffic detected: DNS query: shield.reasonsecurity.com
Source: global traffic	DNS traffic detected: DNS query: en.download.it
Source: global traffic	DNS traffic detected: DNS query: track.analytics-data.io
Source: global traffic	DNS traffic detected: DNS query: update.reasonsecurity.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.16:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.119.249.228:443 -> 192.168.2.16:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.124.78.146:443 -> 192.168.2.16:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.26.92:443 -> 192.168.2.16:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.16:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.16:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.16:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.244.20.27:443 -> 192.168.2.16:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.88.65.152:443 -> 192.168.2.16:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.88.65.152:443 -> 192.168.2.16:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.189.105:443 -> 192.168.2.16:49969 version: TLS 1.2

Source: C:\Users\user\Downloads\swishmax.exe

File created: C:\Windows\unvise32.exe

Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1052

Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp

Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version

Source: classification engine

Classification label: mal96.phis.troj.spyw.evad.win@87/725@66/299

Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe

File created: C:\Program Files\ReasonLabs

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\_rsStubExecute
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\{909a0a8a-0a1e-480c-ac4c-0d932cdcb16b}Installer
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Mutant created: \Sessions\1\BaseNamedObjects\{909a0a8a-0a1e-480c-ac4c-0d932cdcb16b}Installer

Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe

File created: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp

Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%EPP%'
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%EPP%'
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%EPP%'
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessId FROM Win32_Process WHERE (Name='rsAppUI.exe' OR Name='ReasonLabs.exe') AND CommandLine Like '%EPP%'

Source: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://swishmax.en.download.it/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2032,i,1623904719579720976,13038655480931030212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2032,i,1623904719579720976,13038655480931030212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6028 --field-trial-handle=2032,i,1623904719579720976,13038655480931030212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe "C:\Users\user\Downloads\swishmax_lYJ4-o1.exe"
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp "C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp" /SL5="$3033E,1583588,832512,C:\Users\user\Downloads\swishmax_lYJ4-o1.exe"
Source: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe "C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" /SPAWNWND=$802CA /NOTIFYWND=$3033E
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp "C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp" /SL5="$5031E,1583588,832512,C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" /SPAWNWND=$802CA /NOTIFYWND=$3033E
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6028 --field-trial-handle=2032,i,1623904719579720976,13038655480931030212,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp "C:\Users\user\AppData\Local\Temp\is-L5F1F.tmp\swishmax_lYJ4-o1.tmp" /SL5="$3033E,1583588,832512,C:\Users\user\Downloads\swishmax_lYJ4-o1.exe"
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp "C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp" /SL5="$5031E,1583588,832512,C:\Users\user\Downloads\swishmax_lYJ4-o1.exe" /SPAWNWND=$802CA /NOTIFYWND=$3033E
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100" -i -v -d -se=true
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Process created: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe "C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe" /silent
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Users\user\Downloads\swishmax.exe "C:\Users\user\Downloads\swishmax.exe"
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe .\UnifiedStub-installer.exe /silent
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://en.download.it/?typ=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1792,i,1724568342697156793,9729976537374896436,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1052
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3916 -ip 3916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 2548
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240903163150&oc=ZB_RAV_Cross_Tri_NCB&p=f4cc&a=100" -i -v -d -se=true
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Users\user\Downloads\swishmax.exe "C:\Users\user\Downloads\swishmax.exe"
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://en.download.it/?typ=1
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Process created: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe "C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe" /silent
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe .\UnifiedStub-installer.exe /silent
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Source: C:\Users\user\Downloads\swishmax.exe	Process created: C:\Program Files (x86)\SWiSHmax\SwishMax.exe "C:\Program Files (x86)\SWiSHmax\SwishMax.exe"
Source: C:\Users\user\Downloads\swishmax.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" "http://www.swishzone.com/install.php?pid=4&unlockproc=3"
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7816 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50326
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50326
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2148,i,11689891289442087296,15668555040493983723,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=50326 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2140,i,15389772000054879268,6666458068428128636,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5816 --field-trial-handle=2140,i,15389772000054879268,6666458068428128636,262144 /prefetch:8
Source: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://support.swishzone.com/unlock.asp?SC=KLW05TBPCE188293KCDN8CNDBW1J4CFF&AU=0&af_id=0&LI=(1000)&A=T
Source: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://support.swishzone.com/unlock.asp?SC=KLW05TBPCE188293KCDN8CNDBW1J4CFF&AU=0&af_id=0&LI=(1000)&A=T
Source: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://support.swishzone.com/unlock.asp?SC=KLW05TBPCE188293KCDN8CNDBW1J4CFF&AU=0&af_id=0&LI=(1000)&A=T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1136 --field-trial-handle=1896,i,18019545214128525578,8279128784868571556,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1960,i,9594309237064165500,17486205616089957152,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,13477816198588736164,16649535004875598353,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3916 -ip 3916
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\Downloads\swishmax.exe	Process created: C:\Program Files (x86)\SWiSHmax\SwishMax.exe "C:\Program Files (x86)\SWiSHmax\SwishMax.exe"
Source: C:\Users\user\Downloads\swishmax.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" "http://www.swishzone.com/install.php?pid=4&unlockproc=3"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3916 -ip 3916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1052
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3916 -ip 3916
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 2548

Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	File created: C:\Users\user\Downloads\swishmax.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	File created: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\uninstall-dns.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 135410.crdownload	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\x64\Reason.ArchiveUtility-x64.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Users\user\AppData\Local\Temp\~vis0000\visetool.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ARM64\Reason.ArchiveUtility-ARM64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Program Files (x86)\SWiSHmax\SWiSHpla.exe	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax_lYJ4-o1.exe	File created: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Users\user\AppData\Local\Temp\~vis0000\vise32ex.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsDatabase.dll	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\5c302f84-25cb-47f2-b9aa-3998a4faa5ec.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\Helper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Users\user\AppData\Local\Temp\~vis0000\rebootnt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Program Files (x86)\SWiSHmax\lame_enc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-CN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\is-UC7A2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	File created: C:\Users\user\AppData\Local\Temp\~vis0000\uninst32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\uninstall-vpn.exe	Jump to dropped file
Source: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	File created: C:\Users\user\AppData\Local\Temp\swlpi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Memory allocated: 17B81800000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Memory allocated: 17B99940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Memory allocated: 1B972D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Memory allocated: 1B974770000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Window / User API: threadDelayed 9039
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Window / User API: threadDelayed 805
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Window / User API: threadDelayed 2103
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Window / User API: threadDelayed 7493

Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\uninstall-dns.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~vis0000\visetool.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\x64\Reason.ArchiveUtility-x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ARM64\Reason.ArchiveUtility-ARM64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SWiSHmax\SWiSHpla.exe	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~vis0000\vise32ex.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\Helper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~vis0000\rebootnt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	Dropped PE file which has not been started: C:\Program Files (x86)\SWiSHmax\lame_enc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-CN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\Downloads\swishmax.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\~vis0000\uninst32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Dropped PE file which has not been started: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\uninstall-vpn.exe	Jump to dropped file
Source: C:\Program Files (x86)\SWiSHmax\SwishMax.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\swlpi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp TID: 7728	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp TID: 3960	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp TID: 4808	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp TID: 3920	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe TID: 2044	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe TID: 2504	Thread sleep count: 9039 > 30
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe TID: 2504	Thread sleep count: 805 > 30
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe TID: 4712	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe TID: 7876	Thread sleep count: 2103 > 30
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe TID: 7876	Thread sleep count: 7493 > 30
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Users\user\Downloads\swishmax.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\swishmax.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Downloads\swishmax.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\loader.gif VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\mainlogo.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\RAV_Cross.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\WebAdvisor.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\finish.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-822OR.tmp\prod0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsStubLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsLogger.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsAtom.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Users\user\Downloads\swishmax.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Downloads\swishmax.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'

Source: Yara match	File source: C:\Program Files\ReasonLabs\Common\Client\v1.6.0\libGLESv2.dll, type: DROPPED
Source: Yara match	File source: 00000018.00000002.2752039203.000001B918477000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
1 Software	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Windows Service	1 DLL Side-Loading	LSASS Memory	44 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Process Injection	13 Masquerading	Security Account Manager	15 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Scheduled Task/Job	71 Virtualization/Sandbox Evasion	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	11 Process Injection	LSA Secrets	71 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rundll32	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label
C:\Users\user\Downloads\Unconfirmed 135410.crdownload	100%	Avira	PUA/OfferCore.Gen
C:\Users\user\AppData\Local\Temp\is-822OR.tmp\Helper.dll	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-822OR.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TV7AU.tmp\swishmax_lYJ4-o1.tmp	0%	ReversingLabs
C:\Users\user\Downloads\Unconfirmed 135410.crdownload	50%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	0%	ReversingLabs
C:\Program Files\ReasonLabs\EPP\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ARM64\Reason.ArchiveUtility-ARM64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Microsoft.Win32.TaskScheduler.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\System.Data.SQLite.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\System.ValueTuple.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\UnifiedStub-installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\cs-CZ\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\da-DK\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\de-DE\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\de\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\el-GR\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\es-ES\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\es\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fi-FI\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fr-FR\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\fr\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hi-IN\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hr-HR\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\hu-HU\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\id-ID\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\it-IT\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\it\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ja-JP\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ko-KR\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\nb-NO\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\nl-NL\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pl-PL\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pl\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt-BR\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt-PT\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\pt\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ro-RO\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsAtom.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsDatabase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsJSON.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsLogger.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsStubLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\rsTime.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ru-RU\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\ru\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sk-SK\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sl-SI\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sl\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\sv-SE\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\th-TH\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\tr-TR\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\uninstall-dns.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\uninstall-vpn.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\vi-VN\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\x64\Reason.ArchiveUtility-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-CN\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC1950D5E\zh-TW\UnifiedStub.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\~vis0000\rebootnt.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\~vis0000\uninst32.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\~vis0000\vise32ex.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\~vis0000\visetool.dll	0%	ReversingLabs
C:\Users\user\Downloads\swishmax.exe	0%	ReversingLabs
C:\Program Files (x86)\SWiSHmax\SWiSHpla.exe	0%	ReversingLabs
C:\Program Files (x86)\SWiSHmax\SwishMax.exe	18%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\SWiSHmax\lame_enc.dll	0%	ReversingLabs
C:\Program Files\ReasonLabs\Common\Client\v1.6.0\ffmpeg.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
static.cloudflareinsights.com	104.16.80.73	true	false	unknown
c.statcounter.com	104.20.94.138	true	false	unknown
ep1.adtrafficquality.google	142.250.185.130	true	false	unknown
cmp.quantcast.com	18.245.86.24	true	false	unknown
8proof.com	52.116.53.150	true	false	unknown
d2jb0me8mxi5vc.cloudfront.net	18.239.102.195	true	false	unknown
dl.jalecdn.com	95.168.168.24	true	false	unknown
ep2.adtrafficquality.google	142.250.186.161	true	false	unknown
en.download.it	104.22.56.224	true	false	unknown
stats.g.doubleclick.net	64.233.184.154	true	false	unknown
atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com	54.88.65.152	true	false	unknown
cdn.download.it	172.67.26.92	true	false	unknown
googleads.g.doubleclick.net	142.250.186.66	true	false	unknown
swishmax.en.download.it	104.22.56.224	true	false	unknown
analytics.google.com	142.250.186.142	true	false	unknown
td.doubleclick.net	142.250.186.162	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
d1e9165hyidvf5.cloudfront.net	18.244.20.27	true	false	unknown
www.statcounter.com	104.20.94.138	true	false	unknown
d2ozbumhc9y601.cloudfront.net	13.224.189.105	true	false	unknown
d23sp3kzv1t6m5.cloudfront.net	18.239.36.97	true	false	unknown
d14mh4uvqj4iiz.cloudfront.net	18.172.112.34	true	false	unknown
update.reasonsecurity.com	unknown	unknown	false	unknown
shield.reasonsecurity.com	unknown	unknown	false	unknown
track.analytics-data.io	unknown	unknown	false	unknown
cmp.inmobi.com	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
13.224.189.105	d2ozbumhc9y601.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.226	unknown	United States	15169	GOOGLEUS	false
185.166.36.92	unknown	Spain	201942	SOLTIAES	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
104.22.57.224	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.184.226	unknown	United States	15169	GOOGLEUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.23.209.183	unknown	European Union	1273	CWVodafoneGroupPLCEU	false
104.22.56.224	en.download.it	United States	13335	CLOUDFLARENETUS	false
18.245.86.24	cmp.quantcast.com	United States	16509	AMAZON-02US	false
18.239.94.122	unknown	United States	16509	AMAZON-02US	false
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
172.217.18.8	unknown	United States	15169	GOOGLEUS	false
13.107.21.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.239.36.14	unknown	United States	16509	AMAZON-02US	false
18.239.102.195	d2jb0me8mxi5vc.cloudfront.net	United States	16509	AMAZON-02US	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
172.217.18.1	unknown	United States	15169	GOOGLEUS	false
18.239.36.97	d23sp3kzv1t6m5.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.185.193	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
104.20.95.138	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.142	analytics.google.com	United States	15169	GOOGLEUS	false
142.250.184.234	unknown	United States	15169	GOOGLEUS	false
52.116.53.150	8proof.com	United States	36351	SOFTLAYERUS	false
216.58.206.74	unknown	United States	15169	GOOGLEUS	false
142.250.186.174	unknown	United States	15169	GOOGLEUS	false
142.250.186.130	unknown	United States	15169	GOOGLEUS	false
216.58.206.34	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
64.233.184.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.26.5.102	unknown	United States	13335	CLOUDFLARENETUS	false
18.172.112.34	d14mh4uvqj4iiz.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.20.94.138	c.statcounter.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.232	unknown	United States	15169	GOOGLEUS	false
95.168.168.24	dl.jalecdn.com	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
54.88.65.152	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.16.79.73	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
216.239.36.178	unknown	United States	15169	GOOGLEUS	false
18.244.20.27	d1e9165hyidvf5.cloudfront.net	United States	16509	AMAZON-02US	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.98	unknown	United States	15169	GOOGLEUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
172.217.18.27	unknown	United States	15169	GOOGLEUS	false
40.126.32.134	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.161	ep2.adtrafficquality.google	United States	15169	GOOGLEUS	false
142.250.186.162	td.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
20.189.173.20	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.67.26.92	cdn.download.it	United States	13335	CLOUDFLARENETUS	false
142.250.186.129	unknown	United States	15169	GOOGLEUS	false
184.28.89.167	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.130	ep1.adtrafficquality.google	United States	15169	GOOGLEUS	false
52.123.224.70	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.26.4.102	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.66	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503745
Start date and time:	2024-09-03 22:29:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://swishmax.en.download.it/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	56
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Detection:	MAL
Classification:	mal96.phis.troj.spyw.evad.win@87/725@66/299

Input	Output
URL: https://swishmax.en.download.it/ Model: jbxai	{ "brand":["Download.it"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://swishmax.en.download.it/ Model: jbxai	{ "brand":["Download.it", "Scilv.re"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://swishmax.en.download.it/download Model: jbxai	{ "brand":["Download.it"], "contains_trigger_text":false, "prominent_button_name":"Start Download", "text_input_field_labels":["Search Software", "APPs STREAMING", "Windows > Design & photography > Web > SWi5Hmax2 Cownloaci a SWiSHmax2"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://swishmax.en.download.it/downloading Model: jbxai	{ "brand":["Download.it", "SWiSHmax2"], "contains_trigger_text":false, "prominent_button_name":"Download", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://swishmax.en.download.it/downloading Model: jbxai	{ "brand":["Download.it", "SWi5Hmax2"], "contains_trigger_text":false, "prominent_button_name":"unknown", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://swishmax.en.download.it/download Model: jbxai	{ "brand":["Opera"], "contains_trigger_text":false, "prominent_button_name":"Free download", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Users\user\Downloads\swishmax.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25774
Entropy (8bit):	4.669295092519523
Encrypted:	false
SSDEEP:
MD5:	BC400BC21422F9A92E76EC2C5167CA2E
SHA1:	01FD3D9BEE36CA5D9683C6CDD6B3085C8F10C32B
SHA-256:	AA092600E3F475F0A55821FB9C529583D8E23E41BF0461254F02FCF94D3A32C2
SHA-512:	D86D9CD362D570AA7744BEC602846444FD3CD4ED6FF942D8469741800EF8D00F2574F1C36A23C3B883811AC63A4FCEE19C0B462DFC9B85B2B783D96F7F79C03C
Malicious:	false
Reputation:	unknown
Preview:	.. GNU LIBRARY GENERAL PUBLIC LICENSE.... Version 2, June 1991.... Copyright (C) 1991 Free Software Foundation, Inc... .. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed.....[This is the first released version of the library GPL. It is.. numbered 2 because it goes with version 2 of the ordinary GPL.]....... Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..Licenses are intended to guarantee your freedom to share and change..free software--to make sure the software is free for all its users..... This license, the Library General Public License, applies to some..specially designated Free Software Foundation software, and to any..other libraries whose authors decide to use it. You can use it for..your libraries, too..... When we speak of free sof

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3633809396076542
Encrypted:	false
SSDEEP:
MD5:	71EC54DF512A9A5C2C545F9820224F8A
SHA1:	14CB3413F991E728A8C4D0FF8922113F1836FB07
SHA-256:	6C6B99C7F4725AD8770D1BD24BFBA5F6FC42100AAD3DE5B66EB9EE0D0DA2A131
SHA-512:	604F7608363583FB2A50458582B3585A979BDDC47EF65D5FBE66BA10AE26FF9EE275D7F6586A9F764E4B3E603E074DF783B943B3AC4FDB6A4AB8CEA723D3F78C
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.9.8.6.9.0.8.4.2.3.6.4.5.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.9.8.6.9.0.8.4.8.8.6.4.5.0.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.7.9.6.a.4.f.-.a.1.4.e.-.4.1.b.8.-.8.d.6.3.-.f.7.8.5.a.1.3.7.d.a.8.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.b.d.3.f.2.1.-.e.7.e.9.-.4.2.e.7.-.8.1.d.7.-.c.e.c.1.e.e.a.a.a.8.b.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.w.i.s.h.m.a.x._.l.Y.J.4.-.o.1...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.4.c.-.0.0.0.1.-.0.0.1.6.-.5.2.5.9.-.2.8.2.8.4.0.f.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.0.6.d.2.3.2.4.3.5.2.f.c.3.c.b.b.e.1.a.8.3.d.e.0.e.3.c.9.3.6.8.0.0.0.0.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://swishmax.en.download.it/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Program Files (x86)\SWiSHmax\LPGL.txt

C:\Program Files (x86)\SWiSHmax\MaxRegMD5Update.reg

C:\Program Files (x86)\SWiSHmax\SWITemplates\Button 1 (120 x 90).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Button 2 (120 x 60).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Full Banner (468 x 60).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Half Banner (234 x 60).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Large Rectangle (336 x 280).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Medium Rectangle (300 x 250).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Micro Bar (88 x 31).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Rectangle (180 x 150).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Skyscraper (120x600).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Square Button (125x125).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Square Pop-Up (250x250).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Vertical Banner (120x240).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Vertical Rectangle (240x400).swi

C:\Program Files (x86)\SWiSHmax\SWITemplates\Wide Skyscraper (160x600).swi

C:\Program Files (x86)\SWiSHmax\SWiSHpla.exe

C:\Program Files (x86)\SWiSHmax\SwishMax.chm

C:\Program Files (x86)\SWiSHmax\SwishMax.exe

C:\Program Files (x86)\SWiSHmax\cmdfile.txt

C:\Program Files (x86)\SWiSHmax\cmdfile1.txt

C:\Program Files (x86)\SWiSHmax\effects\Appear into position\3D Spin in and grow.sfx

C:\Program Files (x86)\SWiSHmax\effects\Appear into position\3D Spin in and shrink.sfx

Windows Analysis Report
https://swishmax.en.download.it/

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	54134
Entropy (8bit):	3.040677677168391
Encrypted:	false
SSDEEP:
MD5:	E21E9FD51F88A88EB241A613E84040A9
SHA1:	3B60D84F88765673E027C863E09303BD0568BDDE
SHA-256:	6019371FF1449522CED650682AB4BBB5648C08C2A81EB56BE72DB18160FD8C09
SHA-512:	EF70C2781BB3BDF7AD47787985E2F8FA9B9944B220DC3C4A51C765172CA51E7D69E4DBD4104B0FA8E7F122754ECB3026DEEA44277977B760700343C154F809CF
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58109
Entropy (8bit):	6.1062639741194245
Encrypted:	false
SSDEEP:
MD5:	F584CACF6DC8CB4BCA188B30ADAEE45B
SHA1:	E8911EAF185BE3624BE28F2997889387C4373AF4
SHA-256:	44F88EA5B75B6EBEDDC3AA9D58CFD2C764C988742222B942A9E3C36F72C8CE85
SHA-512:	620D2667A625E2EA83767247737D2A05B6EB5B441A716993BBD5AF7AE862BEB7D4AF49730F6C0C4D62BBF2A67A4406888E1650C18F3E8A09FA71C2C388D612D9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	1426
Entropy (8bit):	7.47091092613653
Encrypted:	false
SSDEEP:
MD5:	5E0B91D93EB8C41D99880817ADB8A663
SHA1:	60815F35E237AF890286F20B4BEA452FE87D96DB
SHA-256:	298284CD2412C64DA9ACF70717ADEB0893C40965D938EE2D667DE1D7C5FAD653
SHA-512:	61AB65109B17D7049EDB5FAFA4F5A814F9352E989F2759BA60BC7F1AB774037D8EB6817236B60FB09937472EE1230C85D6C4569BE59659A12D2D939A875C05BA
Malicious:	false
Reputation:	unknown
Preview:	........J.h.t.t.p.s.:././.w.w.w...s.w.i.s.h.z.o.n.e...c.o.m./.w.p.-.c.o.n.t.e.n.t./.u.p.l.o.a.d.s./.2.0.2.1./.0.1./.f.a.v.i.c.o.n.-.s.w.i.s.h.z.o.n.e...p.n.g......PNG........IHDR... ... .....szz.....sBIT....\|.d.....pHYs..........+......tEXtSoftware.www.inkscape.org..<....MIDATX..]l.U...gvWh....!B..Qi.mu.n....v...<h.11Q0.5~$..H4j...../..&$.l...@lg.b;.}...}.P.B....C.X..$...nr.s.o.3.^.l..{. .0F..wc..N>.8.s. .^.n[3.g.N.8.P0....Z........p.P......q%...E"Y..3..^......h...c;....A@.o..P......r.?.RN...E"....h.{..3..h....-.9....l'..Y5e...g....]y.I.T....N....O`ud.#.).........uA.Ta..e.8......D.y.P...b.z%.n...g...o...P....y..+....6.\|xl.y..E&..h9Z....J.V}...h$r..S...T<..K....P..2+ll:.TN.t......~.....]...ckK..v......#..\|.)..lp...3c....&j.Tx......M4....].UE.h.q...n1.......A].....l.....1OG..."..\|......T.....9E.......`v%.; .\|.%.....Z.....v.fJ.y..Dn...2.[..>.o.\.p...,cu:....W.G/.E.]..J.C...A8b.=.5.z... .oc.....WX'...T..J9... ....D......Z.r..vv.....MF._....W......

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

Process:	C:\Users\user\AppData\Local\Temp\fqkw4q2n.exe
File Type:	PE32+ executable (DLL) (GUI) Aarch64, for MS Windows
Category:	dropped
Size (bytes):	148352
Entropy (8bit):	6.270407908600138
Encrypted:	false
SSDEEP:
MD5:	084B3EBB27DA692C90CCC83A765E8B2E
SHA1:	0C3062B13896FEEFE052D196EC9606FA76670A86
SHA-256:	DBB2C00B06B818D5DA88954EDDD9C7B8911A748B1E8C853B9DA7FAAACDBE536D
SHA-512:	F8FB5106749AE7013474F35AD0DC0711B991E907AA2DF9B044F8240FA54633DE370FDAC50C73C2943DB384D06B95B5FF563EBFE5EA2E49268DB5D3DF74B7C120
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........nT.y...y...y.......y......my.......y......y......y..*....y.......y...y...y.......y.......y.......y.......y...y...y.......y..Rich.y..........................PE..d...j..f.........." ...(.^..........(........................................`............`.................................................,...(....@.......0..X........=...P..@.......T...............................@............p.. ............................text....].......^.................. ..`.rdata..^\|...p...~...b..............@..@.data....:..........................@....pdata..X....0......................@..@.rsrc........@......................@..@.reloc..@....P......................@..B................................................................................................................................................................................................................

Process:	C:\Users\user\Downloads\swishmax_lYJ4-o1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.32507380865548
Encrypted:	false
SSDEEP:
MD5:	02B1D8FF84BCD4EBCB01156636269B99
SHA1:	15BA86430B90264DA7D9F2C05BE57C56640D4BA9
SHA-256:	A6497DDDDD577CAEFE5A39958A604F9EE4BFE93E9DA285B147BA6FC6788E75CA
SHA-512:	640227915B78FB8E0FD8E6A6CA883E4ED4E3FA45524FCA5A9344C067840B3FC11C7B98FD05351EABAEE3D4AFA21711DC0999175CBC154D13B02135706EF5B47A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Sep 3 19:30:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9944843787690845
Encrypted:	false
SSDEEP:
MD5:	C4F80DABB9CA90965CB6C154DE1C873B
SHA1:	8E4112A0E7044AE93AB373BCBBF636B676617228
SHA-256:	1146CBD70BC4FEE0C5D676A594A695B45810F180BBB1C9FFA55FF51AC5B0A711
SHA-512:	6D438DA8BDF262017329AE3096FF44A6A6BB892F2F1712E9DDA0DEE72593D0EF7076E2ABC76FC1AF2682E48059D3A9D02EB698D9EBC82C36D91760DA5A129C35
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....m=?.@...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I#Y.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V#Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V#Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V#Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V#Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............=.N.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	4926
Entropy (8bit):	3.2447221859535484
Encrypted:	false
SSDEEP:
MD5:	10B3FF726E10865DF151F12DABFEE15C
SHA1:	083F82A80E8AE8CC0D1F4A2076F5A2E03BA14EE2
SHA-256:	1350FC063A786504B124B2946AB5DEDADC2095DD8BD49BE5CAC22FFF558A461B
SHA-512:	63E06EFFFFB3EBBE69257D738AF52F87D1903FC16C69B6AF7D85B465627D522E9404D5254D0FD5600838B46531F0A8D546D1C16F1EC26475FD40C49EF5C1482F
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre