IOC Report
https://download.techsmith.com/camtasiastudio/releases/camtasia.exe

C:\Users\user\Desktop\cmdline.out

ASCII text, with CRLF line terminators

modified

C:\Users\user\Desktop\download\camtasia.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1028\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1029\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1030\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1031\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1032\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1035\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1036\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\Temp\{7E66493E-A433-47D4-9045-EEADE201F171}\.ba\1038\mbapreq.wxl

XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators

dropped

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://download.techsmith.com/camtasiastudio/releases/camtasia.exe" > cmdline.out 2>&1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\wget.exe

wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://download.techsmith.com/camtasiastudio/releases/camtasia.exe"

C:\Users\user\Desktop\download\camtasia.exe

C:\Users\user\Desktop\download\camtasia.exe

C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe

"C:\Windows\Temp\{CB5AD3D6-270A-4AB0-A898-D5E0F7C2252B}\.cr\camtasia.exe" -burn.clean.room="C:\Users\user\Desktop\download\camtasia.exe" -burn.filehandle.attached=180 -burn.filehandle.self=624

https://download.techsmith.com/camtasiastudio/releases/camtasia.exe

http://www.josbuivenga.demon.nlMuseo

unknown

http://foo/Images/MarketingAnimation/camtasia2.png

unknown

http://foo/install%20states/csisrunningusercontrol.xaml

unknown

https://www.techsmith.comd=

unknown

http://foo/bar/images/marketinganimation/desktop3.png

unknown

http://www.josbuivenga.demon.nl

unknown

http://www.marksimonson.comq

unknown

https://www.techsmith.com/redirect.asp?target=windowsninstall&product=camtasiastudio&ver=22.3.0&lang

unknown

https://support.techsmith.com/hc/de/articles/203732668

unknown

http://foo/Images/MarketingAnimation/desktop3.png

unknown