Overview

overview

10

Static

static

10

160d67508f...f4.msi

windows7-x64

10

160d67508f...f4.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 02:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4.msi
  • Size 2.9MB
  • Sample241108-cm27yashmn
  • SHA256 160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1764
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:324
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:436
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 661407335CE78DA5A4795A0DB8547FC7
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB621.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629500 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1276
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB8D1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629984 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4232
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIBC9B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240630968 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:464
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC8B6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634093 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1012
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 55CB7937C6BAD2226FE2A1ACAD48FB32 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:668
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4612
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3296
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000M0aRpIAJ" /AgentId="beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360"
        2⤵
        • Network Service Discovery
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1876
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding CC70232824D8DC00BD47BE4E34BA1826 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E3D14F20-42F4-4960-A64E-A5615638234E}
          3⤵
          • Executes dropped EXE
          PID:3052
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C532832F-6345-4AB3-A292-7767C34F725D}
          3⤵
          • Executes dropped EXE
          PID:2656
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{922AD266-EB8A-438A-99A6-85B4EB6A044B}
          3⤵
          • Executes dropped EXE
          PID:228
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F44F068-42CE-46F6-8766-B8B6A0C81A75}
          3⤵
          • Executes dropped EXE
          PID:4680
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A15BB09-C7F6-4EB0-9E82-54FF44866C3E}
          3⤵
          • Executes dropped EXE
          PID:4132
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AAAF8DA3-117F-4D7D-A89F-C7825FC1F50D}
          3⤵
          • Executes dropped EXE
          PID:3764
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E46E2CA9-20A7-43F2-A7ED-689996206E1B}
          3⤵
          • Executes dropped EXE
          PID:3592
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40556A26-669A-439C-9D4B-6EE378F92C29}
          3⤵
          • Executes dropped EXE
          PID:396
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5BD6AF12-C3A5-4869-BAC6-1711CC408060}
          3⤵
          • Executes dropped EXE
          PID:2656
        • C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe
          C:\Windows\TEMP\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isFC03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CF71FA28-64A0-4338-B898-693D497A2128}
          3⤵
          • Executes dropped EXE
          PID:3424
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3104
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1916
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3492
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4864
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3016
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3572
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1828
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:4680
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeature.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:4492
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4132
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeatMini.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:4456
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2464
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRManager.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:3968
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2828
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAgent.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1388
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:760
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:3052
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1384
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:3968
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRAudioChat.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2448
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4492
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRVirtualDisplay.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4972
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DC8FE27-708D-4BC7-AEB5-20378D8DF9AD}
              3⤵
              • Executes dropped EXE
              PID:3132
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3FC826B-B042-425A-91DC-56484CF54377}
              3⤵
              • Executes dropped EXE
              PID:3424
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA4C774A-F1FF-415B-8832-438EB7E373BD}
              3⤵
              • Executes dropped EXE
              PID:4384
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9D41FDD8-F22F-456F-80D5-C278DCC88DCE}
              3⤵
              • Executes dropped EXE
              PID:448
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9724D04-CA81-455E-8432-82895267DB0C}
              3⤵
              • Executes dropped EXE
              PID:2792
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B4451E6E-E007-46D5-A710-1B28EDAF8742}
              3⤵
              • Executes dropped EXE
              PID:4456
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{188C2F2D-D8A4-48B0-BBE4-B913300591FE}
              3⤵
              • Executes dropped EXE
              PID:3180
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD86D795-3479-48D8-A9B4-DE7E12DB3D89}
              3⤵
              • Executes dropped EXE
              PID:4972
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D549897B-B868-4BA5-A03D-BBFBFD174E54}
              3⤵
              • Executes dropped EXE
              PID:3824
            • C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
              C:\Windows\TEMP\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33025139-433A-4456-8527-D633A4D04841}
              3⤵
              • Executes dropped EXE
              PID:3764
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A0FE13A-9BF7-482F-B106-F3E8D78854B6}
              3⤵
              • Executes dropped EXE
              PID:1536
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{555B8E8C-4403-4A09-ACD5-3FC7E4A701C3}
              3⤵
              • Executes dropped EXE
              PID:4268
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71F2F035-2E8C-4AE6-90D8-1A6917B44056}
              3⤵
              • Executes dropped EXE
              PID:1972
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{336A1BA9-6470-4D79-99BB-1A62218BD0D8}
              3⤵
              • Executes dropped EXE
              PID:5064
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40C938AF-DDD5-49A5-BE23-B0E5155E1E95}
              3⤵
              • Executes dropped EXE
              PID:4368
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EDE0C997-7C5E-4C99-9DE5-90EE78EC0C5C}
              3⤵
              • Executes dropped EXE
              PID:2792
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18C97F95-5D74-4570-9BC7-FDDABD354CEE}
              3⤵
              • Executes dropped EXE
              PID:1512
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F1D513AC-66AD-49DB-B1C4-45F327BACE07}
              3⤵
              • Executes dropped EXE
              PID:2744
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E45F0246-94FC-4378-94D3-89499AFB8DF7}
              3⤵
              • Executes dropped EXE
              PID:3424
            • C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe
              C:\Windows\TEMP\{2B7DE1E3-7FBE-443F-BD16-7E4721B4F502}\_is170F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA7863C5-64F9-4BD5-A817-07D8D13A0119}
              3⤵
              • Executes dropped EXE
              PID:3620
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3724
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4144
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:3812
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                4⤵
                  PID:1876
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                  4⤵
                    PID:3160
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3384
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49050BAE-EF0E-49FD-A5A4-B85595ED97B8}
                  3⤵
                  • Executes dropped EXE
                  PID:3160
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDCF167B-0D78-4ED1-AFA5-3DB004E623B0}
                  3⤵
                  • Executes dropped EXE
                  PID:828
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{178E5C48-88AD-40DB-9A41-EDDA2E557254}
                  3⤵
                  • Executes dropped EXE
                  PID:3620
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E9C3E8E-7975-4E2F-9A3D-43C2743570EA}
                  3⤵
                  • Executes dropped EXE
                  PID:5028
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A064C15E-F8A3-40B6-AEA6-B91B82B75247}
                  3⤵
                  • Executes dropped EXE
                  PID:3968
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5FD506B4-8E2D-40B4-812D-1D79A799F0C0}
                  3⤵
                  • Executes dropped EXE
                  PID:1252
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A6110DA9-9523-4CDB-825B-9BB52606519E}
                  3⤵
                  • Executes dropped EXE
                  PID:3180
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{626715C0-03A6-4BC0-A0B2-482C89C4F33D}
                  3⤵
                  • Executes dropped EXE
                  PID:3756
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEBABFB9-A2E6-4447-A715-5E6A2E285451}
                  3⤵
                  • Executes dropped EXE
                  PID:448
                • C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe
                  C:\Windows\TEMP\{94BF1C01-11F6-44C6-96F5-6AF5BDAD218A}\_is2A99.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0BDFAA8B-C9CB-439F-A771-FD6D8EB454F8}
                  3⤵
                  • Executes dropped EXE
                  PID:2432
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3132
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:3968
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDF1EF9B-7B6E-4277-9C72-C7BE102BDE6D}
                    3⤵
                    • Executes dropped EXE
                    PID:2992
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{500AE4CF-D3EE-40EC-9247-969101589CD6}
                    3⤵
                    • Executes dropped EXE
                    PID:5028
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA309B16-F8C8-4B44-8228-959C47A92C92}
                    3⤵
                    • Executes dropped EXE
                    PID:2724
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{094E0B6B-0E11-4048-998B-0BB058B673F6}
                    3⤵
                    • Executes dropped EXE
                    PID:2832
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DB8A9888-08EF-4B05-A77E-76CDA4247EF6}
                    3⤵
                    • Executes dropped EXE
                    PID:4692
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2278DFC9-E594-4311-ACFA-65A45C20F1ED}
                    3⤵
                    • Executes dropped EXE
                    PID:3180
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B37B4988-0F53-43A8-96B1-31064DDEC983}
                    3⤵
                    • Executes dropped EXE
                    PID:4436
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32928F9D-FA11-4F8A-8019-58A963EDCCE4}
                    3⤵
                    • Executes dropped EXE
                    PID:2408
                  • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                    C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1C9BCC8-B5CA-472F-9F53-8E7844A485BC}
                    3⤵
                      PID:4456
                    • C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe
                      C:\Windows\TEMP\{2ADF1505-49E2-498E-9035-7F6525C8E431}\_is2E82.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{490DE367-0196-4D26-85FE-0346892D40CB}
                      3⤵
                        PID:1892
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1388
                    • C:\Windows\syswow64\MsiExec.exe
                      C:\Windows\syswow64\MsiExec.exe -Embedding 557CADD1FA08DCF7966838189F824338 E Global\MSI0000
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:5828
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI7695.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240678578 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                        3⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5736
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI7780.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240678796 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                        3⤵
                        • Blocklisted process makes network request
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5224
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI7E19.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680453 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                        3⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5612
                      • C:\Windows\SysWOW64\NET.exe
                        "NET" STOP AteraAgent
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5844
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 STOP AteraAgent
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:3412
                      • C:\Windows\SysWOW64\TaskKill.exe
                        "TaskKill.exe" /f /im AteraAgent.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        PID:5396
                      • C:\Windows\syswow64\NET.exe
                        "NET" STOP AteraAgent
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5848
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 STOP AteraAgent
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5800
                      • C:\Windows\syswow64\TaskKill.exe
                        "TaskKill.exe" /f /im AteraAgent.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        PID:6024
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI9D42.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688437 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                        3⤵
                        • Blocklisted process makes network request
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5744
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                      2⤵
                      • Drops file in System32 directory
                      PID:5796
                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="c3de3f1b-f8b8-44ae-acc3-eeaf292fdb52"
                      2⤵
                      • Modifies data under HKEY_USERS
                      PID:5272
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3272
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                    1⤵
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:1552
                    • C:\Windows\System32\sc.exe
                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                      2⤵
                      • Launches sc.exe
                      PID:4040
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "9d76be9f-3bdc-418f-9acf-9824555d0d30" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      PID:4540
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "ca8d263f-6252-465e-a6ad-4ac6b829d01b" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      PID:2132
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "37467622-3511-4670-97a7-b3e71f8a08b1" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      PID:3596
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "f5f77bd6-0d8f-4700-b2f6-93aee26c0722" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Suspicious use of WriteProcessMemory
                      PID:1604
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3280
                        • C:\Windows\system32\cscript.exe
                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          4⤵
                          • Modifies data under HKEY_USERS
                          PID:3768
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "916b232a-92cc-4c9c-9f32-b0cc1c58a906" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1912
                      • C:\Windows\TEMP\SplashtopStreamer.exe
                        "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1564
                        • C:\Windows\Temp\unpack\PreVerCheck.exe
                          "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2356
                          • C:\Windows\SysWOW64\msiexec.exe
                            msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:1992
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "a1cb2907-8125-4983-95fa-ece8d85f34ec" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4944
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                    1⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2736
                    • C:\Windows\System32\sc.exe
                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                      2⤵
                      • Launches sc.exe
                      PID:2556
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "9644c627-0c97-4f9c-b6fc-001006e183b5" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      PID:640
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                        • Modifies data under HKEY_USERS
                        PID:5660
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "48672bee-9c78-4f92-8d6f-e2adfcad4ab6" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                      2⤵
                      • Modifies data under HKEY_USERS
                      PID:3068
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        3⤵
                          PID:3812
                          • C:\Windows\system32\cscript.exe
                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            4⤵
                            • Modifies data under HKEY_USERS
                            PID:5424
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "ace8705e-ce89-40bf-9548-4caeae2db0f5" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                        2⤵
                        • Drops file in System32 directory
                        PID:1552
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "3792c1a0-99d8-416a-98b2-fa7e9ae7fa21" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5300
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "bab427d1-8c89-4938-aa41-c5fbce84593b" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        PID:5416
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "2e7cb490-7689-4405-bea3-47573a854a42" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                        2⤵
                          PID:5504
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "88f13230-df83-42d2-ab36-0e32bfa7b001" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                          2⤵
                          • Drops file in System32 directory
                          PID:5620
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "59f010f5-459e-4d8a-9c12-457b662b723a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                          2⤵
                            PID:5728
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "55b31774-6e28-48f4-9d77-6e2276e6a7cd" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                            2⤵
                            • Modifies registry class
                            PID:5128
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "4992e6ef-c5de-4fa6-a8e6-bd15f3cf087e" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:5652
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=e7ee725d0f745432f10151752f403761&rmm_session_pwd_ttl=86400"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5256
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "b8140f1d-3efb-4a2c-8bd1-961c79f15702" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            PID:5928
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "738d8d6d-5f2e-4c80-bd3f-09fcfd616af0" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            PID:2968
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "b7d899d5-dc17-44fe-b037-a29c5c59beb5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            PID:4132
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:6132
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:5236
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3160
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:436
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:3844
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4684
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:4016
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:1608
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:448
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2644
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious use of SetWindowsHookEx
                                PID:5532
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:5296
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:5932
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:2856
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:2656
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        • Checks SCSI registry key(s)
                                        • Modifies data under HKEY_USERS
                                        PID:5572
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:5748
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:5912
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "4d2d8f9d-e735-4b3f-bfd7-1601da0916d6" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                  2⤵
                                    PID:2404
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "23f41696-4b1f-4f87-b2f2-090e50ca7f69" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                                    2⤵
                                      PID:4456
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "427ea56f-1223-47a8-863b-624a21325dc4" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                                      2⤵
                                        PID:6016
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "2ebe368d-3752-4892-a5b8-4500cc251c7e" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                                        2⤵
                                          PID:3264
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "5b09728d-22d1-4868-8632-1492ebbe3aec" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                                          2⤵
                                          • Modifies data under HKEY_USERS
                                          PID:5512
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                            3⤵
                                              PID:5372
                                              • C:\Windows\system32\cscript.exe
                                                cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                4⤵
                                                • Modifies data under HKEY_USERS
                                                PID:3068
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "f7f1aebb-b1b6-4845-95f2-aa48ccad179e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                                            2⤵
                                              PID:4804
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "38813873-f489-4381-9203-18031baa9db9" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                                              2⤵
                                                PID:4988
                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=e7ee725d0f745432f10151752f403761&rmm_session_pwd_ttl=86400"
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5272
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "4eba874b-5116-4ab9-ba5a-1ef2803ce59a" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                                                2⤵
                                                • Drops file in Program Files directory
                                                PID:4260
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "607a8b5d-5278-4297-ac74-30cc1fcea13d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                                                2⤵
                                                  PID:2544
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                    3⤵
                                                    • System Time Discovery
                                                    PID:1044
                                                    • C:\Program Files\dotnet\dotnet.exe
                                                      dotnet --list-runtimes
                                                      4⤵
                                                      • System Time Discovery
                                                      PID:3080
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "49f794b5-54af-4f59-9fab-8452316cca31" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                                                  2⤵
                                                  • Writes to the Master Boot Record (MBR)
                                                  PID:5140
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "db2a0909-91ba-47eb-949b-e3db464c10b6" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                                                  2⤵
                                                    PID:3552
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "105e1a9c-3636-4efb-8d1e-32a93c19d55c" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:6056
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "87e68c6d-929c-4d41-a8ff-f6be03572bc7" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                                                    2⤵
                                                      PID:5628
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360" "87e68c6d-929c-4d41-a8ff-f6be03572bc7" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000M0aRpIAJ"
                                                        3⤵
                                                          PID:5124
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "c369f836-e995-4938-960d-4138b0be91d3" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        PID:5828
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" beba3f2b-bcfd-484c-a1d6-5f9fdd1f9360 "4d2d8f9d-e735-4b3f-bfd7-1601da0916d6" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:5816
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                      1⤵
                                                      • Drops file in Windows directory
                                                      • Checks SCSI registry key(s)
                                                      PID:3980
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:5664
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:3280
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000158"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:3848
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:5192

                                                    Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Persistence

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Privilege Escalation

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Defense Evasion

                                                          Modify Registry

                                                          1
                                                          T1112

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Subvert Trust Controls

                                                          1
                                                          T1553

                                                          Install Root Certificate

                                                          1
                                                          T1553.004

                                                          System Binary Proxy Execution

                                                          1
                                                          T1218

                                                          Msiexec

                                                          1
                                                          T1218.007

                                                          Credential Access

                                                          Discovery

                                                          Network Service Discovery

                                                          1
                                                          T1046

                                                          Peripheral Device Discovery

                                                          2
                                                          T1120

                                                          Query Registry

                                                          4
                                                          T1012

                                                          System Information Discovery

                                                          3
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          System Time Discovery

                                                          1
                                                          T1124

                                                          Lateral Movement

                                                          Collection

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          e57b586.rbs
                                                          • Path C:\Config.Msi\e57b586.rbs
                                                          • Size 8KB
                                                          • SHA256 03e5783b40ef494192fd88ee91517287547aa0a7fd0dfa206b8511cb6776f58e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          e57b58b.rbs
                                                          • Path C:\Config.Msi\e57b58b.rbs
                                                          • Size 74KB
                                                          • SHA256 747b3bbafba6cd5fd9d080e718ca84534c487efc292dadef69ffd0c3e9ad88c7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          e57b58d.rbs
                                                          • Path C:\Config.Msi\e57b58d.rbs
                                                          • Size 464B
                                                          • SHA256 6f1d7a54c2f3beabbd5125efca8f30a251c01d368c114363fef7e4c0f601a50c
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          e57b593.rbs
                                                          • Path C:\Config.Msi\e57b593.rbs
                                                          • Size 9KB
                                                          • SHA256 ce035170168b5c7751b5f3df07c2e5a50d81ac406de018b408547d6c88d0d37d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          e57b59b.rbs
                                                          • Path C:\Config.Msi\e57b59b.rbs
                                                          • Size 8KB
                                                          • SHA256 eae3c9b019253fb143b77645919256078ecf8cb69972f74cd4785feb638b11b5
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AteraAgent.InstallLog
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                          • Size 1KB
                                                          • SHA256 ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          AteraAgent.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                          • Size 142KB
                                                          • SHA256 a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AteraAgent.exe.config
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                          • Size 1KB
                                                          • SHA256 e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          ICSharpCode.SharpZipLib.dll
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                          • Size 210KB
                                                          • SHA256 2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Newtonsoft.Json.dll
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                          • Size 693KB
                                                          • SHA256 2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Agent.Package.Watchdog.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                          • Size 157KB
                                                          • SHA256 7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageADRemote.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                          • Size 51KB
                                                          • SHA256 5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageAgentInformation.INI
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                          • Size 12B
                                                          • SHA256 3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          AgentPackageAgentInformation.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                          • Size 173KB
                                                          • SHA256 36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageAgentInformation.exe.config
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                          • Size 546B
                                                          • SHA256 5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Atera.AgentPackage.Common.dll
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                          • Size 94KB
                                                          • SHA256 c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Newtonsoft.Json.dll
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                          • Size 688KB
                                                          • SHA256 12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageHeartbeat.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                          • Size 27KB
                                                          • SHA256 7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageInternalPoller.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                          • Size 214KB
                                                          • SHA256 9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageMarketplace.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                          • Size 37KB
                                                          • SHA256 30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageMonitoring.zip
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                          • Size 3.4MB
                                                          • SHA256 98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageMonitoring.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                          • Size 389KB
                                                          • SHA256 01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageOsUpdates.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                          • Size 196KB
                                                          • SHA256 0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageProgramManagement.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                          • Size 55KB
                                                          • SHA256 44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          chocolatey.config
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                          • Size 9KB
                                                          • SHA256 11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          chocolatey.config.5416.update
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5416.update
                                                          • Size 9KB
                                                          • SHA256 6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          chocolatey.log
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                          • Size 8KB
                                                          • SHA256 eb2fe413504837ccd0fd145931e005b26e62d60d2f65c039785a5d91f8652040
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          cpush.exe.ignore
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                          • Size 2B
                                                          • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          AgentPackageRuntimeInstaller.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                          • Size 54KB
                                                          • SHA256 2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageSTRemote.zip
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                          • Size 334KB
                                                          • SHA256 adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageSTRemote.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                          • Size 72KB
                                                          • SHA256 c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageSystemTools.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                          • Size 50KB
                                                          • SHA256 6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageTicketing.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                          • Size 32KB
                                                          • SHA256 30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageUpgradeAgent.exe
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                          • Size 54KB
                                                          • SHA256 11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Pubnub.dll
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                          • Size 588KB
                                                          • SHA256 13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          log.txt
                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                          • Size 217B
                                                          • SHA256 a9b35f88f95a598cb4e07781bf987717291b764a9dac556db5609e2b7d4563b6
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          DIFxCmd.exe
                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                          • Size 9KB
                                                          • SHA256 0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          DIFxCmd64.exe
                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                          • Size 10KB
                                                          • SHA256 a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          devcon.exe
                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                          • Size 76KB
                                                          • SHA256 800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          devcon64.exe
                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                          • Size 80KB
                                                          • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          SRAgent.sqlite3
                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                          • Size 92KB
                                                          • SHA256 59f7fd327df056c8e5397995d90901a13ddab07be545065c80beec53ec5f74b6
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AteraAgent.InstallState
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                          • Size 7KB
                                                          • SHA256 1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Agent.Package.Watchdog.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                          • Size 1.9MB
                                                          • SHA256 2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageADRemote.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                          • Size 1.1MB
                                                          • SHA256 88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageAgentInformation.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                          • Size 375KB
                                                          • SHA256 29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageHeartbeat.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                          • Size 321KB
                                                          • SHA256 dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageInternalPoller.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                          • Size 814KB
                                                          • SHA256 09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageMarketplace.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                          • Size 1.2MB
                                                          • SHA256 a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageMarketplace.ini
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                          • Size 11B
                                                          • SHA256 12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          package_2.db
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                          • Size 48KB
                                                          • SHA256 1f67853ce76612d9780c1601ce50274e3a6c467d9951606c7e29d47dd8c750f9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          package_2.db
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                          • Size 48KB
                                                          • SHA256 acf71a5ef2f88bf0d3e75b1b2d8ee4ce0235d0e2b371b909f355cc97feb39c9e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageOsUpdates.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                          • Size 2.8MB
                                                          • SHA256 5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageProgramManagement.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                          • Size 2.9MB
                                                          • SHA256 0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageRuntimeInstaller.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                          • Size 1.1MB
                                                          • SHA256 e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageSTRemote.exe.config
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                          • Size 541B
                                                          • SHA256 7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          AgentPackageSTRemote.ini
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                          • Size 12B
                                                          • SHA256 73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          AgentPackageSystemTools.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                          • Size 646KB
                                                          • SHA256 ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageTicketing.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                          • Size 3.1MB
                                                          • SHA256 d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AgentPackageUpgradeAgent.zip
                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                          • Size 569KB
                                                          • SHA256 dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          0049385344e26b35073809038a152516
                                                          • Path C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\0049385344e26b35073809038a152516
                                                          • Size 16KB
                                                          • SHA256 5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          chocolatey.config
                                                          • Path C:\ProgramData\chocolatey\config\chocolatey.config
                                                          • Size 809B
                                                          • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          chocolatey.log
                                                          • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                                                          • Size 7KB
                                                          • SHA256 5a458b19050ca183984efccc8af51ff62d91ef322737c253b016c8c8f95e8c9d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                          • Size 471B
                                                          • SHA256 251eb310eb807b47bd4093a3170aea35c155fa78e500baa6ca4e2cdeaf0166ff
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          • Size 727B
                                                          • SHA256 69354ff510301b85c14cc1ecd0e5b3c98308b820cfbce483389a7b9a437f67d5
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          • Size 727B
                                                          • SHA256 20d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                          • Size 400B
                                                          • SHA256 d77d8c3361e311011ded20faeb1fcc4f3c75a91e3603867a82658fa6efb3c0fb
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          • Size 404B
                                                          • SHA256 beb7ca1b832f38738da9211ddec8870694c16d334c7b49bd595d6f9ad745321c
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          • Size 412B
                                                          • SHA256 2c0531cd2f3202f57bf4b89889f67b059a82b7af68799bf3d299af16d424e7bf
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          rundll32.exe.log
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                          • Size 651B
                                                          • SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          MSI1660.tmp
                                                          • Path C:\Windows\Installer\MSI1660.tmp
                                                          • Size 4.5MB
                                                          • SHA256 e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          System.Management.dll
                                                          • Path C:\Windows\Installer\MSI7695.tmp-\System.Management.dll
                                                          • Size 60KB
                                                          • SHA256 24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MSIB621.tmp
                                                          • Path C:\Windows\Installer\MSIB621.tmp
                                                          • Size 509KB
                                                          • SHA256 87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          AlphaControlAgentInstallation.dll
                                                          • Path C:\Windows\Installer\MSIB621.tmp-\AlphaControlAgentInstallation.dll
                                                          • Size 25KB
                                                          • SHA256 e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          Microsoft.Deployment.WindowsInstaller.dll
                                                          • Path C:\Windows\Installer\MSIB621.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                          • Size 179KB
                                                          • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          CustomAction.config
                                                          • Path C:\Windows\Installer\MSIB8D1.tmp-\CustomAction.config
                                                          • Size 1KB
                                                          • SHA256 e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Newtonsoft.Json.dll
                                                          • Path C:\Windows\Installer\MSIB8D1.tmp-\Newtonsoft.Json.dll
                                                          • Size 695KB
                                                          • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          MSIBE53.tmp
                                                          • Path C:\Windows\Installer\MSIBE53.tmp
                                                          • Size 211KB
                                                          • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          e57b585.msi
                                                          • Path C:\Windows\Installer\e57b585.msi
                                                          • Size 2.9MB
                                                          • SHA256 160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_iddcx.cat
                                                          • Path C:\Windows\System32\DriverStore\Temp\{7d565373-3c04-c041-9c33-a93216ce5b62}\lci_iddcx.cat
                                                          • Size 10KB
                                                          • SHA256 85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_iddcx.inf
                                                          • Path C:\Windows\System32\DriverStore\Temp\{7d565373-3c04-c041-9c33-a93216ce5b62}\lci_iddcx.inf
                                                          • Size 4KB
                                                          • SHA256 60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_iddcx.dll
                                                          • Path C:\Windows\System32\DriverStore\Temp\{7d565373-3c04-c041-9c33-a93216ce5b62}\x64\lci_iddcx.dll
                                                          • Size 52KB
                                                          • SHA256 148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_proxywddm.cat
                                                          • Path C:\Windows\System32\DriverStore\Temp\{a29f0214-4ccf-0048-a19b-3ade9a32c0a2}\lci_proxywddm.cat
                                                          • Size 12KB
                                                          • SHA256 7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_proxywddm.inf
                                                          • Path C:\Windows\System32\DriverStore\Temp\{a29f0214-4ccf-0048-a19b-3ade9a32c0a2}\lci_proxywddm.inf
                                                          • Size 2KB
                                                          • SHA256 d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          lci_proxyumd.dll
                                                          • Path C:\Windows\System32\DriverStore\Temp\{a29f0214-4ccf-0048-a19b-3ade9a32c0a2}\x64\lci_proxyumd.dll
                                                          • Size 179KB
                                                          • SHA256 e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_proxyumd32.dll
                                                          • Path C:\Windows\System32\DriverStore\Temp\{a29f0214-4ccf-0048-a19b-3ade9a32c0a2}\x64\lci_proxyumd32.dll
                                                          • Size 135KB
                                                          • SHA256 79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lci_proxywddm.sys
                                                          • Path C:\Windows\System32\DriverStore\Temp\{a29f0214-4ccf-0048-a19b-3ade9a32c0a2}\x64\lci_proxywddm.sys
                                                          • Size 119KB
                                                          • SHA256 0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          B7C5EA94-B96A-41F5-BE95-25D78B486678-02-13-01.dat
                                                          • Path C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-02-13-01.dat
                                                          • Size 602B
                                                          • SHA256 2e43f0dc4ee33fb5d46a820b9534f471a90f3b5beb5161675ea326c00684dcaa
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          InstallUtil.log
                                                          • Path C:\Windows\Temp\InstallUtil.log
                                                          • Size 4KB
                                                          • SHA256 3a7df7649f77394b1ca9cb1d24619c7609c9398d04e58eb17f919dec6cb74317
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          InstallUtil.log
                                                          • Path C:\Windows\Temp\InstallUtil.log
                                                          • Size 708B
                                                          • SHA256 156b3e5766892751457c446208f4d174a770e3709d4aa5162ac0a61f40ec9598
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          InstallUtil.log
                                                          • Path C:\Windows\Temp\InstallUtil.log
                                                          • Size 1KB
                                                          • SHA256 2a44eb7877905b132e9958cb32b75b02c95fc719376ffa5a08109a5d11285b74
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          PreVer.log
                                                          • Path C:\Windows\Temp\PreVer.log
                                                          • Size 2KB
                                                          • SHA256 c724387c121cf835f951539b57bb959718e26e83691d717c3eb22c5098fe1c96
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          unpack.log
                                                          • Path C:\Windows\Temp\unpack.log
                                                          • Size 2KB
                                                          • SHA256 2f32ee8706367502e637d77cebfaa07753f9ad3160da4a8ece94e0803a2893f0
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          unpack.log
                                                          • Path C:\Windows\Temp\unpack.log
                                                          • Size 4KB
                                                          • SHA256 cb697d8129eaac735b04cfd03c596d28a0e531c501e7015c0a40afc0c3464641
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          PreVerCheck.exe
                                                          • Path C:\Windows\Temp\unpack\PreVerCheck.exe
                                                          • Size 3.2MB
                                                          • SHA256 7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          IsConfig.ini
                                                          • Path C:\Windows\Temp\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\IsConfig.ini
                                                          • Size 571B
                                                          • SHA256 ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          String1033.txt
                                                          • Path C:\Windows\Temp\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\String1033.txt
                                                          • Size 182KB
                                                          • SHA256 6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          _is868.exe
                                                          • Path C:\Windows\Temp\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\_is868.exe
                                                          • Size 179KB
                                                          • SHA256 e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          setup.inx
                                                          • Path C:\Windows\Temp\{10DEDAA4-1324-4432-94AD-8D34313AB5B3}\setup.inx
                                                          • Size 345KB
                                                          • SHA256 c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          ISRT.dll
                                                          • Path C:\Windows\Temp\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\ISRT.dll
                                                          • Size 427KB
                                                          • SHA256 70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          _isres_0x0409.dll
                                                          • Path C:\Windows\Temp\{81714416-D613-4A74-ADCD-D5ADFB9E53F7}\_isres_0x0409.dll
                                                          • Size 1.8MB
                                                          • SHA256 9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          • Size 404B
                                                          • SHA256 c61a956053d94c5bdace8a666ad9fdcba02dad715ddb65bf5f35ffd4dae34a77
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          • Size 412B
                                                          • SHA256 25065d344932ec28ba39a19bc6cfda8bebe94b267e967d16026976bf1507e51d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          memory/436-1216-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/436-1215-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/436-2244-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/436-2047-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/436-2245-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/436-2046-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/436-2238-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/436-2239-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/436-1137-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/436-1138-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/464-110-0x0000000005550000-0x00000000055B6000-memory.dmp
                                                          Download

                                                          memory/640-1343-0x0000016993640000-0x0000016993652000-memory.dmp
                                                          Download

                                                          memory/640-1356-0x0000016993E90000-0x0000016993EAC000-memory.dmp
                                                          Download

                                                          memory/640-1387-0x00000169AC850000-0x00000169AC902000-memory.dmp
                                                          Download

                                                          memory/640-1598-0x00000169AC790000-0x00000169AC7E4000-memory.dmp
                                                          Download

                                                          memory/1276-39-0x0000000003160000-0x000000000318E000-memory.dmp
                                                          Download

                                                          memory/1276-43-0x00000000054F0000-0x00000000054FC000-memory.dmp
                                                          Download

                                                          memory/1552-202-0x000001B07A550000-0x000001B07A572000-memory.dmp
                                                          Download

                                                          memory/1552-1600-0x000001727D310000-0x000001727D372000-memory.dmp
                                                          Download

                                                          memory/1552-1392-0x0000017263F40000-0x0000017263F74000-memory.dmp
                                                          Download

                                                          memory/1552-1396-0x00000172647B0000-0x00000172647BA000-memory.dmp
                                                          Download

                                                          memory/1552-241-0x000001B07AB80000-0x000001B07ABB8000-memory.dmp
                                                          Download

                                                          memory/1552-192-0x000001B07A5A0000-0x000001B07A652000-memory.dmp
                                                          Download

                                                          memory/1552-1394-0x00000172647C0000-0x00000172647DC000-memory.dmp
                                                          Download

                                                          memory/1552-1395-0x0000017264840000-0x0000017264858000-memory.dmp
                                                          Download

                                                          memory/1552-1603-0x000001727D270000-0x000001727D28C000-memory.dmp
                                                          Download

                                                          memory/1552-1515-0x0000017264A20000-0x0000017264A6A000-memory.dmp
                                                          Download

                                                          memory/1552-1578-0x000001727D3D0000-0x000001727D482000-memory.dmp
                                                          Download

                                                          memory/1552-1393-0x00000172647F0000-0x000001726483A000-memory.dmp
                                                          Download

                                                          memory/1552-1590-0x000001727D570000-0x000001727D64C000-memory.dmp
                                                          Download

                                                          memory/1876-148-0x000001AFDDF50000-0x000001AFDDF78000-memory.dmp
                                                          Download

                                                          memory/1876-160-0x000001AFF8530000-0x000001AFF85C8000-memory.dmp
                                                          Download

                                                          memory/1876-164-0x000001AFDFC30000-0x000001AFDFC42000-memory.dmp
                                                          Download

                                                          memory/1876-165-0x000001AFF8490000-0x000001AFF84CC000-memory.dmp
                                                          Download

                                                          memory/1912-302-0x0000019A6AC80000-0x0000019A6AC9C000-memory.dmp
                                                          Download

                                                          memory/1912-300-0x0000019A6A410000-0x0000019A6A426000-memory.dmp
                                                          Download

                                                          memory/1912-301-0x0000019A6B560000-0x0000019A6B612000-memory.dmp
                                                          Download

                                                          memory/1968-480-0x00000000037A0000-0x0000000003967000-memory.dmp
                                                          Download

                                                          memory/1968-477-0x0000000010000000-0x0000000010114000-memory.dmp
                                                          Download

                                                          memory/1968-1047-0x0000000010000000-0x0000000010114000-memory.dmp
                                                          Download

                                                          memory/1968-1084-0x0000000010000000-0x0000000010114000-memory.dmp
                                                          Download

                                                          memory/1968-907-0x00000000037E0000-0x00000000039A7000-memory.dmp
                                                          Download

                                                          memory/1968-991-0x0000000010000000-0x0000000010114000-memory.dmp
                                                          Download

                                                          memory/1968-904-0x0000000010000000-0x0000000010114000-memory.dmp
                                                          Download

                                                          memory/1968-516-0x0000000010000000-0x0000000010114000-memory.dmp
                                                          Download

                                                          memory/3844-1185-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/3844-1186-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/3844-2241-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/3844-2240-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/3844-1760-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/3844-3215-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/3844-3214-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/3844-1761-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/4232-76-0x0000000004B90000-0x0000000004C42000-memory.dmp
                                                          Download

                                                          memory/4232-79-0x0000000004AD0000-0x0000000004AF2000-memory.dmp
                                                          Download

                                                          memory/4232-80-0x0000000004C50000-0x0000000004FA4000-memory.dmp
                                                          Download

                                                          memory/4540-275-0x00000196E1D30000-0x00000196E1DE0000-memory.dmp
                                                          Download

                                                          memory/4540-277-0x00000196E1C80000-0x00000196E1C9C000-memory.dmp
                                                          Download

                                                          memory/4540-272-0x00000196C8C10000-0x00000196C8C40000-memory.dmp
                                                          Download

                                                          memory/4684-1533-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/4684-1526-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/4684-1150-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/4684-1918-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/4684-1151-0x0000000072450000-0x000000007281D000-memory.dmp
                                                          Download

                                                          memory/4684-1917-0x0000000072820000-0x000000007293C000-memory.dmp
                                                          Download

                                                          memory/4944-358-0x000001EA4B4C0000-0x000001EA4B4CA000-memory.dmp
                                                          Download

                                                          memory/4944-348-0x000001EA4B4A0000-0x000001EA4B4BC000-memory.dmp
                                                          Download

                                                          memory/4944-345-0x000001EA4AF90000-0x000001EA4AFF4000-memory.dmp
                                                          Download

                                                          memory/4944-346-0x000001EA640D0000-0x000001EA6411A000-memory.dmp
                                                          Download

                                                          memory/4944-349-0x000001EA64170000-0x000001EA641BC000-memory.dmp
                                                          Download

                                                          memory/4944-357-0x000001EA4B490000-0x000001EA4B498000-memory.dmp
                                                          Download

                                                          memory/4944-356-0x000001EA641C0000-0x000001EA64208000-memory.dmp
                                                          Download

                                                          memory/4944-359-0x000001EA644C0000-0x000001EA6459C000-memory.dmp
                                                          Download

                                                          memory/4944-415-0x000001EA64210000-0x000001EA64236000-memory.dmp
                                                          Download

                                                          memory/4944-414-0x000001EA64650000-0x000001EA6468A000-memory.dmp
                                                          Download

                                                          memory/4944-410-0x000001EA64240000-0x000001EA6426A000-memory.dmp
                                                          Download

                                                          memory/4944-409-0x000001EA645A0000-0x000001EA64608000-memory.dmp
                                                          Download

                                                          memory/4944-408-0x000001EA4B9F0000-0x000001EA4B9F8000-memory.dmp
                                                          Download

                                                          memory/4944-382-0x000001EA643E0000-0x000001EA64492000-memory.dmp
                                                          Download

                                                          memory/4944-383-0x000001EA4B520000-0x000001EA4B528000-memory.dmp
                                                          Download

                                                          memory/4944-384-0x000001EA4B9E0000-0x000001EA4B9E8000-memory.dmp
                                                          Download

                                                          memory/5128-1795-0x000001B44AF50000-0x000001B44AF70000-memory.dmp
                                                          Download

                                                          memory/5128-1738-0x000001B44A5C0000-0x000001B44A5CC000-memory.dmp
                                                          Download

                                                          memory/5128-1758-0x000001B44AF30000-0x000001B44AF48000-memory.dmp
                                                          Download

                                                          memory/5128-1765-0x000001B463730000-0x000001B4637E2000-memory.dmp
                                                          Download

                                                          memory/5300-1601-0x00000244F83D0000-0x00000244F8418000-memory.dmp
                                                          Download

                                                          memory/5300-1586-0x00000244F7790000-0x00000244F7842000-memory.dmp
                                                          Download

                                                          memory/5300-1550-0x00000244DE5F0000-0x00000244DE62A000-memory.dmp
                                                          Download

                                                          memory/5300-1593-0x00000244F76F0000-0x00000244F770C000-memory.dmp
                                                          Download

                                                          memory/5416-1577-0x000001C057300000-0x000001C0573B2000-memory.dmp
                                                          Download

                                                          memory/5416-1575-0x000001C03E630000-0x000001C03E640000-memory.dmp
                                                          Download

                                                          memory/5416-1722-0x000001C0580E0000-0x000001C058156000-memory.dmp
                                                          Download

                                                          memory/5416-1736-0x000001C057240000-0x000001C05725E000-memory.dmp
                                                          Download

                                                          memory/5416-1605-0x000001C057F40000-0x000001C057F86000-memory.dmp
                                                          Download

                                                          memory/5416-1604-0x000001C058600000-0x000001C058C5C000-memory.dmp
                                                          Download

                                                          memory/5416-1711-0x000001C058010000-0x000001C058060000-memory.dmp
                                                          Download

                                                          memory/5416-1574-0x000001C03E190000-0x000001C03E1A0000-memory.dmp
                                                          Download

                                                          memory/5416-1581-0x000001C03E660000-0x000001C03E680000-memory.dmp
                                                          Download

                                                          memory/5504-1580-0x00000179773B0000-0x00000179773D0000-memory.dmp
                                                          Download

                                                          memory/5504-1587-0x00000179786F0000-0x0000017978756000-memory.dmp
                                                          Download

                                                          memory/5504-1582-0x0000017977BB0000-0x0000017977C62000-memory.dmp
                                                          Download

                                                          memory/5504-1576-0x0000017976A30000-0x0000017976A40000-memory.dmp
                                                          Download

                                                          memory/5504-1592-0x00000179773D0000-0x00000179773E4000-memory.dmp
                                                          Download

                                                          memory/5620-1602-0x000001E79F1D0000-0x000001E79F2AC000-memory.dmp
                                                          Download

                                                          memory/5620-1583-0x000001E79EF10000-0x000001E79EF5A000-memory.dmp
                                                          Download

                                                          memory/5620-1591-0x000001E7867D0000-0x000001E7867EC000-memory.dmp
                                                          Download

                                                          memory/5620-1579-0x000001E785E80000-0x000001E785E90000-memory.dmp
                                                          Download

                                                          memory/5620-1609-0x000001E79F2B0000-0x000001E79F362000-memory.dmp
                                                          Download

                                                          memory/5620-1660-0x000001E7867F0000-0x000001E7867F8000-memory.dmp
                                                          Download

                                                          memory/5928-1798-0x0000020EA6560000-0x0000020EA656A000-memory.dmp
                                                          Download

                                                          memory/5928-1824-0x0000020EA6EC0000-0x0000020EA6EDA000-memory.dmp
                                                          Download