Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-07-2021 12:36
General
-
Target
Dike_Infocert_upgrade.msi
-
Size
628KB
-
MD5
0162581e46cffb64d7c8c90c4134695b
-
SHA1
5af1b43c0264814e030b0b0116a9cf998d1ce8ca
-
SHA256
67158ec3e3edcaff528ce829517c6ab20095b2dda6a3f60a5ebf53025d116040
-
SHA512
13acfccd5022f4cbb6d4e4b9a6d8ca8ef2d919a4b67c5e196f4ed62d387dadd460594cbc42761f8e48a32f1a184df5c5fea6857ea1f61f251ce301877eccdb2c
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Blocklisted process makes network request 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Sets service image path in registry 2 TTPs
-
Loads dropped DLL 64 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 29 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 27 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 7 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Runs .reg file with regedit 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Dike_Infocert_upgrade.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3CF79F3F883051924BC671C1C09D20F72⤵
- Loads dropped DLL
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="amministrazione@universoinvestigazioni.it" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="0013z00002gg5y2AAA"2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 87A1883E1752E6A19BB37F76ED7DA25E E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{56E0A2F9-1C1D-4C9C-BA53-DAFC90A88526}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{63D4F39E-7847-48B6-97A3-A8CC3C113FB0}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1B3B9D9D-CD9C-4224-9934-90FC478D0877}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C24D6E8-B361-4A64-B063-7EA94D88B0E9}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{63B6DC72-2ED6-431A-86F6-28FB664ED4CA}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0BE092DE-1107-481F-8E8E-60BD2AE3E902}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66C9F1BF-2B4F-4E72-8DB8-72F5E9FBCDB7}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4B1F3629-1608-4B6C-8B29-029B99688B6F}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66B76262-F622-48C1-9A41-4B13100FE32D}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exeC:\Windows\TEMP\{F3C2BAF4-ED5A-4B13-A60D-11FCB2557B56}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF9345F8-F65C-4D1C-A2A8-E18D241A1DA0}3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRServer.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRApp.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRFeature.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRFeatMini.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRManager.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRAgent.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM SRChat.exe /T4⤵
- Kills process with taskkill
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{825ABDE2-29A4-4460-9125-A034B08BB941}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9281834-389E-49A7-AAF9-A7DA51404BBC}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2F8B30EE-6ED5-4E56-AFB2-ADDAFB9D9879}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25ABD46A-A030-45EE-865B-1095AC85599C}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D6C2D573-DF2C-4433-B7DF-44D8FCCEA0A9}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA34ED05-C6C0-40E9-8451-157574E3C5E5}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D5DC8638-6709-448E-8F04-D89EE948F0CB}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4EBCE234-55B3-49F8-ACCC-C10F6AEBE355}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{67F30AF5-0435-4F9A-BDC6-D0C8C09EA940}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exeC:\Windows\TEMP\{C2CBB8F1-1DB4-4EB4-9EB7-15D31D67DE1A}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{90CBE1B6-759B-446B-94E8-90A91360DA64}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57654969-C1C4-472B-9FDA-D000539FB773}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{34FADB3F-2492-4A9F-B8EF-BDD90D6F76E3}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7D257540-D4DE-4376-98C1-F5C69562A348}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94EB9A22-CD52-43F9-B386-90BF9EEEC50B}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C565211-E76A-45A3-9CDB-F8FC932F5FE2}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66CEAF9E-D0FA-48BB-8FFA-E2741DACCE91}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{936EE93F-DCE2-4E4F-B085-4F342929637C}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{776D3058-1D49-462C-B2DE-FC51B9894012}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7FC98322-3651-410A-BF33-F663785658BF}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exeC:\Windows\TEMP\{853E3393-230A-4538-BE32-FBAA5C139A8D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A05F7785-A94E-4B44-89F9-E8549F611093}3⤵
- Executes dropped EXE
-
C:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exeC:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\regedit.exeregedit.exe /s "C:\Windows\TEMP\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\InstRegExp.reg"3⤵
- Runs .reg file with regedit
-
C:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exeC:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe /P USERSESSIONID3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\regedit.exeregedit.exe /s "C:\Windows\TEMP\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\InstRegExp.reg"3⤵
- Runs .reg file with regedit
-
C:\Windows\syswow64\reg.exereg.exe import "C:\Windows\TEMP\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\CredProvider_Inst.reg" /reg:643⤵
- Modifies registry class
-
C:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exeC:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SetupUtil.exe /P ST_EVENT3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd.exe" /C wevtutil.exe um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"4⤵
-
C:\Windows\system32\wevtutil.exewevtutil.exe um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd.exe" /C wevtutil.exe im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"4⤵
-
C:\Windows\system32\wevtutil.exewevtutil.exe im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"5⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{985E3B89-EB85-4C5F-8A44-8AF99DC62332}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F791183C-E57C-4D3B-B29A-2F6C0ABDA895}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6BFE17E8-65BC-43EA-B06F-855B830F83EA}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F38846C-5221-4505-93A0-B134CCE66E1D}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{919D4EB8-F4B3-48E9-98CA-963C8144A94E}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{70B05FD1-D9CA-4DB5-8F54-F121CE92E979}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9956792-A3AA-4308-8DA4-078643A34618}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25B83643-8987-431F-8507-49879469180B}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AE77BBB0-3E10-4552-849B-7A7B930F5D9C}3⤵
- Executes dropped EXE
-
C:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exeC:\Windows\TEMP\{E302148E-FE4F-4892-9997-AE642828FCC2}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B50E5235-C7B2-414A-9934-3EE58B8EF44A}3⤵
- Executes dropped EXE
-
C:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SSU_Clean.exeC:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\SSU_Clean.exe /S3⤵
-
C:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\Splashtop_Software_Updater.exeC:\Windows\Temp\{B7C5EA94-B96A-41F5-BE95-25D78B486678}\Splashtop_Software_Updater.exe /S /Caller=SVR3⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FAFF3246-4B6F-4DDF-8922-039F40907965}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{04BBFCCA-019C-480A-AB84-D70702664455}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CBB42200-C0DE-4136-B5B9-948927A4EA56}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A5A51DA-AA3C-489B-B4BF-BE09EBD58E22}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26845AB6-2F30-4057-8974-9843C4AA8FE5}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{146D6746-74E8-4ED9-9046-BCA64C7C8927}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ECDEBB99-14EF-4307-B5AA-3F118A993B6B}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1C759860-E170-41EF-BBBA-47F3640D84A4}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{482EDB8A-085A-426F-9060-853E97E2D856}3⤵
-
C:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exeC:\Windows\TEMP\{FF815495-787E-4035-A84D-109D6D9200A1}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F7EAEE9-D9EF-4EB8-BE37-13045A56A8BB}3⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i3⤵
- Modifies registry class
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE69EA87-D3CA-4C1C-9EC7-63B50B7875F4}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C816509-CB82-4411-B9E0-D4F1ABAEBDDC}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF20CC21-425A-4F16-8B2B-3075D91D2EBD}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{015FA561-3B39-49CB-8315-2EBEB1DC6B43}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E666047-51A8-4DBD-A9E7-6B9DBA53F2C6}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{39FD44C9-F716-4BB2-98B9-4885DE818694}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30D6DDA8-503E-4842-92EE-BEFCBDCEA9A8}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1757BB16-90C0-4CC2-B305-126A8771A73E}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF4B7FC4-3BFB-45DC-A84E-43374D5B238D}3⤵
-
C:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exeC:\Windows\TEMP\{239094C2-B2D2-4F85-B486-31ABB40556DE}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D697E23-C09D-428D-B8CC-2382F23595E3}3⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B4B842A9-A768-490C-8931-1EAEE02BFB1F}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A9C2A5D7-04E0-4FFB-8D03-1069767A64AD}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8F5CD2E-24FF-4E4F-A408-082232BDCC5D}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA314F9C-DA5E-4115-A0BB-C83F2DD38EA5}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF1E97C5-AA9D-4C22-BA83-5808958BB0AD}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43CD7811-130F-4346-97F2-8A2DA13026FA}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{97D9F6D0-D275-4CEB-AE60-B92CA2756621}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49604227-574A-402E-9D7D-45FC43D4F141}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46272BF6-22FB-4E5E-B8F0-ED0323C2440A}3⤵
-
C:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exeC:\Windows\TEMP\{698CE808-511D-4B71-A0FC-7D5DC37A158D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9174D274-5154-4BE1-9C79-1A538C81A650}3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/250002⤵
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "21e84880-f115-4678-9d90-5eaf455851de" agent-api.atera.com/Production 443 or8ixLi90Mf "initialIdentification"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "cscript ospp.vbs /dstatus"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript ospp.vbs /dstatus4⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "a3b9151e-ee78-4f92-ad4a-346c4ade90ee" agent-api.atera.com/Production 443 or8ixLi90Mf "initialIdentification"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "cscript ospp.vbs /dstatus"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript ospp.vbs /dstatus4⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "005ca982-7e1c-4864-8080-8aff1ee3aad6" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "cscript ospp.vbs /dstatus"3⤵
-
C:\Windows\system32\cscript.execscript ospp.vbs /dstatus4⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "7338c267-f4dc-41c0-abb1-a136012c31ec" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\SplashtopStreamer3360.exe"C:\Windows\TEMP\SplashtopStreamer3360.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\unpack\PreVerCheck.exe"C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"5⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ"3⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_session_pwd=44e158641a0506ccbff5afd2659e3a53"3⤵
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\AgentPackageWindowsUpdate.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\AgentPackageWindowsUpdate.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "f73be582-09c3-477c-b81d-b2ec62b82787" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "47c5e84c-98d3-4e55-bed8-7f1558f5212e" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat"2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "d364a8ec-539e-4104-868c-05b37085bfec" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjpudWxsfQ=="2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "75f2d49f-c1a7-48cb-8930-0b6fbe1223b7" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "5d659fff-9230-4bf1-a4b6-7e2a32fc7eab" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "0ca2f59b-1a24-4065-b174-731a437a2cbc" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "b26bc8e2-ca40-4cd1-af4a-09fb661a76df" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe"C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "98312f59-2532-4611-ae7f-8c728ca86001" "b26bc8e2-ca40-4cd1-af4a-09fb661a76df" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /i C:\Windows\TEMP\Setupx64.msi /lv* AteraSetupLog.txt /qn /norestart4⤵
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "343474ca-b0eb-47e0-b452-88f933cef2b9" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTaskScheduler\AgentPackageTaskScheduler.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTaskScheduler\AgentPackageTaskScheduler.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "59a32b50-33be-457f-b1e0-b4a7ef3217fd" agent-api.atera.com/Production 443 or8ixLi90Mf "Schedule"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageNetworkDiscovery\AgentPackageNetworkDiscovery.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageNetworkDiscovery\AgentPackageNetworkDiscovery.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "0c32edf0-9ec3-45a0-bf7a-b9bbff7ca71c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJQYXJhbXMiOiJ7XCJDb21tYW5kXCI6NixcIkRvbWFpbk5hbWVcIjpcIlwiLFwiVXNlck5hbWVcIjpcIlwiLFwiUGFzc3dvcmRcIjpcIlwiLFwiQ3VzdG9tZXJOYW1lXCI6XCJcIixcIkJhY2tncm91bmRTY2FuSG91cnNcIjpbMTAsMTRdfSIsIktleSI6IiIsIk5ldHdvcmtEaXNjb3ZlcnlDb21tYW5kVHlwZSI6NiwiSXNBZG1pbiI6ZmFsc2V9"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "3228eb44-2810-4c26-90cc-94ec980e3ebd" agent-api.atera.com/Production 443 or8ixLi90Mf "syncdevices"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "47c5e84c-98d3-4e55-bed8-7f1558f5212e" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat"2⤵
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "7338c267-f4dc-41c0-abb1-a136012c31ec" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded"2⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_session_pwd=44e158641a0506ccbff5afd2659e3a53"3⤵
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe"C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 98312f59-2532-4611-ae7f-8c728ca86001 "47c5e84c-98d3-4e55-bed8-7f1558f5212e" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat"2⤵
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe"C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe"1⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"1⤵
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe-h3⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"3⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"3⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRDetect.exe"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRDetect.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exeSRUtility.exe -r4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exeMD5
33dd421f03cba2285db580d195337417
SHA1ef6a57315a9f4bc95e8372de231c76961bb26d61
SHA2560bfee9b7976dac1a18339d57d5f9991f65ce25b87fd01c74e16f943eb3d1d899
SHA512b3993661dce0d5a472384f244baf34f680d4bbcde066c45cfef94a2f4c5db4a796be24ecb7dd081bd6e1b5dd8da7ce9f9a7a41713f2dfda2e11e6f15edd69073
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exeMD5
33dd421f03cba2285db580d195337417
SHA1ef6a57315a9f4bc95e8372de231c76961bb26d61
SHA2560bfee9b7976dac1a18339d57d5f9991f65ce25b87fd01c74e16f943eb3d1d899
SHA512b3993661dce0d5a472384f244baf34f680d4bbcde066c45cfef94a2f4c5db4a796be24ecb7dd081bd6e1b5dd8da7ce9f9a7a41713f2dfda2e11e6f15edd69073
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exeMD5
33dd421f03cba2285db580d195337417
SHA1ef6a57315a9f4bc95e8372de231c76961bb26d61
SHA2560bfee9b7976dac1a18339d57d5f9991f65ce25b87fd01c74e16f943eb3d1d899
SHA512b3993661dce0d5a472384f244baf34f680d4bbcde066c45cfef94a2f4c5db4a796be24ecb7dd081bd6e1b5dd8da7ce9f9a7a41713f2dfda2e11e6f15edd69073
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.configMD5
7ff0ac77806aed9588b143cd0fab552b
SHA1184b62f2956b95ffe3dc98ebb31d7f45dbca83fd
SHA256730d85d5ef4f0939154278949c126a444ed859e7718bb175ca3153ca6ed9d142
SHA5121856bda8cc3d4161110cd75a7be4939193ed408a95f9c41e22f4cc9f85b1294584f95796bce207dd65d606ffb57760b3d2e1681efbbb7759a19a9f70fb7edac8
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dllMD5
c8164876b6f66616d68387443621510c
SHA17a9df9c25d49690b6a3c451607d311a866b131f4
SHA25640b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
SHA51244a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dllMD5
83222120c8095b8623fe827fb70faf6b
SHA19294136b07c36fab5523ef345fe05f03ea516b15
SHA256eff79de319ca8941a2e62fb573230d82b79b80958e5a26ab1a4e87193eb13503
SHA5123077e4ea7ebfd4d25b60b9727fbab183827aad5ba914e8cd3d9557fa3913fd82efe2cd20b1a193d8c7e1b81ee44f04dadfcb8f18507977c78dd5c8b071f8addb
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.INIMD5
52ad24cd7b4b64fdb749335b1e947c0a
SHA14ae2c80907f7fac3df3b0186d1bc53e2890e5de9
SHA2566211b1bd1a05e7d078d2bc8bc9edcee30a70d15ce9cd0997bf08dd90b5b516d9
SHA5127da6f5e939807e3e0cbc47c920b17bb65e342d5797567a4f902df0f543746f76f115ed33f6529cc995dac31f05bda26c7f8e2a83c914a7e8bdf5b7d056f84fbe
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exeMD5
cc697eb732f601562293576e25725044
SHA138d32ff1faee74d5813d7ed82ab786bb7f63ace8
SHA2563d028c4204341b8fc14fa36efadf9ab6758547708b25179ee60b6f6207d8e166
SHA512b1881741f9bb6341436edacf5add2e717afec4b6480c9ff76345ff846f74ba6fda6e77291f378bcc4aaa9c0854b41a229b876caa0ca09e04c8edec31aecf36fd
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exeMD5
cc697eb732f601562293576e25725044
SHA138d32ff1faee74d5813d7ed82ab786bb7f63ace8
SHA2563d028c4204341b8fc14fa36efadf9ab6758547708b25179ee60b6f6207d8e166
SHA512b1881741f9bb6341436edacf5add2e717afec4b6480c9ff76345ff846f74ba6fda6e77291f378bcc4aaa9c0854b41a229b876caa0ca09e04c8edec31aecf36fd
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe.configMD5
200b9c5450a1640157e06de09698a485
SHA1fd8cbe606fff687c4c4aa807f2ea22b73f353ad0
SHA256e6505d2e060926a7e7e7ed3e2d66b974ec15576719d18177e2aa9e540d4acd9f
SHA512b88b11a7bc0bba669263bf25a8ccd9cbde71a4196e59b35c4e4cd26deed6f18ff00452d585c6d1ec4986d92f6d51c9b94c0cfcc577acdbe6ae94fe2475b6ba51
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\Atera.AgentPackages.CommonLib.dllMD5
7911b591333e07c3d497985be2a29d3c
SHA1f679994b1ed45ec7011e5401b0338e9fed934ac7
SHA256e960b38ba9a34d472e22d63af322c6b1e8ccbca470fa3117bec12db6f65362f8
SHA512f6c957ce2a73bbaa1247c60ea6267fad18c0f8cea1a74401ceb355e657889017083c7da0d857f0f7a467988cc954e0d58417e73124556cd541b8f2d2e865805a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\Atera.AgentPackages.ModelsV3.dllMD5
2188e1b90ffd7858b8d067fe1612cb1e
SHA1a6d03ba0ee59727cc942ca56b85890b8b0a0944b
SHA2568901817b84a7eea58517e7b36bcd86009afddaa34e6e2144eb279d2f11be2edc
SHA512e5fc6e40b47231f405113d23617647af0d1c2f07f6aec332baeffdc6d2372c651d5afc8844f513695a523e59145ffa65fdc26071fee37b1de8d6375e8f90492e
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\StructureMap.dllMD5
ac62aaad8daaf570084a5c9fc39b7ee8
SHA1cf317cade246cdc47d34706038574d0401dec6e8
SHA256779e7bff8fc744f02e64e097fd0c32c3f93bbe8d233ff796f83384c5f73889a9
SHA512ded66cb1c9bc73d5010103a2be632ec8fa3d7272623a5d1aa85aa19c3d857f5f74639084bed4b244c5381e5ac46e6e47d5be80790dedb3f9fdd41e3f6cd5780c
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INIMD5
04ef8a3c001a0ee28b1787423127271e
SHA1aa0b319a3b8f04d1ba5704e0d87f9195deaed332
SHA2564f02c008ea3183f19c0a5d56a71e2b6e07a99a56489d36cf40b5bac910409e18
SHA5129c0d91eb8c9339a788c78d3850d78aae9a8e251cfc56c9c58e347f5f0fb6ba72fb111bb849c3857b4167f3f312fe3e920bb1826c2254d20954f75c7c19f65f33
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exeMD5
49916107ee58eb8150c4e20ccfcc15d7
SHA1c6e89b6881d46ae708ab1a3df023f8228e5476c0
SHA2563e6ea764c4eaa5685f6a0e44268a7f2d7cd48c42aa6ab32f80124389757938f2
SHA5124e18017d43e6d7410aeadc161f53efea733b0091b28dc0201ec4c153a2e8b00999f09b0439168eea932e6464a6104d76d35dbbd8b420487c41e2b81e8faba08a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exeMD5
49916107ee58eb8150c4e20ccfcc15d7
SHA1c6e89b6881d46ae708ab1a3df023f8228e5476c0
SHA2563e6ea764c4eaa5685f6a0e44268a7f2d7cd48c42aa6ab32f80124389757938f2
SHA5124e18017d43e6d7410aeadc161f53efea733b0091b28dc0201ec4c153a2e8b00999f09b0439168eea932e6464a6104d76d35dbbd8b420487c41e2b81e8faba08a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exeMD5
49916107ee58eb8150c4e20ccfcc15d7
SHA1c6e89b6881d46ae708ab1a3df023f8228e5476c0
SHA2563e6ea764c4eaa5685f6a0e44268a7f2d7cd48c42aa6ab32f80124389757938f2
SHA5124e18017d43e6d7410aeadc161f53efea733b0091b28dc0201ec4c153a2e8b00999f09b0439168eea932e6464a6104d76d35dbbd8b420487c41e2b81e8faba08a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exeMD5
49916107ee58eb8150c4e20ccfcc15d7
SHA1c6e89b6881d46ae708ab1a3df023f8228e5476c0
SHA2563e6ea764c4eaa5685f6a0e44268a7f2d7cd48c42aa6ab32f80124389757938f2
SHA5124e18017d43e6d7410aeadc161f53efea733b0091b28dc0201ec4c153a2e8b00999f09b0439168eea932e6464a6104d76d35dbbd8b420487c41e2b81e8faba08a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.configMD5
7033bdb79f5752cbcafa17b296df24b2
SHA11d59a4aa8545f1d8aef1606c4a8a23b1b807ff18
SHA2567b07559d1b4b17d4aef7e6f305a0d8c2fed13931b85e217bda0ee702af523f74
SHA512df78b9194a91a2c2ab5814e92ab8585c3aaaef3f1519146592ad345253dea0afe2be8c3d99291f4bdfaf32d3785ad5cb33586e9f4a18a01e370451b69e9fc36d
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dllMD5
159c9643ddfb511421327ece3bb3133b
SHA14c11d1e591bf0d9b89ea5a949ed26a0425b25184
SHA256a1c9523bdb884cd43b20d3d5173f2c6bf206de17c2e79db25d372ff19cec5fb7
SHA512c7232aed3013d5d472475c1e4ba2335f57ebb31228545d7e1a7de45bbcb0246af0115a590d608389a32f1614befa67122eb33bd9881bea7ea2ff1b5b56bd2a98
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dllMD5
c56f50320ec016d53ccaa5cb824f4573
SHA17a3102cd45cf49f12195f9354f0412e0885f8504
SHA256cbc15a831e6ca49482dc16a50cfd6cd8b70f1865b3ed2be57b831e1e0d8dec6e
SHA51292720fc806dd79399df2f2f9d2f5f66a7cae2b6debef3da3f018c183a15d9e49691612615b492c573b6665ccbb3da37041a74263d1f20cf1b45c2640d6044ef2
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.INIMD5
03b8a5a32d56d4fbdf7802d7aec58aa1
SHA1d340ac69ebbd1883d17915ea3bb856c93ec37a98
SHA256a42f4dfec2e8385fe457f0604977a4f5cedae391776598b04367addc6d1c8ada
SHA5121ee29b06c9a8ee1d1f5e200f59e25ce29d4aa4c8fcf1c809e75a28f4d3c9faf3e7ff2077bc351dca81e287a0c57d17f6b1b5f535415f7837667bad29e6559991
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exeMD5
e6cf1fac613f61846812b4a30efc3a39
SHA1060b70d76d5178a6bf33d160fbc7db6a5789fbfe
SHA256524c7a89c9de151943d41261910f5e3b58abed77a7ff8827f1903e972dd37be2
SHA5124c03b7603cff7997a9fe53711946440fde14b24bc325b853cc72096d548b89cb992a7ac970bb1ceddb898ea1d7b456038508ad45d2bfeb63553e83b3ffb398e8
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exeMD5
e6cf1fac613f61846812b4a30efc3a39
SHA1060b70d76d5178a6bf33d160fbc7db6a5789fbfe
SHA256524c7a89c9de151943d41261910f5e3b58abed77a7ff8827f1903e972dd37be2
SHA5124c03b7603cff7997a9fe53711946440fde14b24bc325b853cc72096d548b89cb992a7ac970bb1ceddb898ea1d7b456038508ad45d2bfeb63553e83b3ffb398e8
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe.configMD5
3f9b7c50015ca8be5ec84127bb37e2cb
SHA107fa0b2f00ba82a440bfeacafd8b0b8d1b3e4ee7
SHA256c66e1ba36e874342cd570cf5bdd3d8b73864a4c9e9d802398be7f46fe39a8532
SHA512db5713dda4ecac0a1201add7d5d1a55bdbfc9e373b2277661869f7de9e8ba593f44bdafa6c8dbeba09df158b2dfdd1875c26c047f50597185f1f2f5612fc87b9
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\Atera.AgentPackage.Common.dllMD5
01686fb0e3083594677d84d0f46df354
SHA10419ea9022e5ad29217344a0962ae99a4473bc0c
SHA256a1d6a5121135c51c1644c3d1888ae02517b3e5fa71092397485f2ad25aa1e691
SHA51234c6a1fe79a5b19748247f162b1645a63b71632784bd9b5cd482f81c77dc8aa229d8f8aeba419696b276d34ce0e4258752c6c7f78d5e2d846d355e6bddcce0fe
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\Newtonsoft.Json.dllMD5
273a2fb7bc05f02e8b4b8c123da24308
SHA13d81b2d5d21a0adc1ccc75e7bf9275734ef6c780
SHA256021b1a16871473eaf99de4bdeb3682361fb2ed74d5d3207e69450828fa6dab6c
SHA51225fab3e378815ed0986179604845a366011d12e5944f1b662b54b26ad7c4d12e3e8e6afdbc63448d1bc9548ba741ed2d484fa3f9b1ee25055b2618dac5289232
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exeMD5
36243dab64849780a7b800e0b3e9419f
SHA1cb6be598bafea04e25a9a0515141a3a6fe00fa38
SHA2562f599ae4c76b642d30d2d5dfd0f0c009c3407cc592d3341d368f19da9b4cd29f
SHA5123d897e9ba1fe0f706c819cc6b0f4a260e437a564ce7c84c68db43003d181b6fcb735ab63a8d2fa5cfbec6b23319e9fadc269aa8331d1f818fd665bb1029fadae
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exeMD5
36243dab64849780a7b800e0b3e9419f
SHA1cb6be598bafea04e25a9a0515141a3a6fe00fa38
SHA2562f599ae4c76b642d30d2d5dfd0f0c009c3407cc592d3341d368f19da9b4cd29f
SHA5123d897e9ba1fe0f706c819cc6b0f4a260e437a564ce7c84c68db43003d181b6fcb735ab63a8d2fa5cfbec6b23319e9fadc269aa8331d1f818fd665bb1029fadae
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.INIMD5
d27e792dbedd4ce70d3c7e81ff0844e3
SHA1d729b456a03de94175935c8a83a1f1140c067b02
SHA2569358dd9c96af7d596bf94dec1f94ecf26881b231a70c1be3ee08705d65ca2895
SHA5128f3d39caec3a39266f4a96faf0acd430623bbe73f99f46c527fe126328979f0d41a3ff12cbfba4dece8a678a0da9e48b18563da0eff2ca0ba1441fce9477b587
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exeMD5
da4dbe091ba30623cf17348d0aaee74d
SHA1315ec6f26545384b8f68f9106be2153ca78f74e4
SHA256e400659675dca995965712fa796acc0ab691668bc4f4b36d5294c63e2c126108
SHA51229aac02faf7a375a44cb804c639c47887ebb4254f6b8c29cca0ad5be6f3cab8f0b41616ea58a35c0a1716ff471d27e52c22193e386d422835068d23bab380fef
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exeMD5
da4dbe091ba30623cf17348d0aaee74d
SHA1315ec6f26545384b8f68f9106be2153ca78f74e4
SHA256e400659675dca995965712fa796acc0ab691668bc4f4b36d5294c63e2c126108
SHA51229aac02faf7a375a44cb804c639c47887ebb4254f6b8c29cca0ad5be6f3cab8f0b41616ea58a35c0a1716ff471d27e52c22193e386d422835068d23bab380fef
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe.configMD5
9a98997c57162a9b8665e44512088e4f
SHA14c14fb14240346c2261b466f776085f4a98250c9
SHA25686bc14fd84dbc08192b6aa5ea54d1bcaea37195f90bfce9ab6cf884da898ed32
SHA512f169ed80565a10ce2ce0b9a65f1e177d25dd4dbc96ff5c27e501cb43cf9f8a17e2be8b44007f35c597090520ffa811966b7b6ac13184c68b0ea800b4b659a334
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dllMD5
d1063466612c6d7db55cb176b4334163
SHA1f64cda376c29136b19a4c6df040e1d78e50d4fb6
SHA2565d088b60c7939037bf3a5b32beba85f681234bb1f5c457bfefac597875f5f385
SHA512c63acfc6c40845a3fd6f017a4697eeddccb187e38e59dec530705f36c0988061310efcfb87de68acffdb6acffc58d54a8c126aeb5e8044347da6121f39805abb
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.INIMD5
2ee2a757a5865cc7f0d97c67a0b5d8c5
SHA14bdfbbfa8a5622a5419160f3395916f615918ac9
SHA256526d4fb92081239213ed7651bd67d1d6ae80cb69f2e4c64f6305b5f9ae0b3af1
SHA512dc39fccc5c88a3ab9a50e8d87c93972054934078b42f436a7fb030e64ba513bd3724538613742b6a087724c4cfa469e45574b190a2390a63a748e0c1982851df
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exeMD5
538177ef021e529dfe997d255607fe27
SHA13c34dc31b559c5cd7b39bfaa462e61dc51fd037b
SHA256b181ccac37163e346d88cdd4bf1e4dad609f3a45bb5c143f3db7dc152d395a69
SHA512a6b3af6ef8b3ab699ebfc1192869ef4d2b56b99aaa47ab6b826ddb23c01fc2c73d3b4680e5839c65f64d1b2c89964b2d69512d214fdb58a088408203eac61cec
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exeMD5
538177ef021e529dfe997d255607fe27
SHA13c34dc31b559c5cd7b39bfaa462e61dc51fd037b
SHA256b181ccac37163e346d88cdd4bf1e4dad609f3a45bb5c143f3db7dc152d395a69
SHA512a6b3af6ef8b3ab699ebfc1192869ef4d2b56b99aaa47ab6b826ddb23c01fc2c73d3b4680e5839c65f64d1b2c89964b2d69512d214fdb58a088408203eac61cec
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.configMD5
9bc8c60dca1db56880a6de6186139bbb
SHA1215828e6240b6d588e1d3e1a92e9df51ede80062
SHA25698cbf73681a1b63d4242cb40a2bd0bb6b04a61528a4230e8eb7e10bd83b6e6b0
SHA512809a8d652869977bcaa702fc7ab4963ef48554e122acd08314c7645dbb878bb32e0c5be0aa08606956fcf1fac5431cc401f5949ef781e52eb9919c72c88f999a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dllMD5
ced1b0417be18a7c18d13b362b83e1b4
SHA1ee6688a75ea807aa8d51d69c1f4cec2fd201590c
SHA2563679e9374b1639b46ead6349245adc836243d42c7237b6a94ef917b1f6ed61be
SHA512751e24ca287541deb37e501f3bea90cdc699625331c932a31dde4f61ed0d2af1bef839f42c1f53978027285c81a01d1151ff6590040f17ef0be38d50ed50da4a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Newtonsoft.Json.dllMD5
ddda7e8fffc144e58f39d7e973aeb64b
SHA1bb7ed32023150cab7740524da6f2870c546d3acd
SHA25653ba23ec48132705610c6bf3d6c9e8db6d2f3234a629c26f3a974ceb7f2e95f1
SHA512a57e9b8c0c11ddaea7773ef3550c9a2fd5c29afcab5eea0ca4cc9507880308f130c417f01383dc9b25a02eb32737b4d8a039e7b3f57ae1d85e13da6de0d3b4dc
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.INIMD5
2fc8d65453a9c9c04a37d76b83569a72
SHA132d96fc8d7a9eeab00d5bb5384d301d18263d1f8
SHA256ab306495ecfa337cf3bc9c06480c1fe778f9934b245ec7fc25a030fbe4619b98
SHA512aa67306ddb9fdb1122d7816ee733d792259aa3bdef7a16211e1751450501fae2243c1556f55ba777dec6b9a868aa15e089e8ad22ef75ac9774623765b78ad01a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exeMD5
779a81d6343a98b9b27beeafbb0a05ee
SHA1507320c64adacae75ec7d58f641befebe348cf0d
SHA256d88ceae464b731344f2dd7d6402b517571cff6faa6ac12d5b1f5abc5200a6693
SHA51216048677f1a49b49ad3b9a424a4d2c8560ff3efb71967cefbe4b70c4baa72ed82bd4ef70dd73472182c66c8226102f2364dc9b3233bd246f2188c236d191a70a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exeMD5
779a81d6343a98b9b27beeafbb0a05ee
SHA1507320c64adacae75ec7d58f641befebe348cf0d
SHA256d88ceae464b731344f2dd7d6402b517571cff6faa6ac12d5b1f5abc5200a6693
SHA51216048677f1a49b49ad3b9a424a4d2c8560ff3efb71967cefbe4b70c4baa72ed82bd4ef70dd73472182c66c8226102f2364dc9b3233bd246f2188c236d191a70a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe.configMD5
9bc8c60dca1db56880a6de6186139bbb
SHA1215828e6240b6d588e1d3e1a92e9df51ede80062
SHA25698cbf73681a1b63d4242cb40a2bd0bb6b04a61528a4230e8eb7e10bd83b6e6b0
SHA512809a8d652869977bcaa702fc7ab4963ef48554e122acd08314c7645dbb878bb32e0c5be0aa08606956fcf1fac5431cc401f5949ef781e52eb9919c72c88f999a
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\Newtonsoft.Json.dllMD5
13e68cf6aecd7ac7f47080b230523262
SHA1c3d3e8ca1030e96ce20d00695c0bc9778ae43c96
SHA256067e009ec640b958e2be69863d3a486daf59b6b523725f94eb8f649d839f340a
SHA5128266a604c4db593565c75a203ce6dc9221bfee279ad0a87a2ace19dbd8c193762f327378a5337aebffff3187849f8808b8c4612e599ece1ea7aaf091f5a6ba13
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exeMD5
2827351b0af210d7118dbe0c2e894e21
SHA1eb9a09a375a2652f78256ab69b883914f4219e3b
SHA2567533cd228397a23e7c807f95cc9cb5cbea9f820c7cc71be7e2cfe3fe4b243c7d
SHA512a1800510b511bd23acad9ffdc08ca4187421f7e366c21307f2d9a86193d6b0bc0a4be4dcb8773099bf91b7b880b028af3225467bcaac4dea327907fb4ea4b7e1
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\AgentPackageWindowsUpdate.INIMD5
93af2eaefb9b3fe0799ebb4155104fab
SHA1ae3455155c1881d098397e6f3f1ad31858b35c5f
SHA256d662fe4971fc12d599f47641acbbdaf3b1cc1175fca3744bc4699c93a08b074b
SHA512f9e791c248c48bc8017647d5b07e9d8ac3c33d17ba57caf8ff89fa8dad50657832c9d5688110a367d235dd220e32060069a7c9f96da79f90211a1e7a442cbcb0
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\AgentPackageWindowsUpdate.exeMD5
b12c63053efe64ae12a800e7202ef65e
SHA1f4c459ed00f653c97dda9af913760ff129ed8294
SHA256b178c407dde32dd0810f2e1672260b23a08b917624ce67af302b9a795728c6db
SHA512e3a3b8bfc04b7b9cb2eb4f666d25b5dbdd15c19c94f7465e446566f8f4337aaca1bac7a5cd67a6b8f275a3494fa9145087f2dcc46b9a1ba6a9e3e08867f00314
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\AgentPackageWindowsUpdate.exeMD5
b12c63053efe64ae12a800e7202ef65e
SHA1f4c459ed00f653c97dda9af913760ff129ed8294
SHA256b178c407dde32dd0810f2e1672260b23a08b917624ce67af302b9a795728c6db
SHA512e3a3b8bfc04b7b9cb2eb4f666d25b5dbdd15c19c94f7465e446566f8f4337aaca1bac7a5cd67a6b8f275a3494fa9145087f2dcc46b9a1ba6a9e3e08867f00314
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\AgentPackageWindowsUpdate.exe.configMD5
c0a1095205d9061cb19da9e7dc8323d0
SHA1f50b534777f0ece5414ed533aeafdc660d97fb1d
SHA256de0b0fe7b58f4c212cd825b3b07e978caa43103708445fdab2347986ecc12acb
SHA512a64ce84f73859b3703c615a8422aaa6825570f7ff974e88a047d167a541d2ba7fc4bf2c77bb2c3c2afbca56f1e2e47e37197ac5f56fcf37be22f9bf195a5e370
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\Atera.AgentPackage.Common.dllMD5
3c0e332cc4eca9cab722263a0f2cc082
SHA1e7a33fdcbbfa7ad5d2a3d9efcf07c2ca7f1e5531
SHA256e8abad75b5f29668151f9070fce8624525c8da80203cfa9fb81d03a948a6da71
SHA512129a84b1fa6c491b5ab98896cf3bb32a17f2a504e0cc635a028fcf4496121b832f608d007b21a8d84ae22af31a0382951635690e204dd9ac2cec17a690dc1057
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\Interop.WUApiLib.dllMD5
ba6f28e2359291c2778ec04427acea2a
SHA1759a9518bfb3ef76b3dc1664385a13a3403feabf
SHA256708308c9d5c2579afb21d0b10229f94b274fd5ad0a2ed0659abd3bb5f8733bf5
SHA51220fe56f29dd58f30db8021edd6f5b7e178ce909d4b438a97bad71850f4441b9abbf1c0c83559d9c19d958d616c9aa9344b686601f37db36cb0a66a22323f951d
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageWindowsUpdate\Newtonsoft.Json.dllMD5
b83633d144eb1d00c744c709ab54490e
SHA1dad6e6759042810e2a9a7c5882b0ed1399e289d3
SHA2568855c8021ab67f0a15ffb4c1568de102e5882e478acc8000554e821d8c4c042e
SHA51296471e13d771b6e91dfdcb1684b98762e41338972fcf47f8d46cc6bf07cb0f9271a89cd656a55d9be422a2741aae4349be7a312f88ec2c4218fc25d7588057ee
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\PubNub-Messaging.dllMD5
e8458b60d4f251de071b765287c5661e
SHA1b4a4d91483f658b79204ec4be2c2012efefd5a63
SHA25652c29826c96e35373f05fefbd0f92ac9ec377cd65e8f58a945f3a86b41c3ddc6
SHA51257b3b9cd3a47a6543e0e81a4606e7a90e4a459fe827c01ec6a21d1a64503fe6267079fa89e3120519079a1e9a0eb925f3b794d9b39f03d7eba524393dc564bea
-
C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txtMD5
6d43b212fbdbb75e7d7e9af578a9cd2c
SHA14a7966bf28ff178a17461988b95b44e84791d213
SHA256c9f08bb6a41f1bfcd03ff55dfbc6dace7e32fe05fac02b69757acb7071e6f693
SHA512dd3f20b66e766e51fdb13dc7e4ac7775537286ec831fdb3b6809fdaeb71ac8502e7e9725c1ef3548daa26671e27c89f88aa6a667e40b6b1a4b2b81fa2201e12d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44DMD5
a67caad04483de7ffee8359d2c6e8550
SHA16cc2f0c416e8d43d02fb86d6c134f2fc77bfd970
SHA25675bfd1b527fa64ead4723b09b574b1b5542bc2164d17e216b4b6c0112ec388c0
SHA51259c2431eb2654f6e328242035b79fa4c9057dfd5b6c4432e3c5457671143f488c8dafe33d8db3233b29b3abaca4c22674da0056a66e17a5ba9a10924a22aa248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_45127723BB4D97FE8AFE9AA61205741AMD5
b97b24e989431cea371a2786279890aa
SHA147685405d8c4a3bb115ca1b1271f3756125a0a94
SHA25678620c9358834a3c491c36f58bf1c5085357107c811f87c6a3d32353c3271604
SHA51260e09235587f08e32c439734680b3c7a115dc1874b628b75c32f6b30bfb92046ed5eaf949ba827aeb28082b2eafe51d9c979754c1e6297e7d6b69b619201f796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44DMD5
501b4710f0223b412bc8248db4dd07d9
SHA13c4459f0c08cc16cd4c6f31e5f512bae0bcdb64b
SHA256f115b2dac51a2cf243696fe08c635d24e5af168d4afbbca3ce2d4a78f5e6cc85
SHA512d18aa9067a96b08b169e52a7a6e2a319ac8efd3eaf1ab4e73ddbf4943644b1e80529fcaacbd18ee386ffcdd7bbef0bed158df0121ac3abd50c2c1bfed1db1d5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_45127723BB4D97FE8AFE9AA61205741AMD5
868cdaa5dfeec24a67ec477382f58f36
SHA129342b26d109da8aac825202520b8223cdaa7cad
SHA2565943e7b029e8635d82e98e65cc5ddba80613dd2d95fe6d620e92ed916b57e0c1
SHA51248c28a0c26c37719019285015ce2d1ad585d99a592e120d459e37f71a98adff41a67e8c81969cf9a39bd367c349e8eb5fb8f43082fc1d8036c19f9d6c10ce7cd
-
C:\Windows\Installer\MSICA6B.tmpMD5
a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.logMD5
af1df4b695c99ca18d5aa5d3220632e2
SHA1c1a809a8f9c48ddef6ecaf630462cab57e65f7e8
SHA25635bf2ca5337dc1010520f375e825902a9f5705cc9378d19e2dfb606c51100a6f
SHA5122ffc658c8457743cb337892d1114c076e25629ab2788b7948d752ade0a2e88c304d4a35b741507d9d17658e98285222cc8db3f7eb6238067d8983df94b1022bd
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2MD5
40124594567c3ce1da06a0472e988af4
SHA18f4f94bc47e98ddd2cc7f60908230e504aa55bb0
SHA2563433dbcf1d93e7bdf44ba943dae1b9cc12a5db6b36a12d7b46b45d49bf852635
SHA512b86f5b8a74a94b5c079ad474ea2ba6e45aebf7a354b594a451a2fbf59f2f26ee771886dea3833ec37dd7c18d2e6467dfdbd4cab63ba20116a32840f07328a855
-
\??\Volume{d05cfc4a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{1cfc81dc-47cc-40b3-8f11-0200d2a6d332}_OnDiskSnapshotPropMD5
3decfa9154cfefb4e94a02572750c5f9
SHA1819ef1dfc6dd8241b97e32c4be15af3c50e151d5
SHA256971e8bafe10c9cd3abd54929a341d610352862f1ce263d57981d96149696305a
SHA5120dd296904cdac05b619ced8448bda902754f9f055fa73bed3725818d20bfca246583f0fcd375a9f3443d32eaa3e2de882eed5de8ea4d41343b99b658775c4aeb
-
\Windows\Installer\MSICA6B.tmpMD5
a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
memory/572-179-0x0000000000000000-mapping.dmp
-
memory/572-195-0x000001E4FE5A0000-0x000001E4FE5A2000-memory.dmpFilesize
8KB
-
memory/628-431-0x0000000000000000-mapping.dmp
-
memory/792-280-0x0000000000000000-mapping.dmp
-
memory/792-347-0x0000018EE5350000-0x0000018EE5352000-memory.dmpFilesize
8KB
-
memory/892-443-0x0000000000000000-mapping.dmp
-
memory/1208-444-0x0000000000000000-mapping.dmp
-
memory/1216-442-0x0000000000000000-mapping.dmp
-
memory/1720-405-0x0000000000000000-mapping.dmp
-
memory/2176-118-0x0000000000000000-mapping.dmp
-
memory/2196-132-0x00000234595B0000-0x00000234595B1000-memory.dmpFilesize
4KB
-
memory/2196-135-0x0000023459910000-0x0000023459911000-memory.dmpFilesize
4KB
-
memory/2196-136-0x000002345B2A0000-0x000002345B2A1000-memory.dmpFilesize
4KB
-
memory/2196-137-0x0000023473C60000-0x0000023473C62000-memory.dmpFilesize
8KB
-
memory/2196-128-0x0000000000000000-mapping.dmp
-
memory/2276-445-0x0000000000000000-mapping.dmp
-
memory/2400-478-0x000002306E4E0000-0x000002306E4E2000-memory.dmpFilesize
8KB
-
memory/2560-438-0x0000000000000000-mapping.dmp
-
memory/2724-123-0x0000000000000000-mapping.dmp
-
memory/2776-404-0x0000000000000000-mapping.dmp
-
memory/2852-204-0x0000015F07470000-0x0000015F07471000-memory.dmpFilesize
4KB
-
memory/2852-194-0x0000000000000000-mapping.dmp
-
memory/2852-236-0x0000015F207E0000-0x0000015F207E2000-memory.dmpFilesize
8KB
-
memory/2852-220-0x0000015F20560000-0x0000015F20561000-memory.dmpFilesize
4KB
-
memory/2852-222-0x0000015F07950000-0x0000015F07951000-memory.dmpFilesize
4KB
-
memory/2852-384-0x0000000000000000-mapping.dmp
-
memory/2852-229-0x0000015F07C60000-0x0000015F07C61000-memory.dmpFilesize
4KB
-
memory/2996-406-0x0000000000000000-mapping.dmp
-
memory/3188-458-0x000001F7650A0000-0x000001F7650A2000-memory.dmpFilesize
8KB
-
memory/3240-411-0x0000000010000000-0x000000001024A000-memory.dmpFilesize
2.3MB
-
memory/3240-412-0x0000000002A70000-0x0000000002A72000-memory.dmpFilesize
8KB
-
memory/3240-399-0x0000000000000000-mapping.dmp
-
memory/3240-419-0x0000000004A90000-0x0000000004BA2000-memory.dmpFilesize
1.1MB
-
memory/3240-420-0x00000000046A0000-0x00000000046A2000-memory.dmpFilesize
8KB
-
memory/3340-408-0x0000000000000000-mapping.dmp
-
memory/3496-418-0x0000000000000000-mapping.dmp
-
memory/3532-435-0x0000000000000000-mapping.dmp
-
memory/3684-274-0x0000026E7A910000-0x0000026E7A911000-memory.dmpFilesize
4KB
-
memory/3684-311-0x0000026E7BB90000-0x0000026E7BB92000-memory.dmpFilesize
8KB
-
memory/3684-255-0x0000000000000000-mapping.dmp
-
memory/3752-414-0x0000000000000000-mapping.dmp
-
memory/3756-422-0x0000000000000000-mapping.dmp
-
memory/3844-350-0x0000000000000000-mapping.dmp
-
memory/3864-388-0x0000000000000000-mapping.dmp
-
memory/4052-430-0x0000000000000000-mapping.dmp
-
memory/4112-142-0x000001483BF80000-0x000001483BF81000-memory.dmpFilesize
4KB
-
memory/4112-149-0x0000014856390000-0x0000014856391000-memory.dmpFilesize
4KB
-
memory/4112-147-0x000001483C540000-0x000001483C542000-memory.dmpFilesize
8KB
-
memory/4112-145-0x0000014855ED0000-0x0000014855ED1000-memory.dmpFilesize
4KB
-
memory/4140-410-0x0000000000000000-mapping.dmp
-
memory/4144-417-0x0000000000000000-mapping.dmp
-
memory/4192-230-0x0000019985970000-0x0000019985971000-memory.dmpFilesize
4KB
-
memory/4192-215-0x00000199851E0000-0x00000199851E1000-memory.dmpFilesize
4KB
-
memory/4192-273-0x000001999E270000-0x000001999E272000-memory.dmpFilesize
8KB
-
memory/4192-432-0x0000000000000000-mapping.dmp
-
memory/4192-200-0x0000000000000000-mapping.dmp
-
memory/4192-251-0x000001999E280000-0x000001999E281000-memory.dmpFilesize
4KB
-
memory/4200-434-0x0000000000000000-mapping.dmp
-
memory/4212-365-0x00007FF5FF7B0000-0x00007FF5FF7B1000-memory.dmpFilesize
4KB
-
memory/4212-345-0x000001A4A5CE0000-0x000001A4A5CE2000-memory.dmpFilesize
8KB
-
memory/4212-283-0x0000000000000000-mapping.dmp
-
memory/4232-146-0x0000000000000000-mapping.dmp
-
memory/4244-382-0x00000269C0D10000-0x00000269C0D12000-memory.dmpFilesize
8KB
-
memory/4244-358-0x0000000000000000-mapping.dmp
-
memory/4256-191-0x000001A34BD20000-0x000001A34BD21000-memory.dmpFilesize
4KB
-
memory/4256-232-0x000001A34C590000-0x000001A34C592000-memory.dmpFilesize
8KB
-
memory/4256-185-0x0000000000000000-mapping.dmp
-
memory/4256-214-0x000001A34C530000-0x000001A34C531000-memory.dmpFilesize
4KB
-
memory/4256-199-0x000001A364DA0000-0x000001A364DA1000-memory.dmpFilesize
4KB
-
memory/4256-208-0x000001A34C4C0000-0x000001A34C4C1000-memory.dmpFilesize
4KB
-
memory/4304-433-0x0000000000000000-mapping.dmp
-
memory/4308-477-0x00000229749F0000-0x00000229749F2000-memory.dmpFilesize
8KB
-
memory/4352-425-0x0000000000000000-mapping.dmp
-
memory/4460-160-0x000001A136340000-0x000001A136341000-memory.dmpFilesize
4KB
-
memory/4460-162-0x000001A14EDC0000-0x000001A14EDC2000-memory.dmpFilesize
8KB
-
memory/4460-150-0x0000000000000000-mapping.dmp
-
memory/4460-158-0x000001A1363F0000-0x000001A1363F1000-memory.dmpFilesize
4KB
-
memory/4460-154-0x000001A135B80000-0x000001A135B81000-memory.dmpFilesize
4KB
-
memory/4496-415-0x0000000000000000-mapping.dmp
-
memory/4532-424-0x0000000000000000-mapping.dmp
-
memory/4548-366-0x0000025FD5D10000-0x0000025FD5D12000-memory.dmpFilesize
8KB
-
memory/4548-308-0x0000000000000000-mapping.dmp
-
memory/4556-402-0x00000288295B0000-0x00000288295B1000-memory.dmpFilesize
4KB
-
memory/4556-285-0x0000028810700000-0x0000028810701000-memory.dmpFilesize
4KB
-
memory/4556-261-0x00000288102E0000-0x00000288102E1000-memory.dmpFilesize
4KB
-
memory/4556-241-0x0000000000000000-mapping.dmp
-
memory/4556-364-0x0000028829610000-0x0000028829612000-memory.dmpFilesize
8KB
-
memory/4556-278-0x0000028810B60000-0x0000028810B61000-memory.dmpFilesize
4KB
-
memory/4588-172-0x0000016557180000-0x0000016557182000-memory.dmpFilesize
8KB
-
memory/4588-163-0x0000000000000000-mapping.dmp
-
memory/4604-440-0x0000000000000000-mapping.dmp
-
memory/4632-392-0x0000000000000000-mapping.dmp
-
memory/4632-426-0x0000000000000000-mapping.dmp
-
memory/4636-416-0x0000000000000000-mapping.dmp
-
memory/4656-227-0x00000240A0750000-0x00000240A0751000-memory.dmpFilesize
4KB
-
memory/4656-211-0x0000000000000000-mapping.dmp
-
memory/4656-253-0x00000240A1000000-0x00000240A1001000-memory.dmpFilesize
4KB
-
memory/4656-277-0x00000240B9940000-0x00000240B9942000-memory.dmpFilesize
8KB
-
memory/4656-246-0x00000240B9740000-0x00000240B9741000-memory.dmpFilesize
4KB
-
memory/4656-257-0x00000240B9710000-0x00000240B9711000-memory.dmpFilesize
4KB
-
memory/4676-276-0x0000022219620000-0x0000022219621000-memory.dmpFilesize
4KB
-
memory/4676-258-0x0000000000000000-mapping.dmp
-
memory/4696-421-0x0000000000000000-mapping.dmp
-
memory/4788-436-0x0000000000000000-mapping.dmp
-
memory/4800-429-0x0000000000000000-mapping.dmp
-
memory/4828-407-0x0000000000000000-mapping.dmp
-
memory/4832-270-0x0000000000000000-mapping.dmp
-
memory/4832-346-0x000001BBADE40000-0x000001BBADE42000-memory.dmpFilesize
8KB
-
memory/4832-284-0x000001BBAD5D0000-0x000001BBAD5D1000-memory.dmpFilesize
4KB
-
memory/4836-437-0x0000000000000000-mapping.dmp
-
memory/4840-439-0x0000000000000000-mapping.dmp
-
memory/4968-175-0x0000000000000000-mapping.dmp
-
memory/4972-174-0x0000000000000000-mapping.dmp
-
memory/4984-428-0x0000000000000000-mapping.dmp
-
memory/5012-409-0x0000000000000000-mapping.dmp
-
memory/5044-269-0x00000257F6900000-0x00000257F6901000-memory.dmpFilesize
4KB
-
memory/5044-245-0x00000257DD880000-0x00000257DD881000-memory.dmpFilesize
4KB
-
memory/5044-282-0x00000257F6B40000-0x00000257F6B42000-memory.dmpFilesize
8KB
-
memory/5044-237-0x0000000000000000-mapping.dmp
-
memory/5064-176-0x0000000000000000-mapping.dmp
-
memory/5072-177-0x0000000000000000-mapping.dmp
-
memory/5080-427-0x0000000000000000-mapping.dmp