Treasure

TLDR: I can’t say for 100% sure, but there are multiple reasons to believe that this is malware.

Long version: I’m seeing multiple suspicious things here.

• The IPs being connected to are part of some hoster and have some abuse reports: https://www.abuseipdb.com/check-block/217.20.58.98/29

• The domain being resolved is qcloud[.]com, which belongs to Tencent Cloud and definitely not Microsoft.

• Other domains in memory like counter-strike[.]com[.]ua are very new and definitely sound fishy.

• A standalone version of 7zip is being run and extracts the created rar file with the password “infected”. Real alarm bells here.

• A lot of the registry actions look like anti-debugging, which does not sound like something an Illustrator Plugin would do.

Sure thing, the reasons that are most important for me personally are better multi-attach, easier splitting and resize, better plugin ecosystem and it being more modern and actively maintained in general.

I much prefer tmux over screen.