Overview

overview

10

Static

static

10

Arquivo_4593167.msi

windows7-x64

10

Arquivo_4593167.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2024, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Arquivo_4593167.msi
  • Size 2.9MB
  • Sample241030-2d7thaserj
  • SHA256 0d47740bf97710835ebe91ac545ff0da45d81b54dfb8e2dea485fe5a123ae468
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Arquivo_4593167.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4896
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4580
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6D61D6D84B5879AD496940179AFAD02A
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI24AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657890 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3520
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2845.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240658500 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3220
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2E60.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240660125 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4556
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI3CFB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240663875 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3452
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 897185D7B2E07DC81C64F7DA3848F520 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2832
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3952
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4664
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000LlkxmIAB" /AgentId="2d853988-8d83-4071-b562-f6787d5a48e1"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1804
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EBC4B897A77FA70993274D3DA89D4527 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C246C2A4-0107-492C-A6DF-2E5ACEC8CA38}
          3⤵
          • Executes dropped EXE
          PID:2252
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C83F79A0-6199-4B7D-8D1A-5FBDE4DD4E1E}
          3⤵
          • Executes dropped EXE
          PID:4036
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2496D76B-688A-41F0-8745-4EF652F1B151}
          3⤵
          • Executes dropped EXE
          PID:2364
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C4B01CA-800E-477B-B685-77DA0C673962}
          3⤵
          • Executes dropped EXE
          PID:4376
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5B525A4D-53A1-4AFD-8B35-F7BBCED67F1A}
          3⤵
          • Executes dropped EXE
          PID:2328
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB75A004-0343-4F0D-8776-A387F23C1A63}
          3⤵
          • Executes dropped EXE
          PID:832
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5E777EA4-8AB0-4EFA-9350-C4AB6883161B}
          3⤵
          • Executes dropped EXE
          PID:4376
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07AB17C1-319D-4FAD-9A7F-991C362DB33F}
          3⤵
          • Executes dropped EXE
          PID:2328
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD136935-935D-417E-9B99-AA5C14101F43}
          3⤵
          • Executes dropped EXE
          PID:720
        • C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe
          C:\Windows\TEMP\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_is7E43.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C8A9129B-61DE-46B8-AC0C-ED1B7301184B}
          3⤵
          • Executes dropped EXE
          PID:4320
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2064
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1172
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4884
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4212
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2376
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2352
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4512
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4264
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3452
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2304
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1572
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4264
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3980
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2072
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1784
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2588
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4588
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2512
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3324
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1132
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DB5554D8-F841-4AF4-93F2-A2A1CC4E4E99}
          3⤵
          • Executes dropped EXE
          PID:1132
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1049FDDD-833D-4910-9510-59437512FA40}
          3⤵
          • Executes dropped EXE
          PID:3952
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00FE30F3-5ABF-4D54-BC85-D59691E998C1}
          3⤵
          • Executes dropped EXE
          PID:4776
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FBA233F6-36CA-4D0E-A396-1AFE04B8D50F}
          3⤵
          • Executes dropped EXE
          PID:2304
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FEA6DEA4-1F8B-4B38-B2DF-E807ECC1F0AF}
          3⤵
          • Executes dropped EXE
          PID:3716
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C85810A-7DA4-4393-9DF8-4725BA32A486}
          3⤵
          • Executes dropped EXE
          PID:3620
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FC082308-B230-4EA9-9A5C-1D1157FD2BE0}
          3⤵
          • Executes dropped EXE
          PID:4340
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73106763-CFE3-494F-A1F7-EE2DF14393C3}
          3⤵
          • Executes dropped EXE
          PID:1048
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8EFE77E1-FE61-4B93-89B5-1DE4758E7F2A}
          3⤵
          • Executes dropped EXE
          PID:2380
        • C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
          C:\Windows\TEMP\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{12A42573-71CE-415E-883C-B4A0E26EBCB5}
          3⤵
          • Executes dropped EXE
          PID:4964
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7B97CE2-5AA4-4121-B368-013782632772}
          3⤵
          • Executes dropped EXE
          PID:1604
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA197A4C-54E5-4D57-B1BA-0C8198BF5330}
          3⤵
          • Executes dropped EXE
          PID:2016
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1B0410A-3EDF-4113-9745-1A87D4BD0EEE}
          3⤵
          • Executes dropped EXE
          PID:3952
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A870DA53-D7CC-477F-A636-334F4D2E5945}
          3⤵
          • Executes dropped EXE
          PID:4340
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC3D9EB3-21EC-43F0-9B84-95378E1251DC}
          3⤵
          • Executes dropped EXE
          PID:2304
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5355FA0-088D-43AF-8FAD-A4DC96C0B6AA}
          3⤵
          • Executes dropped EXE
          PID:4192
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{05233822-7883-4B05-A2D6-58ABE5C6BE6B}
          3⤵
          • Executes dropped EXE
          PID:1604
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{550C92DF-F4A4-4C4E-B80C-751A921B3411}
          3⤵
          • Executes dropped EXE
          PID:2016
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BD13B508-E62F-4BB7-B886-A355CCB68204}
          3⤵
          • Executes dropped EXE
          PID:2328
        • C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe
          C:\Windows\TEMP\{F300B754-1847-4860-AE29-0DD39C49A860}\_is9B14.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{90971F72-A21D-4B9D-A31A-D3ACF2DD560D}
          3⤵
          • Executes dropped EXE
          PID:4236
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4996
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4840
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2172
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4416
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:3952
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3572
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{89FE4397-B084-4054-B100-06DD67797A73}
              3⤵
              • Executes dropped EXE
              PID:3620
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B11A746E-07F7-4EAF-960A-D6AA0FB616D8}
              3⤵
              • Executes dropped EXE
              PID:4964
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A6CD8EBB-DE58-4253-878F-9D33A34F7E80}
              3⤵
              • Executes dropped EXE
              PID:1604
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{79E2CB54-99E2-4779-BBDD-F3125426C951}
              3⤵
              • Executes dropped EXE
              PID:4264
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EED672C3-332F-422D-B4F9-B93F182202FE}
              3⤵
              • Executes dropped EXE
              PID:4584
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{927DE3CA-D89A-4D67-93E6-46DBC2ECBD06}
              3⤵
              • Executes dropped EXE
              PID:4416
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C31D7CE-CC5F-47F7-9A1C-60AC9A35C2BA}
              3⤵
              • Executes dropped EXE
              PID:1052
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9BE9BE2B-E134-49D7-9247-1A654B57964A}
              3⤵
              • Executes dropped EXE
              PID:2364
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{60C0C591-C26C-480D-8273-DA30526ED3C5}
              3⤵
              • Executes dropped EXE
              PID:3620
            • C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe
              C:\Windows\TEMP\{265A87FE-DBC7-467E-BA6F-47E4CAF43071}\_isAECD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{64B3E399-246E-413F-B784-4AFBFE59EEAE}
              3⤵
              • Executes dropped EXE
              PID:1596
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4616
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{47180217-21ED-4F46-A68B-A8C464A035A1}
              3⤵
              • Executes dropped EXE
              PID:2016
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{772BD5F2-B3B1-4915-A377-B640783D0F95}
              3⤵
              • Executes dropped EXE
              PID:4060
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8CEEE8D5-EF5A-4D6B-AB10-295F117CD020}
              3⤵
              • Executes dropped EXE
              PID:2724
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2069E87-3B98-4EE8-9E4F-1FFA366D0216}
              3⤵
              • Executes dropped EXE
              PID:2504
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3B684D3-CDFB-4ADC-A45A-E0251149506D}
              3⤵
              • Executes dropped EXE
              PID:2512
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91459A71-E5C4-4545-B845-BA6F53EDAE20}
              3⤵
              • Executes dropped EXE
              PID:5064
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A94B5495-E8F9-45E2-81EF-82C342413714}
              3⤵
              • Executes dropped EXE
              PID:4504
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5C7AB9A-B075-487D-9D18-24A929655722}
              3⤵
              • Executes dropped EXE
              PID:516
            • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
              C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF9D348D-C029-4B01-BED5-A46F15899C56}
              3⤵
                PID:4192
              • C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe
                C:\Windows\TEMP\{20496CA8-4369-4F47-BB05-7500DD4C369B}\_isB304.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA68871B-E6FC-46A2-AC6C-3CD5081EADBB}
                3⤵
                  PID:2248
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4980
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:1596
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 8CC57DA862082744D1BD38B012E44437 E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:3992
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIEADA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240708703 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                    3⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5980
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIF0C7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240709953 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5804
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIF78E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711593 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5892
                  • C:\Windows\SysWOW64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3836
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5912
                  • C:\Windows\SysWOW64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:5932
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5492
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5448
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:5792
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSI1D6F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240721234 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5260
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                  2⤵
                  • Drops file in System32 directory
                  PID:5548
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="b86e902c-5374-44f3-9733-78ad8e871233"
                  2⤵
                  • Drops file in Program Files directory
                  • Modifies data under HKEY_USERS
                  PID:1776
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4120
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2368
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:720
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "89358eb9-04aa-43a3-abf0-0610e00720c3" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  PID:4244
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "b96d4a7e-f36e-4b40-9ebd-9e6c33fee6bf" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  PID:1588
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "8a806122-b9fb-44c5-9264-3e483a1e169c" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  PID:792
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "58c963b6-ed44-48cc-ba6c-606045dd0de1" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2728
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3576
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:3452
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "b1192d07-07fe-4985-b76b-77d5aba54cb1" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3840
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4968
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1012
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:408
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "c15a003b-ef9b-4605-a48d-cefc5fa214a6" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3524
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4312
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:1012
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "e479d975-d4a2-443b-a992-9b28aaedc29e" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in Program Files directory
                  PID:2416
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:3980
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:3648
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "fb839c40-2f03-4b60-b645-8ac76a2c25eb" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000LlkxmIAB
                    2⤵
                      PID:2884
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                          PID:4320
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "3be1f7f5-5acd-4f83-b95e-1772321d96dd" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000LlkxmIAB
                        2⤵
                          PID:1844
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=9b2d7604fd5873d808af2aa301e499f6&rmm_session_pwd_ttl=86400"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5332
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "2b890368-f1e5-4dcb-949a-f06fce085e31" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000LlkxmIAB
                          2⤵
                          • Modifies registry class
                          PID:4856
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "b7a74ea6-de7c-4784-9693-30f734846a73" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000LlkxmIAB
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:4968
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "60c8ac03-c2de-4c5f-8947-0bfc9a529c45" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000LlkxmIAB
                          2⤵
                          • Drops file in System32 directory
                          PID:5216
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "346e148b-cb92-4602-b465-9132cf0ffbc6" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000LlkxmIAB
                          2⤵
                            PID:5608
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "652c6e2b-8c1e-4bc4-bc12-36989bf424c3" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000LlkxmIAB
                            2⤵
                            • Drops file in Program Files directory
                            PID:5692
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "6648aa98-96bd-4986-af9b-27abcef7576f" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000LlkxmIAB
                            2⤵
                            • Drops file in System32 directory
                            PID:5980
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "9ae1cece-3ddb-4c62-9e44-a9f8d8f78015" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000LlkxmIAB
                            2⤵
                              PID:2728
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "1c13e0dc-e31c-4019-b664-fc6e67fcdc84" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000LlkxmIAB
                              2⤵
                              • Writes to the Master Boot Record (MBR)
                              PID:5504
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "db3f9c37-ba7c-4776-a666-045888a0e600" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000LlkxmIAB
                              2⤵
                              • Drops file in System32 directory
                              PID:5432
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "537b2d35-3a0a-48eb-aceb-7e86aec4b131" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000LlkxmIAB
                              2⤵
                              • Drops file in System32 directory
                              PID:5452
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                3⤵
                                • System Time Discovery
                                PID:5292
                                • C:\Program Files\dotnet\dotnet.exe
                                  dotnet --list-runtimes
                                  4⤵
                                  • System Time Discovery
                                  PID:6072
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "47f6ec3b-fa57-464e-9c23-2ad8fe9f2795" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000LlkxmIAB
                              2⤵
                                PID:5752
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2504
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3716
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                  -h
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2292
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2512
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                    4⤵
                                      PID:2828
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2648
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4996
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                      SRUtility.exe -r
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3612
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5792
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                      4⤵
                                        PID:1704
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ver
                                          5⤵
                                            PID:5540
                                          • C:\Windows\system32\sc.exe
                                            sc query ddmgr
                                            5⤵
                                            • Launches sc.exe
                                            PID:208
                                          • C:\Windows\system32\sc.exe
                                            sc query lci_proxykmd
                                            5⤵
                                            • Launches sc.exe
                                            PID:3600
                                          • C:\Windows\system32\rundll32.exe
                                            rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                            5⤵
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Checks SCSI registry key(s)
                                            • Modifies data under HKEY_USERS
                                            PID:4972
                                  • C:\Windows\System32\mousocoreworker.exe
                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                    1⤵
                                      PID:5892
                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                      1⤵
                                      • Drops file in Program Files directory
                                      • Modifies data under HKEY_USERS
                                      PID:3648
                                      • C:\Windows\System32\sc.exe
                                        "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                        2⤵
                                        • Launches sc.exe
                                        PID:5684
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "f071f023-713a-4bb3-a8e0-51d91b65869d" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000LlkxmIAB
                                        2⤵
                                        • Modifies data under HKEY_USERS
                                        PID:2828
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          3⤵
                                            PID:5472
                                            • C:\Windows\system32\cscript.exe
                                              cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                              4⤵
                                              • Modifies data under HKEY_USERS
                                              PID:4972
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "001aeae4-d36d-4d1e-999d-2116661c2a8f" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000LlkxmIAB
                                          2⤵
                                            PID:976
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "58968a6e-4a94-4aa9-b7b9-b57e041cf4e1" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000LlkxmIAB
                                            2⤵
                                              PID:4720
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "87271a53-7dc2-4b78-89e7-173c61fcae5f" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000LlkxmIAB
                                              2⤵
                                                PID:3620
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "67bef192-9bae-415f-b01b-f0e33767637c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000LlkxmIAB
                                                2⤵
                                                  PID:3576
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "f1f43d48-dd37-411d-9f91-eeb32677fc38" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000LlkxmIAB
                                                  2⤵
                                                    PID:3528
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "996226ca-2130-4d7b-98ac-a8914c674cb7" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000LlkxmIAB
                                                    2⤵
                                                      PID:2552
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                        3⤵
                                                        • System Time Discovery
                                                        PID:5032
                                                        • C:\Program Files\dotnet\dotnet.exe
                                                          dotnet --list-runtimes
                                                          4⤵
                                                          • System Time Discovery
                                                          PID:6612
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "e9e97575-ab99-412d-a24c-767342d9e272" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000LlkxmIAB
                                                      2⤵
                                                      • Writes to the Master Boot Record (MBR)
                                                      • Drops file in Program Files directory
                                                      PID:5292
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "293cae51-b8f0-409a-a88c-b7e67493eb7d" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000LlkxmIAB
                                                      2⤵
                                                        PID:2352
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "1b5aadd0-838d-4a05-99af-bdedb7cd2f58" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000LlkxmIAB
                                                        2⤵
                                                          PID:6352
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "2518928a-d2fc-46a1-b5c0-7955c7775a29" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000LlkxmIAB
                                                          2⤵
                                                            PID:6724
                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=9b2d7604fd5873d808af2aa301e499f6&rmm_session_pwd_ttl=86400"
                                                              3⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6928
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "3a4ca79c-4435-4945-b0e9-d86feb4a23c6" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000LlkxmIAB
                                                            2⤵
                                                              PID:6864
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 2d853988-8d83-4071-b562-f6787d5a48e1 "7494001d-50fe-4b95-ab97-bd531166d6f9" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000LlkxmIAB
                                                              2⤵
                                                                PID:7132
                                                                • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                  "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "2d853988-8d83-4071-b562-f6787d5a48e1" "7494001d-50fe-4b95-ab97-bd531166d6f9" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000LlkxmIAB"
                                                                  3⤵
                                                                    PID:5632
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                PID:5516
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "00000000000000E8" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:5696
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:4696
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000144"
                                                                  2⤵
                                                                  • Drops file in Drivers directory
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:4588
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                  2⤵
                                                                  • Drops file in Drivers directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:6020

                                                              Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Persistence

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Privilege Escalation

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    1
                                                                    T1112

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Subvert Trust Controls

                                                                    1
                                                                    T1553

                                                                    Install Root Certificate

                                                                    1
                                                                    T1553.004

                                                                    System Binary Proxy Execution

                                                                    1
                                                                    T1218

                                                                    Msiexec

                                                                    1
                                                                    T1218.007

                                                                    Credential Access

                                                                    Discovery

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    4
                                                                    T1012

                                                                    System Information Discovery

                                                                    3
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    e5823d0.rbs
                                                                    • Path C:\Config.Msi\e5823d0.rbs
                                                                    • Size 8KB
                                                                    • SHA256 bd3db919459f994df11efb831d488f3e7e31653e79b0499c217192834132acd3
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    e5823d5.rbs
                                                                    • Path C:\Config.Msi\e5823d5.rbs
                                                                    • Size 74KB
                                                                    • SHA256 adc02a3c60609d257ff459d16027f93ff352c150e8aba81da517a130ce0ff4cd
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    e5823d7.rbs
                                                                    • Path C:\Config.Msi\e5823d7.rbs
                                                                    • Size 464B
                                                                    • SHA256 cfb9025e4447aa4675fe2a2d199fe35a43f4ecffc6f450cd6a77c4514781b803
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    e5823dd.rbs
                                                                    • Path C:\Config.Msi\e5823dd.rbs
                                                                    • Size 9KB
                                                                    • SHA256 f64d3847008f518d5fa4589b577897eaa8ebb8682cfe74e775156b6a6c1f42c7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    e5823e5.rbs
                                                                    • Path C:\Config.Msi\e5823e5.rbs
                                                                    • Size 8KB
                                                                    • SHA256 61d469df1d4f42741f54b998d6a373cc31f2a59091508b1e9929d4d507c333ac
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AteraAgent.InstallLog
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                    • Size 1KB
                                                                    • SHA256 1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AteraAgent.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                    • Size 142KB
                                                                    • SHA256 a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AteraAgent.exe.config
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                    • Size 1KB
                                                                    • SHA256 e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    ICSharpCode.SharpZipLib.dll
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                    • Size 210KB
                                                                    • SHA256 2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Newtonsoft.Json.dll
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                    • Size 693KB
                                                                    • SHA256 2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Agent.Package.Watchdog.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                    • Size 157KB
                                                                    • SHA256 9338c8080cb7be1ee73f1cd706e5e230a0c3b8690305cd9de451fad20b2d0b7b
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageADRemote.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                    • Size 51KB
                                                                    • SHA256 5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageAgentInformation.INI
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                    • Size 12B
                                                                    • SHA256 3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AgentPackageAgentInformation.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                    • Size 173KB
                                                                    • SHA256 36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageAgentInformation.exe.config
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                    • Size 546B
                                                                    • SHA256 5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Atera.AgentPackage.Common.dll
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                    • Size 94KB
                                                                    • SHA256 c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Newtonsoft.Json.dll
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                    • Size 688KB
                                                                    • SHA256 12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageHeartbeat.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                    • Size 27KB
                                                                    • SHA256 7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageInternalPoller.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                    • Size 214KB
                                                                    • SHA256 9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageMarketplace.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                    • Size 37KB
                                                                    • SHA256 30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageMonitoring.zip
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                    • Size 3.4MB
                                                                    • SHA256 98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageMonitoring.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                    • Size 389KB
                                                                    • SHA256 01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    package_2.db
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                    • Size 48KB
                                                                    • SHA256 1f9ea6f107c811c95e05546c0f7eda46b876a67d8663c6a5aed3bee3f8ce528e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageOsUpdates.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                    • Size 195KB
                                                                    • SHA256 adacab8ac34991a5b4908aafb21a9d0eef3a24b4a44ac6b48a1ac745623eb2a9
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageProgramManagement.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                    • Size 55KB
                                                                    • SHA256 b9a24b5a8d6e2cdb3b5fd5e22b415b42246e7aba4e82eb193345e98128f9817a
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    chocolatey.config
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                    • Size 9KB
                                                                    • SHA256 11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    chocolatey.config.5692.update
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5692.update
                                                                    • Size 9KB
                                                                    • SHA256 6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    chocolatey.log
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                    • Size 7KB
                                                                    • SHA256 090e1abea048c28c61821e9c0b83e4a66ab9cf07f2697303aa06cfcc3678bdfc
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    cpush.exe.ignore
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                    • Size 2B
                                                                    • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AgentPackageRuntimeInstaller.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                    • Size 54KB
                                                                    • SHA256 2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageSTRemote.zip
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                    • Size 334KB
                                                                    • SHA256 adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageSTRemote.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                    • Size 72KB
                                                                    • SHA256 c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageSystemTools.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                    • Size 50KB
                                                                    • SHA256 6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageTicketing.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                    • Size 32KB
                                                                    • SHA256 8f95244aee9389ad0eee52a25f6a9ed67561f504d7eaca085bea5be94e12b724
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageUpgradeAgent.exe
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                    • Size 54KB
                                                                    • SHA256 11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Pubnub.dll
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                    • Size 588KB
                                                                    • SHA256 13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    log.txt
                                                                    • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                    • Size 239B
                                                                    • SHA256 a2b050b4eb292d50fb1f6d93024a00b997c379106df5f6991e6e7e76fd0e5274
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    DIFxCmd.exe
                                                                    • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                    • Size 9KB
                                                                    • SHA256 0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    DIFxCmd64.exe
                                                                    • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                    • Size 10KB
                                                                    • SHA256 a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    devcon.exe
                                                                    • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                    • Size 76KB
                                                                    • SHA256 800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    devcon64.exe
                                                                    • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                    • Size 80KB
                                                                    • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    SRAgent.sqlite3
                                                                    • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                    • Size 88KB
                                                                    • SHA256 4bcf03ae8d9c7317db6b754274be27428f09eb91f37dd98f4454ed1e537d6181
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AteraAgent.InstallLog
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                    • Size 321B
                                                                    • SHA256 85839872a437e67907189ce9e7523c91c700472bb150ee39db06c3dfb91e4cf1
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AteraAgent.InstallState
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                    • Size 7KB
                                                                    • SHA256 1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Agent.Package.Watchdog.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                    • Size 1.9MB
                                                                    • SHA256 a27b758c00eab6777ac9571ef4fcdb80abaccbc4eb6fa5ff8e5ec33c08ffbc37
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageADRemote.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                    • Size 1.1MB
                                                                    • SHA256 88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageAgentInformation.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                    • Size 375KB
                                                                    • SHA256 29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageHeartbeat.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                    • Size 321KB
                                                                    • SHA256 dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageInternalPoller.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                    • Size 814KB
                                                                    • SHA256 09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageMarketplace.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                    • Size 1.2MB
                                                                    • SHA256 a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageMonitoring.ini
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                    • Size 12B
                                                                    • SHA256 a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    package_2.db
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                    • Size 48KB
                                                                    • SHA256 5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    package_2.db
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                    • Size 48KB
                                                                    • SHA256 d59aa31a38b625f831db4d5b10e1933290221955e5d39f2dd4420c30f584041d
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    package_2.db
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                    • Size 48KB
                                                                    • SHA256 52e6959ba7dd2424c61f2b0122f3b66bac486b9edf5c19521a612da4fd3f0b14
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageOsUpdates.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                    • Size 2.8MB
                                                                    • SHA256 30215a902c746227df0d5fed400eaf74a5c1e827d50eec7c21cd37ea1b299aa5
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageProgramManagement.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                    • Size 2.9MB
                                                                    • SHA256 a124b14f13dcea8e25a9b7d9350e0b5527006e921f0c32ff922826f6564b170b
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageRuntimeInstaller.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                    • Size 1.1MB
                                                                    • SHA256 e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageRuntimeInstaller.ini
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.ini
                                                                    • Size 11B
                                                                    • SHA256 12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AgentPackageSTRemote.exe.config
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                    • Size 541B
                                                                    • SHA256 7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AgentPackageSTRemote.ini
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                    • Size 12B
                                                                    • SHA256 73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    AgentPackageSystemTools.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                    • Size 646KB
                                                                    • SHA256 ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AgentPackageUpgradeAgent.zip
                                                                    • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                    • Size 569KB
                                                                    • SHA256 dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    645248b1ab96798ce691366ea1173d31
                                                                    • Path C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\645248b1ab96798ce691366ea1173d31
                                                                    • Size 16KB
                                                                    • SHA256 5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    chocolatey.config
                                                                    • Path C:\ProgramData\chocolatey\config\chocolatey.config
                                                                    • Size 809B
                                                                    • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    chocolatey.log
                                                                    • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                    • Size 12KB
                                                                    • SHA256 ff8a345b86e27c41b671f21ca61d5db59bb6e701b68101c19d645e1bc4885bea
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Size 471B
                                                                    • SHA256 89fec915186f771ea75e806b37951b415a87d9091bae6c503f045092254a9705
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                    • Size 727B
                                                                    • SHA256 bb75eeb18bda565003475de62ef5c37ca005d2809c0da6fdcdeb82c07b6a71ff
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                    • Size 727B
                                                                    • SHA256 b0fa8ff8516c233400ff93675d5091c6747a19287d70c92c470fb30978868fa6
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Size 400B
                                                                    • SHA256 cc546c3c2897d94347d7f8b643519186d337169c2c7c054a1e9300ed02c39c67
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                    • Size 404B
                                                                    • SHA256 38ab720d65e07b346c1e4b3fee15880b5c1551e5ac4afa6a028b7d88e2fc6277
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                    • Size 412B
                                                                    • SHA256 49e53bd9e853c1c392a9a01470967b60e7d528f78114d0cf749c67fa7f914662
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    rundll32.exe.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                    • Size 651B
                                                                    • SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    MSI24AA.tmp
                                                                    • Path C:\Windows\Installer\MSI24AA.tmp
                                                                    • Size 509KB
                                                                    • SHA256 87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AlphaControlAgentInstallation.dll
                                                                    • Path C:\Windows\Installer\MSI24AA.tmp-\AlphaControlAgentInstallation.dll
                                                                    • Size 25KB
                                                                    • SHA256 e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Microsoft.Deployment.WindowsInstaller.dll
                                                                    • Path C:\Windows\Installer\MSI24AA.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                    • Size 179KB
                                                                    • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    CustomAction.config
                                                                    • Path C:\Windows\Installer\MSI2845.tmp-\CustomAction.config
                                                                    • Size 1KB
                                                                    • SHA256 e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Newtonsoft.Json.dll
                                                                    • Path C:\Windows\Installer\MSI2845.tmp-\Newtonsoft.Json.dll
                                                                    • Size 695KB
                                                                    • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    MSI30C3.tmp
                                                                    • Path C:\Windows\Installer\MSI30C3.tmp
                                                                    • Size 211KB
                                                                    • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    MSI9A17.tmp
                                                                    • Path C:\Windows\Installer\MSI9A17.tmp
                                                                    • Size 4.5MB
                                                                    • SHA256 72896d8abeeeb40360596927c0feade8f0bc28f9937d35f646b9ba2a47f1edca
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    System.Management.dll
                                                                    • Path C:\Windows\Installer\MSIEADA.tmp-\System.Management.dll
                                                                    • Size 60KB
                                                                    • SHA256 24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    e5823cf.msi
                                                                    • Path C:\Windows\Installer\e5823cf.msi
                                                                    • Size 2.9MB
                                                                    • SHA256 0d47740bf97710835ebe91ac545ff0da45d81b54dfb8e2dea485fe5a123ae468
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_iddcx.cat
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{55f9bf06-9f68-084b-91f9-d9763d2d1386}\lci_iddcx.cat
                                                                    • Size 10KB
                                                                    • SHA256 85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_iddcx.inf
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{55f9bf06-9f68-084b-91f9-d9763d2d1386}\lci_iddcx.inf
                                                                    • Size 4KB
                                                                    • SHA256 60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_iddcx.dll
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{55f9bf06-9f68-084b-91f9-d9763d2d1386}\x64\lci_iddcx.dll
                                                                    • Size 52KB
                                                                    • SHA256 148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_proxywddm.cat
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{d5750b48-e25f-1e48-9144-709fd30acacc}\lci_proxywddm.cat
                                                                    • Size 12KB
                                                                    • SHA256 7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_proxywddm.inf
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{d5750b48-e25f-1e48-9144-709fd30acacc}\lci_proxywddm.inf
                                                                    • Size 2KB
                                                                    • SHA256 d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    lci_proxyumd.dll
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{d5750b48-e25f-1e48-9144-709fd30acacc}\x64\lci_proxyumd.dll
                                                                    • Size 179KB
                                                                    • SHA256 e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_proxyumd32.dll
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{d5750b48-e25f-1e48-9144-709fd30acacc}\x64\lci_proxyumd32.dll
                                                                    • Size 135KB
                                                                    • SHA256 79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    lci_proxywddm.sys
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{d5750b48-e25f-1e48-9144-709fd30acacc}\x64\lci_proxywddm.sys
                                                                    • Size 119KB
                                                                    • SHA256 0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    B7C5EA94-B96A-41F5-BE95-25D78B486678-22-30-05.dat
                                                                    • Path C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-22-30-05.dat
                                                                    • Size 602B
                                                                    • SHA256 15605cfd388384f476ed05c79a8d6c1892235b720f2f65d7db129df1b688b090
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    InstallUtil.log
                                                                    • Path C:\Windows\Temp\InstallUtil.log
                                                                    • Size 4KB
                                                                    • SHA256 b47c608829bc7d21fdc3bbe6e63c1e2efaced0fceb4dd970c0a71a522e8eca89
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    InstallUtil.log
                                                                    • Path C:\Windows\Temp\InstallUtil.log
                                                                    • Size 976B
                                                                    • SHA256 8f5523a43a8f91d450d60e646100d44aec8c113408cd4c82a1fa02fd0e2cae90
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    InstallUtil.log
                                                                    • Path C:\Windows\Temp\InstallUtil.log
                                                                    • Size 1KB
                                                                    • SHA256 31837ae276a7cb2eb19dfc3127a03540155d325dd6f95dc18ac176a67607bfbf
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    PreVer.log
                                                                    • Path C:\Windows\Temp\PreVer.log
                                                                    • Size 2KB
                                                                    • SHA256 4b70c7a4503d7b4e16d6728e4c312999d8c405a3aff7bb5449dd9e582c3ea5f3
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    unpack.log
                                                                    • Path C:\Windows\Temp\unpack.log
                                                                    • Size 4KB
                                                                    • SHA256 172e7470abdac4e186492d3740af28a43dfd842480a5ba28af467c17ef329ec1
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    PreVerCheck.exe
                                                                    • Path C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                    • Size 2.7MB
                                                                    • SHA256 83ef8e362af27279b63ef28379675a087984791e5eaf4a9272a5cb4e52dd059c
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    ISRT.dll
                                                                    • Path C:\Windows\Temp\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\ISRT.dll
                                                                    • Size 427KB
                                                                    • SHA256 70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    _isres_0x0409.dll
                                                                    • Path C:\Windows\Temp\{2746198C-FE6E-44A4-8540-3029FDC4BBEB}\_isres_0x0409.dll
                                                                    • Size 1.8MB
                                                                    • SHA256 9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    IsConfig.ini
                                                                    • Path C:\Windows\Temp\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\IsConfig.ini
                                                                    • Size 571B
                                                                    • SHA256 d193eda99410268676293d315164ff29cd263ca0251a0238592a23a9d78476b0
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    String1033.txt
                                                                    • Path C:\Windows\Temp\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\String1033.txt
                                                                    • Size 182KB
                                                                    • SHA256 bd703470b2f35e3c4d917d3038bf806fcc7c155142d300806c95500274951efd
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    _is8DA6.exe
                                                                    • Path C:\Windows\Temp\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\_is8DA6.exe
                                                                    • Size 179KB
                                                                    • SHA256 e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    setup.inx
                                                                    • Path C:\Windows\Temp\{F14F5D6A-4B85-4267-BF9C-0A92EE682641}\setup.inx
                                                                    • Size 345KB
                                                                    • SHA256 c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                    • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                    • Size 404B
                                                                    • SHA256 f9482a359621f71f5672bdb300217f2e71a28ba4cec2c40439c5dc39b64e9aa7
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                    • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                    • Size 412B
                                                                    • SHA256 646ed20063ae5a1dd5a0ebd40f867900c8a7b6f668af78a9f6a93c7cac070f61
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    {2399666d-465f-454a-867c-25e83c01c14c}_OnDiskSnapshotProp
                                                                    • Path \??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2399666d-465f-454a-867c-25e83c01c14c}_OnDiskSnapshotProp
                                                                    • Size 6KB
                                                                    • SHA256 8c5ab5b0ceed8c55ffd856c98502c61ff076349ac8c3321658eabc5b6168c90b
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    memory/1804-165-0x0000012965430000-0x000001296546C000-memory.dmp
                                                                    Download

                                                                    memory/1804-148-0x000001294AF20000-0x000001294AF48000-memory.dmp
                                                                    Download

                                                                    memory/1804-160-0x0000012965580000-0x0000012965618000-memory.dmp
                                                                    Download

                                                                    memory/1804-164-0x000001294CBF0000-0x000001294CC02000-memory.dmp
                                                                    Download

                                                                    memory/2292-2487-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/2292-2486-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/2292-2335-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/2292-2336-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/2292-2334-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/2292-1171-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/2292-2488-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/2292-1156-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/2292-1155-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/2368-241-0x000002AFC8640000-0x000002AFC8678000-memory.dmp
                                                                    Download

                                                                    memory/2368-202-0x000002AFC8040000-0x000002AFC8062000-memory.dmp
                                                                    Download

                                                                    memory/2368-195-0x000002AFC8100000-0x000002AFC81B2000-memory.dmp
                                                                    Download

                                                                    memory/2512-1926-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/2512-1152-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/2512-1924-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/2512-1925-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/2512-1153-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/2512-1154-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/2512-2189-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/2512-2190-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/2512-2191-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/2728-1765-0x000001271D6B0000-0x000001271D6CC000-memory.dmp
                                                                    Download

                                                                    memory/2728-1758-0x000001271CE70000-0x000001271CE80000-memory.dmp
                                                                    Download

                                                                    memory/2728-1791-0x0000012736240000-0x00000127362F2000-memory.dmp
                                                                    Download

                                                                    memory/2728-1761-0x000001271D730000-0x000001271D77A000-memory.dmp
                                                                    Download

                                                                    memory/2728-1778-0x0000012736160000-0x000001273623C000-memory.dmp
                                                                    Download

                                                                    memory/2884-1344-0x000001EB76E40000-0x000001EB76EF2000-memory.dmp
                                                                    Download

                                                                    memory/2884-1288-0x000001EB5E480000-0x000001EB5E49C000-memory.dmp
                                                                    Download

                                                                    memory/2884-1280-0x000001EB5DC20000-0x000001EB5DC32000-memory.dmp
                                                                    Download

                                                                    memory/2884-1755-0x000001EB76D80000-0x000001EB76DD4000-memory.dmp
                                                                    Download

                                                                    memory/3112-987-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                    Download

                                                                    memory/3112-1079-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                    Download

                                                                    memory/3112-478-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                    Download

                                                                    memory/3112-903-0x00000000039D0000-0x0000000003B97000-memory.dmp
                                                                    Download

                                                                    memory/3112-900-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                    Download

                                                                    memory/3112-512-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                    Download

                                                                    memory/3112-481-0x0000000003990000-0x0000000003B57000-memory.dmp
                                                                    Download

                                                                    memory/3220-80-0x0000000004F10000-0x0000000005264000-memory.dmp
                                                                    Download

                                                                    memory/3220-79-0x00000000029C0000-0x00000000029E2000-memory.dmp
                                                                    Download

                                                                    memory/3220-76-0x0000000004E50000-0x0000000004F02000-memory.dmp
                                                                    Download

                                                                    memory/3520-43-0x0000000004B70000-0x0000000004B7C000-memory.dmp
                                                                    Download

                                                                    memory/3520-39-0x0000000004B80000-0x0000000004BAE000-memory.dmp
                                                                    Download

                                                                    memory/3524-356-0x00000205BE840000-0x00000205BE87A000-memory.dmp
                                                                    Download

                                                                    memory/3524-348-0x00000205A5A80000-0x00000205A5A8A000-memory.dmp
                                                                    Download

                                                                    memory/3524-357-0x00000205BE540000-0x00000205BE566000-memory.dmp
                                                                    Download

                                                                    memory/3524-354-0x00000205BE790000-0x00000205BE7F8000-memory.dmp
                                                                    Download

                                                                    memory/3524-355-0x00000205BE570000-0x00000205BE59A000-memory.dmp
                                                                    Download

                                                                    memory/3524-353-0x00000205BE530000-0x00000205BE538000-memory.dmp
                                                                    Download

                                                                    memory/3524-352-0x00000205BE3F0000-0x00000205BE3F8000-memory.dmp
                                                                    Download

                                                                    memory/3524-351-0x00000205A5B60000-0x00000205A5B68000-memory.dmp
                                                                    Download

                                                                    memory/3524-350-0x00000205BE6D0000-0x00000205BE782000-memory.dmp
                                                                    Download

                                                                    memory/3524-342-0x00000205A51B0000-0x00000205A5214000-memory.dmp
                                                                    Download

                                                                    memory/3524-343-0x00000205A5AC0000-0x00000205A5B0A000-memory.dmp
                                                                    Download

                                                                    memory/3524-344-0x00000205A5A50000-0x00000205A5A6C000-memory.dmp
                                                                    Download

                                                                    memory/3524-349-0x00000205BE5F0000-0x00000205BE6CC000-memory.dmp
                                                                    Download

                                                                    memory/3524-347-0x00000205A5A70000-0x00000205A5A78000-memory.dmp
                                                                    Download

                                                                    memory/3524-345-0x00000205BE350000-0x00000205BE39C000-memory.dmp
                                                                    Download

                                                                    memory/3524-346-0x00000205BE3A0000-0x00000205BE3E8000-memory.dmp
                                                                    Download

                                                                    memory/3716-1777-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/3716-1133-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/3716-1779-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/3716-1806-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/3716-1776-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/3716-2331-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/3716-1132-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/3716-1134-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/3716-2184-0x0000000072850000-0x000000007296C000-memory.dmp
                                                                    Download

                                                                    memory/3716-2183-0x0000000072970000-0x0000000072A6D000-memory.dmp
                                                                    Download

                                                                    memory/3716-2185-0x0000000072480000-0x0000000072844000-memory.dmp
                                                                    Download

                                                                    memory/3840-302-0x000002018F6B0000-0x000002018F6CC000-memory.dmp
                                                                    Download

                                                                    memory/3840-300-0x000002018ED30000-0x000002018ED46000-memory.dmp
                                                                    Download

                                                                    memory/3840-301-0x00000201A7E90000-0x00000201A7F42000-memory.dmp
                                                                    Download

                                                                    memory/4244-275-0x000002624B150000-0x000002624B200000-memory.dmp
                                                                    Download

                                                                    memory/4244-272-0x0000026232040000-0x0000026232070000-memory.dmp
                                                                    Download

                                                                    memory/4244-277-0x00000262328C0000-0x00000262328DC000-memory.dmp
                                                                    Download

                                                                    memory/4556-110-0x0000000004FF0000-0x0000000005056000-memory.dmp
                                                                    Download

                                                                    memory/4856-1496-0x000001C30F420000-0x000001C30F42C000-memory.dmp
                                                                    Download

                                                                    memory/4856-1616-0x000001C30F8F0000-0x000001C30F910000-memory.dmp
                                                                    Download

                                                                    memory/4856-1515-0x000001C30F8D0000-0x000001C30F8E8000-memory.dmp
                                                                    Download

                                                                    memory/4856-1556-0x000001C3285B0000-0x000001C328662000-memory.dmp
                                                                    Download

                                                                    memory/4968-1736-0x0000023078EE0000-0x0000023078F92000-memory.dmp
                                                                    Download

                                                                    memory/4968-1613-0x00000230785A0000-0x00000230785BA000-memory.dmp
                                                                    Download

                                                                    memory/4968-1784-0x00000230795D0000-0x0000023079AF8000-memory.dmp
                                                                    Download

                                                                    memory/4968-1562-0x0000023077D40000-0x0000023077D4A000-memory.dmp
                                                                    Download

                                                                    memory/5216-1726-0x0000020A21910000-0x0000020A2195A000-memory.dmp
                                                                    Download

                                                                    memory/5216-1783-0x0000020A3A2F0000-0x0000020A3A3A0000-memory.dmp
                                                                    Download

                                                                    memory/5216-1716-0x0000020A20F30000-0x0000020A20F3C000-memory.dmp
                                                                    Download

                                                                    memory/5216-1760-0x0000020A21310000-0x0000020A2132C000-memory.dmp
                                                                    Download

                                                                    memory/5432-1774-0x0000017CBDF30000-0x0000017CBDF4C000-memory.dmp
                                                                    Download

                                                                    memory/5432-1785-0x0000017CD6830000-0x0000017CD687A000-memory.dmp
                                                                    Download

                                                                    memory/5432-1769-0x0000017CBDF60000-0x0000017CBDFAA000-memory.dmp
                                                                    Download

                                                                    memory/5432-1782-0x0000017CBDFB0000-0x0000017CBDFBA000-memory.dmp
                                                                    Download

                                                                    memory/5432-1766-0x0000017CBD6B0000-0x0000017CBD6E4000-memory.dmp
                                                                    Download

                                                                    memory/5432-1781-0x0000017CD67C0000-0x0000017CD67D8000-memory.dmp
                                                                    Download

                                                                    memory/5452-1792-0x00000254AC6B0000-0x00000254AC762000-memory.dmp
                                                                    Download

                                                                    memory/5452-1763-0x0000025493330000-0x0000025493342000-memory.dmp
                                                                    Download

                                                                    memory/5452-1764-0x0000025493C20000-0x0000025493C6A000-memory.dmp
                                                                    Download

                                                                    memory/5452-1770-0x0000025493B80000-0x0000025493B9C000-memory.dmp
                                                                    Download

                                                                    memory/5452-1793-0x00000254AC850000-0x00000254AC92C000-memory.dmp
                                                                    Download

                                                                    memory/5608-1754-0x0000025C3C6C0000-0x0000025C3C6FA000-memory.dmp
                                                                    Download

                                                                    memory/5608-1786-0x0000025C55960000-0x0000025C55A12000-memory.dmp
                                                                    Download

                                                                    memory/5608-1790-0x0000025C3CC90000-0x0000025C3CCD8000-memory.dmp
                                                                    Download

                                                                    memory/5608-1787-0x0000025C3CC10000-0x0000025C3CC2C000-memory.dmp
                                                                    Download

                                                                    memory/5692-1753-0x0000020AC0A90000-0x0000020AC0AA0000-memory.dmp
                                                                    Download

                                                                    memory/5692-1772-0x0000020AC0F50000-0x0000020AC0F70000-memory.dmp
                                                                    Download

                                                                    memory/5692-1759-0x0000020AC0F20000-0x0000020AC0F30000-memory.dmp
                                                                    Download

                                                                    memory/5692-1768-0x0000020AC1500000-0x0000020AC15B2000-memory.dmp
                                                                    Download

                                                                    memory/5980-1767-0x0000023D27150000-0x0000023D27160000-memory.dmp
                                                                    Download

                                                                    memory/5980-1780-0x0000023D279D0000-0x0000023D279E4000-memory.dmp
                                                                    Download

                                                                    memory/5980-1775-0x0000023D403D0000-0x0000023D40436000-memory.dmp
                                                                    Download

                                                                    memory/5980-1771-0x0000023D27990000-0x0000023D279B0000-memory.dmp
                                                                    Download

                                                                    memory/5980-1773-0x0000023D40310000-0x0000023D403C2000-memory.dmp
                                                                    Download