Overview

overview

10

Static

static

10

b42fa58e23...df.msi

windows7-x64

10

b42fa58e23...df.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 12:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b42fa58e23432c66acf7d1ba65f2c938dac7bbcd0dbebeac7c52951555d07cdf.msi
  • Size 2.9MB
  • Sample241108-pnbgtssdkh
  • SHA256 b42fa58e23432c66acf7d1ba65f2c938dac7bbcd0dbebeac7c52951555d07cdf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b42fa58e23432c66acf7d1ba65f2c938dac7bbcd0dbebeac7c52951555d07cdf.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4644
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4408
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 39109CE61717D66FF338DC84238B4B10
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB12F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628265 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2224
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB3FF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628750 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4456
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB884.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629890 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4168
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC3A5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632781 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1200
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 480686048C71BBB61410F528BAD63400 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4632
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4940
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="297" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="0013z00002RLqCLAA1" /AgentId="830d21bf-52f4-4ce7-a581-dcc7ad1e27f0"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:2828
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3593F73AF82FD3DA44F1BD49FAF93FC1 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{168A8811-6E8C-4E1F-9F2C-9D76B9E072B9}
          3⤵
          • Executes dropped EXE
          PID:4000
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2334420-B03B-45D1-AEB4-73D486B251DA}
          3⤵
          • Executes dropped EXE
          PID:3932
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6167F7CA-E5E5-4146-883E-2597F847BB34}
          3⤵
          • Executes dropped EXE
          PID:2176
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C9C895D-75C7-4095-9211-AF695BBE8D73}
          3⤵
          • Executes dropped EXE
          PID:2068
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46909E20-DA09-44B8-8A32-29C30852E857}
          3⤵
          • Executes dropped EXE
          PID:4168
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F14FDE1F-40B3-40AC-8FBF-8CA59FADCDEF}
          3⤵
          • Executes dropped EXE
          PID:3432
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8900B626-41E1-4040-A9B7-1808133D4A5D}
          3⤵
          • Executes dropped EXE
          PID:3932
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00B0C397-BE89-4EDA-94CE-5C16C15273C2}
          3⤵
          • Executes dropped EXE
          PID:4408
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C028FB3A-4275-414C-87BA-73EE1E19C2D8}
          3⤵
          • Executes dropped EXE
          PID:4112
        • C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe
          C:\Windows\TEMP\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isF906.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A07CDF60-2A32-4577-BD18-6EE6A30E7496}
          3⤵
          • Executes dropped EXE
          PID:1176
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4636
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1028
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1200
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4416
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2180
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4380
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2068
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2192
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5048
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3168
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4168
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4380
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3168
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4416
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4476
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1176
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:876
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2828
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DD52F0D-F0C7-41ED-9167-CB85172A3E97}
          3⤵
          • Executes dropped EXE
          PID:1148
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1D0895B3-ED09-4978-A4CF-D44961397ADB}
          3⤵
          • Executes dropped EXE
          PID:2444
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{010D102B-C5C8-42F8-812B-1E90677AFBC4}
          3⤵
          • Executes dropped EXE
          PID:748
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{62D72C17-01CE-45A4-B633-F776B8411F76}
          3⤵
          • Executes dropped EXE
          PID:4000
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{516316B9-6AB2-4051-8EA8-072665D64BF1}
          3⤵
          • Executes dropped EXE
          PID:3340
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A13475F-1FC5-4E06-86EA-B78C05D67EEA}
          3⤵
          • Executes dropped EXE
          PID:3784
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{69E16327-6B7B-4105-BD91-4809A3ACFB69}
          3⤵
          • Executes dropped EXE
          PID:2968
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A44EEA68-3C6B-4670-B2A0-964B1E4EC827}
          3⤵
          • Executes dropped EXE
          PID:3892
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DAFAB92F-FBC8-4205-A645-007BB11FD6D9}
          3⤵
          • Executes dropped EXE
          PID:3476
        • C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
          C:\Windows\TEMP\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58886269-4BEA-4F99-91FF-E8B66A952FD3}
          3⤵
          • Executes dropped EXE
          PID:2840
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{98580CAF-21D5-43D5-9E52-C439115C67D3}
          3⤵
          • Executes dropped EXE
          PID:5204
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{67D5B463-A157-4F44-817E-04B92A5D8923}
          3⤵
          • Executes dropped EXE
          PID:5244
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2DC16D3B-572B-4723-B68A-F0C8EBC343AA}
          3⤵
          • Executes dropped EXE
          PID:5276
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F90A8D98-D59C-4BFD-A1A8-81FEA5D02235}
          3⤵
          • Executes dropped EXE
          PID:5308
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00C4C0BC-9E45-450E-85D9-A2519244A217}
          3⤵
          • Executes dropped EXE
          PID:5340
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5BC175A4-36F4-4E3A-994E-53B7771AF6F2}
          3⤵
          • Executes dropped EXE
          PID:5416
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A957F286-24D0-41AE-9B30-9D862F1EAE7F}
          3⤵
          • Executes dropped EXE
          PID:5448
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2118333A-6D93-418F-8184-1207438FAC64}
          3⤵
          • Executes dropped EXE
          PID:5480
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AE835E1D-51F2-4D77-8104-5E01376B7B08}
          3⤵
          • Executes dropped EXE
          PID:5512
        • C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe
          C:\Windows\TEMP\{049C33FB-28E7-4EF9-B239-E64D8AA00D6B}\_is125C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A473004-E39A-4153-91CE-1EB200E87975}
          3⤵
          • Executes dropped EXE
          PID:5544
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5700
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5772
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5916
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:5968
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:6108
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2444
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F49393CA-FB0E-407F-92EA-F3AACBB72FA9}
              3⤵
              • Executes dropped EXE
              PID:2728
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7BA64203-C30F-440D-8A28-B699396CB832}
              3⤵
              • Executes dropped EXE
              PID:5204
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3234FA5A-63AD-4761-997E-373CE2FCFD79}
              3⤵
              • Executes dropped EXE
              PID:5296
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{22C8561F-9FFC-4408-B232-1B2C6C8E8878}
              3⤵
              • Executes dropped EXE
              PID:5316
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BFBEB20C-CE57-4303-ABA0-C398FA9985C9}
              3⤵
              • Executes dropped EXE
              PID:5372
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3F303965-6BAE-4390-B7F0-88A55D96C941}
              3⤵
              • Executes dropped EXE
              PID:5464
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16BFA83F-5F1D-4837-8384-C5610A458BE2}
              3⤵
              • Executes dropped EXE
              PID:5496
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6263ECE9-34B1-4058-971A-CA15AF914BFA}
              3⤵
              • Executes dropped EXE
              PID:5516
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59B18082-A288-4D06-B17A-F9F7C23AB8B2}
              3⤵
              • Executes dropped EXE
              PID:5548
            • C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe
              C:\Windows\TEMP\{7D99B03D-12A0-4834-B60C-3978ADD5F183}\_is2682.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2431BC3B-F11F-4BF7-A34E-268B4B5BD022}
              3⤵
              • Executes dropped EXE
              PID:5588
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5640
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E566023B-2FE3-47F0-BAA1-972153209CF2}
              3⤵
              • Executes dropped EXE
              PID:5808
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41FAF2BD-4454-493F-A1A7-B7A8012AFB8F}
              3⤵
              • Executes dropped EXE
              PID:5844
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{79372E29-DB18-424C-A81E-89F39CC8E35E}
              3⤵
              • Executes dropped EXE
              PID:5876
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{476720B8-5FBF-4701-AFBA-DFC82ABADB86}
              3⤵
              • Executes dropped EXE
              PID:5908
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6880AA86-F3DB-420E-A02C-711F4BCE3326}
              3⤵
              • Executes dropped EXE
              PID:5996
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BBA20BE4-8319-4728-94A4-1414060944C5}
              3⤵
              • Executes dropped EXE
              PID:2888
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1EA4454C-9022-4FBB-BD1B-C7205833F94F}
              3⤵
              • Executes dropped EXE
              PID:6084
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF74DE85-1D86-46CA-9D29-582064DC98F1}
              3⤵
              • Executes dropped EXE
              PID:4356
            • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
              C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1915863C-0900-43DB-A883-24737839FD9C}
              3⤵
                PID:6132
              • C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe
                C:\Windows\TEMP\{711DA4C5-53C7-49AF-9617-8B1539354661}\_is29CF.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{06187B9C-D321-4EA9-9469-FF970FE8108A}
                3⤵
                  PID:4380
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4564
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 89F892C93BC2418D00AB59AB7C365398 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2888
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI66D6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240674609 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2760
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI680F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240674828 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:5508
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI6B5C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240675671 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2340
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5576
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5868
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5348
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1484
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5408
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:1804
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI8A86.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240683625 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5944
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:1220
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="663fb7fe-44df-4ff1-b865-bdc800025b12"
                2⤵
                • Modifies data under HKEY_USERS
                PID:4864
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:2128
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2628
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:224
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "cf1acd3d-5225-4061-83bf-3e06b0d6e6f9" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002RLqCLAA1
                2⤵
                • Executes dropped EXE
                PID:4456
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "968523fb-00ae-4f9d-9e62-b3b339ed5c13" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002RLqCLAA1
                2⤵
                • Executes dropped EXE
                PID:3452
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "cd1f406c-3213-4ea0-9432-ca4b789c107f" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 0013z00002RLqCLAA1
                2⤵
                • Executes dropped EXE
                PID:4724
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "fcb291ba-59aa-48f9-b5b7-779e8787e23b" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 0013z00002RLqCLAA1
                2⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:748
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3428
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:224
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "c43dabf7-b7d0-46d2-b5d6-1a3cccef613b" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 0013z00002RLqCLAA1
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1364
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2772
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4656
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:468
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "db70f31b-8eab-4e44-938c-18767ece83ab" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 0013z00002RLqCLAA1
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies data under HKEY_USERS
                PID:4224
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4644
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "7953a923-8b82-4354-9b19-cb67130c8c74" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002RLqCLAA1
                2⤵
                • Drops file in Program Files directory
                • Modifies data under HKEY_USERS
                PID:4928
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:1200
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:5408
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "74755cca-a0fa-45a4-a859-b25657df1a40" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002RLqCLAA1
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  PID:2776
                  • C:\Windows\SYSTEM32\msiexec.exe
                    "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                    3⤵
                      PID:5504
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "475bbea8-37a1-4f29-b5fa-2c62cc9087bc" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002RLqCLAA1
                    2⤵
                      PID:4392
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=2668c673ba99afa95e46a102c8d5c6f3&rmm_session_pwd_ttl=86400"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3804
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "a75b0d11-a65d-4131-815e-a934d1221f46" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002RLqCLAA1
                      2⤵
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:3420
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "f91f391e-368e-4ad4-93b8-53d807722c89" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002RLqCLAA1
                      2⤵
                      • Drops file in System32 directory
                      PID:5360
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "2898f3eb-ebc8-4783-a98b-cc9ef877203c" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002RLqCLAA1
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      PID:6140
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "e065a7f7-8f1d-4090-a908-32052d236a0e" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002RLqCLAA1
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:5368
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "6a564bb5-d2a6-44fe-9306-ce72236471a8" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002RLqCLAA1
                      2⤵
                      • Drops file in System32 directory
                      PID:5520
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "504adffa-98c5-4e20-ab3d-672d13835268" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002RLqCLAA1
                      2⤵
                      • Drops file in System32 directory
                      PID:3520
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "7e90baa7-3960-4598-ab93-ef6b0e43b278" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002RLqCLAA1
                      2⤵
                        PID:5916
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "51f71bc8-e617-4832-8880-8b88f05180ac" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002RLqCLAA1
                        2⤵
                          PID:5796
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "b0b9ab0a-8d73-4bd7-8a2a-c045df48ea2b" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002RLqCLAA1
                          2⤵
                            PID:4696
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "f9728ac1-90b5-4edc-8563-9cbb1cf5e250" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002RLqCLAA1
                            2⤵
                            • Drops file in System32 directory
                            PID:5900
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:5764
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:5924
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "64b18a6f-02d0-4dd5-8b83-0525a029e69e" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002RLqCLAA1
                            2⤵
                            • Drops file in System32 directory
                            PID:2836
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4180
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2728
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:5512
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5584
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:6100
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:5612
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • Drops file in Program Files directory
                                • System Location Discovery: System Language Discovery
                                PID:2856
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5668
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:6036
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:4444
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:5856
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:5776
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:1900
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        • Checks SCSI registry key(s)
                                        • Modifies data under HKEY_USERS
                                        PID:3144
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:1588
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:4536
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "9bfc456e-e6a7-469c-b563-107665e8143d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002RLqCLAA1
                                  2⤵
                                    PID:748
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "baa9512e-8746-4e0e-8a5a-2a22b783566a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002RLqCLAA1
                                    2⤵
                                      PID:6064
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "33dde2e4-bfcf-4e7f-a454-e796d0b281c4" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002RLqCLAA1
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:6136
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                        3⤵
                                          PID:1188
                                          • C:\Windows\system32\cscript.exe
                                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                            4⤵
                                            • Modifies data under HKEY_USERS
                                            PID:4932
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "cb716dd9-6e33-42f5-97ef-b8e62edcce49" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002RLqCLAA1
                                        2⤵
                                          PID:1520
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "3c8b0e70-6454-4771-a302-b66013fd2878" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002RLqCLAA1
                                          2⤵
                                          • Drops file in Program Files directory
                                          PID:5856
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "f05e12e1-9376-4e74-a71b-3caa9900acc8" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002RLqCLAA1
                                          2⤵
                                            PID:1072
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "bd68bd52-e742-4009-b5c0-48fa9624b507" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002RLqCLAA1
                                            2⤵
                                            • Writes to the Master Boot Record (MBR)
                                            PID:3148
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "7e2265ec-3e8d-4380-8955-5189b1b40665" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002RLqCLAA1
                                            2⤵
                                              PID:1220
                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=2668c673ba99afa95e46a102c8d5c6f3&rmm_session_pwd_ttl=86400"
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3872
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "e96d5c49-2b5a-46f2-8dae-f57a704d2132" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002RLqCLAA1
                                              2⤵
                                                PID:4368
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "90e75412-5d4c-4736-858b-c592363fc91e" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002RLqCLAA1
                                                2⤵
                                                  PID:5848
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "fb597661-842c-429b-8c2a-06ac00b9637d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002RLqCLAA1
                                                  2⤵
                                                    PID:6092
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                      3⤵
                                                      • System Time Discovery
                                                      PID:4920
                                                      • C:\Program Files\dotnet\dotnet.exe
                                                        dotnet --list-runtimes
                                                        4⤵
                                                        • System Time Discovery
                                                        PID:3476
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "ab206eec-d526-4558-b3d5-a1c9f8a00711" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002RLqCLAA1
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:5984
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "58f85555-bbf8-4acc-8951-ef791e16c91a" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002RLqCLAA1
                                                    2⤵
                                                      PID:5572
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "830d21bf-52f4-4ce7-a581-dcc7ad1e27f0" "58f85555-bbf8-4acc-8951-ef791e16c91a" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "0013z00002RLqCLAA1"
                                                        3⤵
                                                          PID:5648
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "cb716dd9-6e33-42f5-97ef-b8e62edcce49" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002RLqCLAA1
                                                        2⤵
                                                          PID:3112
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 830d21bf-52f4-4ce7-a581-dcc7ad1e27f0 "ba4ba833-2e90-4423-bd20-b65ecc661faa" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002RLqCLAA1
                                                          2⤵
                                                          • Modifies registry class
                                                          PID:4564
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                        1⤵
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:1648
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:5508
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000158" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:3800
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000158"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:2220
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:3764

                                                      Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Event Triggered Execution

                                                            2
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Installer Packages

                                                            1
                                                            T1546.016

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Privilege Escalation

                                                            Event Triggered Execution

                                                            2
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Installer Packages

                                                            1
                                                            T1546.016

                                                            Defense Evasion

                                                            Modify Registry

                                                            1
                                                            T1112

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Subvert Trust Controls

                                                            1
                                                            T1553

                                                            Install Root Certificate

                                                            1
                                                            T1553.004

                                                            System Binary Proxy Execution

                                                            1
                                                            T1218

                                                            Msiexec

                                                            1
                                                            T1218.007

                                                            Credential Access

                                                            Discovery

                                                            Peripheral Device Discovery

                                                            2
                                                            T1120

                                                            Query Registry

                                                            4
                                                            T1012

                                                            System Information Discovery

                                                            3
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            e57b0b3.rbs
                                                            • Path C:\Config.Msi\e57b0b3.rbs
                                                            • Size 8KB
                                                            • SHA256 e8861786fcf2206b90fe62101a042b2a137cda9edd5b0b59e5cac8570ab7db16
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57b0b8.rbs
                                                            • Path C:\Config.Msi\e57b0b8.rbs
                                                            • Size 74KB
                                                            • SHA256 d44e865aab6ac7f63f5f7d768d5e06d9afd5b42a6a5e8b3f311e151114d27cef
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57b0ba.rbs
                                                            • Path C:\Config.Msi\e57b0ba.rbs
                                                            • Size 464B
                                                            • SHA256 3b4ae6ad2176ece59d0d4741d1e344c075cd67ee97ebe3d55c0bdb646c3b6755
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            e57b0c0.rbs
                                                            • Path C:\Config.Msi\e57b0c0.rbs
                                                            • Size 9KB
                                                            • SHA256 1a17e15a55290b493fcbf6717c43e33fc49c261e52ff820741fef1141a546471
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57b0c8.rbs
                                                            • Path C:\Config.Msi\e57b0c8.rbs
                                                            • Size 8KB
                                                            • SHA256 729a885f6c31ecaa8f2a006eb4a8fe319791520ac2de7355d695e8a21cad87c3
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AteraAgent.InstallLog
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            • Size 1KB
                                                            • SHA256 ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AteraAgent.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                            • Size 142KB
                                                            • SHA256 a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AteraAgent.exe.config
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                            • Size 1KB
                                                            • SHA256 e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            ICSharpCode.SharpZipLib.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                            • Size 210KB
                                                            • SHA256 2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Newtonsoft.Json.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                            • Size 693KB
                                                            • SHA256 2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Agent.Package.Watchdog.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                            • Size 157KB
                                                            • SHA256 7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageADRemote.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                            • Size 51KB
                                                            • SHA256 5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageAgentInformation.INI
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                            • Size 12B
                                                            • SHA256 3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageAgentInformation.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                            • Size 173KB
                                                            • SHA256 36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageAgentInformation.exe.config
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                            • Size 546B
                                                            • SHA256 5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Atera.AgentPackage.Common.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                            • Size 94KB
                                                            • SHA256 c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Newtonsoft.Json.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                            • Size 688KB
                                                            • SHA256 12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageHeartbeat.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            • Size 27KB
                                                            • SHA256 7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageInternalPoller.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                            • Size 214KB
                                                            • SHA256 9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMarketplace.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                            • Size 37KB
                                                            • SHA256 30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMonitoring.zip
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                            • Size 3.4MB
                                                            • SHA256 98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMonitoring.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                            • Size 389KB
                                                            • SHA256 01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 7f66e28b41bbe0be61d69e190b924309d073237418f43f2b450452bdd9bc54a1
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageOsUpdates.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            • Size 196KB
                                                            • SHA256 0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageProgramManagement.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            • Size 55KB
                                                            • SHA256 44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.config
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                            • Size 9KB
                                                            • SHA256 11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.config.6140.update
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.6140.update
                                                            • Size 9KB
                                                            • SHA256 6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.log
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                            • Size 8KB
                                                            • SHA256 92ac4dadc354494fdaa105fa957693e818934477355ecadc812ecee55c8b2e50
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            cpush.exe.ignore
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                            • Size 2B
                                                            • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageRuntimeInstaller.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                            • Size 54KB
                                                            • SHA256 2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSTRemote.zip
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                            • Size 334KB
                                                            • SHA256 adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSTRemote.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            • Size 72KB
                                                            • SHA256 c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSystemTools.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                            • Size 50KB
                                                            • SHA256 6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageTicketing.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            • Size 32KB
                                                            • SHA256 30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageUpgradeAgent.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                            • Size 54KB
                                                            • SHA256 11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Pubnub.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                            • Size 588KB
                                                            • SHA256 13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            log.txt
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                            • Size 231B
                                                            • SHA256 e654717a3567db3b086ad012bbd8e3e4a1f874822643d7c09749e6dde49d9769
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            DIFxCmd.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                            • Size 9KB
                                                            • SHA256 0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            DIFxCmd64.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                            • Size 10KB
                                                            • SHA256 a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            devcon.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                            • Size 76KB
                                                            • SHA256 800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            devcon64.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                            • Size 80KB
                                                            • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AteraAgent.InstallState
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                            • Size 7KB
                                                            • SHA256 1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Agent.Package.Watchdog.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                            • Size 1.9MB
                                                            • SHA256 2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageADRemote.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                            • Size 1.1MB
                                                            • SHA256 88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageAgentInformation.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                            • Size 375KB
                                                            • SHA256 29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageHeartbeat.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                            • Size 321KB
                                                            • SHA256 dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageInternalPoller.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                            • Size 814KB
                                                            • SHA256 09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMarketplace.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                            • Size 1.2MB
                                                            • SHA256 a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMarketplace.ini
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                            • Size 11B
                                                            • SHA256 12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageMonitoring.ini
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                            • Size 12B
                                                            • SHA256 a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 aea281d2e79e4220f33245a0d6f9afd24975be70a71fb1f09b37c367a51d52fb
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 dded9d354569aa4c34028cb7d2e48018186899d78c70fea57b3da01426fe06bc
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageOsUpdates.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                            • Size 2.8MB
                                                            • SHA256 5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageProgramManagement.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                            • Size 2.9MB
                                                            • SHA256 0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageRuntimeInstaller.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                            • Size 1.1MB
                                                            • SHA256 e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSTRemote.exe.config
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                            • Size 541B
                                                            • SHA256 7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageSTRemote.ini
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                            • Size 12B
                                                            • SHA256 73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageSystemTools.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                            • Size 646KB
                                                            • SHA256 ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageTicketing.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                            • Size 3.1MB
                                                            • SHA256 d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageUpgradeAgent.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                            • Size 569KB
                                                            • SHA256 dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e2643c884ffabe37e47a15842e4a931b
                                                            • Path C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\e2643c884ffabe37e47a15842e4a931b
                                                            • Size 16KB
                                                            • SHA256 5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.config
                                                            • Path C:\ProgramData\chocolatey\config\chocolatey.config
                                                            • Size 809B
                                                            • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            chocolatey.log
                                                            • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                                                            • Size 6KB
                                                            • SHA256 55f0020d6ce84665ba57843a42caa732160d275cb0c29a908716a167b2a4cc28
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Size 471B
                                                            • SHA256 6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Size 727B
                                                            • SHA256 69354ff510301b85c14cc1ecd0e5b3c98308b820cfbce483389a7b9a437f67d5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Size 727B
                                                            • SHA256 20d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Size 400B
                                                            • SHA256 6490e38a71773cca3cc08a70718f031d82c7a182b69b1e7af970ae51edfe5489
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Size 404B
                                                            • SHA256 16ad6dfd1739e6550cac99390a28ae11ed94dc1157010ae2f6346efcec88980b
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Size 412B
                                                            • SHA256 3e469598a525982d67101e15f8168146f290433b5036536eb8ad6197df700d59
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            rundll32.exe.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                            • Size 651B
                                                            • SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            MSI119D.tmp
                                                            • Path C:\Windows\Installer\MSI119D.tmp
                                                            • Size 4.5MB
                                                            • SHA256 72896d8abeeeb40360596927c0feade8f0bc28f9937d35f646b9ba2a47f1edca
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            System.Management.dll
                                                            • Path C:\Windows\Installer\MSI66D6.tmp-\System.Management.dll
                                                            • Size 60KB
                                                            • SHA256 24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            MSIB12F.tmp
                                                            • Path C:\Windows\Installer\MSIB12F.tmp
                                                            • Size 509KB
                                                            • SHA256 87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AlphaControlAgentInstallation.dll
                                                            • Path C:\Windows\Installer\MSIB12F.tmp-\AlphaControlAgentInstallation.dll
                                                            • Size 25KB
                                                            • SHA256 e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Microsoft.Deployment.WindowsInstaller.dll
                                                            • Path C:\Windows\Installer\MSIB12F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            • Size 179KB
                                                            • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            CustomAction.config
                                                            • Path C:\Windows\Installer\MSIB3FF.tmp-\CustomAction.config
                                                            • Size 1KB
                                                            • SHA256 e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Newtonsoft.Json.dll
                                                            • Path C:\Windows\Installer\MSIB3FF.tmp-\Newtonsoft.Json.dll
                                                            • Size 695KB
                                                            • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            MSIBA1C.tmp
                                                            • Path C:\Windows\Installer\MSIBA1C.tmp
                                                            • Size 211KB
                                                            • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57b0b2.msi
                                                            • Path C:\Windows\Installer\e57b0b2.msi
                                                            • Size 2.9MB
                                                            • SHA256 b42fa58e23432c66acf7d1ba65f2c938dac7bbcd0dbebeac7c52951555d07cdf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_iddcx.cat
                                                            • Path C:\Windows\System32\DriverStore\Temp\{98871dfc-ff5a-784d-9acc-c64babde70a5}\lci_iddcx.cat
                                                            • Size 10KB
                                                            • SHA256 85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_iddcx.inf
                                                            • Path C:\Windows\System32\DriverStore\Temp\{98871dfc-ff5a-784d-9acc-c64babde70a5}\lci_iddcx.inf
                                                            • Size 4KB
                                                            • SHA256 60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_iddcx.dll
                                                            • Path C:\Windows\System32\DriverStore\Temp\{98871dfc-ff5a-784d-9acc-c64babde70a5}\x64\lci_iddcx.dll
                                                            • Size 52KB
                                                            • SHA256 148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxywddm.cat
                                                            • Path C:\Windows\System32\DriverStore\Temp\{c81ff0ad-e5db-d34d-8d5c-5e6177db7e6a}\lci_proxywddm.cat
                                                            • Size 12KB
                                                            • SHA256 7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxywddm.inf
                                                            • Path C:\Windows\System32\DriverStore\Temp\{c81ff0ad-e5db-d34d-8d5c-5e6177db7e6a}\lci_proxywddm.inf
                                                            • Size 2KB
                                                            • SHA256 d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            lci_proxyumd.dll
                                                            • Path C:\Windows\System32\DriverStore\Temp\{c81ff0ad-e5db-d34d-8d5c-5e6177db7e6a}\x64\lci_proxyumd.dll
                                                            • Size 179KB
                                                            • SHA256 e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxyumd32.dll
                                                            • Path C:\Windows\System32\DriverStore\Temp\{c81ff0ad-e5db-d34d-8d5c-5e6177db7e6a}\x64\lci_proxyumd32.dll
                                                            • Size 135KB
                                                            • SHA256 79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxywddm.sys
                                                            • Path C:\Windows\System32\DriverStore\Temp\{c81ff0ad-e5db-d34d-8d5c-5e6177db7e6a}\x64\lci_proxywddm.sys
                                                            • Size 119KB
                                                            • SHA256 0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            B7C5EA94-B96A-41F5-BE95-25D78B486678-12-28-40.dat
                                                            • Path C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-12-28-40.dat
                                                            • Size 602B
                                                            • SHA256 373ca762dab6e00c3d27229d9e87a32c8790fa147c2d1bc565efc4bd2a549635
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            InstallUtil.log
                                                            • Path C:\Windows\Temp\InstallUtil.log
                                                            • Size 4KB
                                                            • SHA256 9295718aff1455166a1358a1b4362c47bdf37aa9319d128b14a797ea67a19460
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            InstallUtil.log
                                                            • Path C:\Windows\Temp\InstallUtil.log
                                                            • Size 1KB
                                                            • SHA256 6924a36cf0a9b1266753addca90f519f7a322051dd1da96d7e5fb440442c1041
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            PreVer.log
                                                            • Path C:\Windows\Temp\PreVer.log
                                                            • Size 2KB
                                                            • SHA256 5543c1c3e96b634f004dcb1c074e6fd7d08ef0d7dd7d76b995294457d2075578
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            unpack.log
                                                            • Path C:\Windows\Temp\unpack.log
                                                            • Size 2KB
                                                            • SHA256 68a9ec486cf1f5a66ec4ab26e637d4d9efa7a73342b190306960af76eee148fc
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            PreVerCheck.exe
                                                            • Path C:\Windows\Temp\unpack\PreVerCheck.exe
                                                            • Size 2.7MB
                                                            • SHA256 83ef8e362af27279b63ef28379675a087984791e5eaf4a9272a5cb4e52dd059c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            ISRT.dll
                                                            • Path C:\Windows\Temp\{3E14021E-623C-4424-A96B-99D7EB5738B4}\ISRT.dll
                                                            • Size 427KB
                                                            • SHA256 70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            _isres_0x0409.dll
                                                            • Path C:\Windows\Temp\{3E14021E-623C-4424-A96B-99D7EB5738B4}\_isres_0x0409.dll
                                                            • Size 1.8MB
                                                            • SHA256 9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            IsConfig.ini
                                                            • Path C:\Windows\Temp\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\IsConfig.ini
                                                            • Size 571B
                                                            • SHA256 d193eda99410268676293d315164ff29cd263ca0251a0238592a23a9d78476b0
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            String1033.txt
                                                            • Path C:\Windows\Temp\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\String1033.txt
                                                            • Size 182KB
                                                            • SHA256 bd703470b2f35e3c4d917d3038bf806fcc7c155142d300806c95500274951efd
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            _is730.exe
                                                            • Path C:\Windows\Temp\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\_is730.exe
                                                            • Size 179KB
                                                            • SHA256 e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            setup.inx
                                                            • Path C:\Windows\Temp\{F0C483E5-955A-46E4-8CE7-24AB2D449333}\setup.inx
                                                            • Size 345KB
                                                            • SHA256 c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Size 404B
                                                            • SHA256 bee37905026884eedf91d7bb32fc316d9941dfa2944d8b86b2aa65a4c7c90b5f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Size 412B
                                                            • SHA256 e50aa56094bbfe3a93c6906e8837887953df72e66c08acdc0c5f51f09b359441
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            memory/1184-1048-0x0000000003D70000-0x0000000003F37000-memory.dmp
                                                            Download

                                                            memory/1184-478-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/1184-1082-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/1184-1045-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/1184-1009-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/1184-905-0x0000000003D60000-0x0000000003F27000-memory.dmp
                                                            Download

                                                            memory/1184-902-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/1184-481-0x0000000003D50000-0x0000000003F17000-memory.dmp
                                                            Download

                                                            memory/1184-514-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/1184-1085-0x0000000003D80000-0x0000000003F47000-memory.dmp
                                                            Download

                                                            memory/1364-301-0x000002BF5B040000-0x000002BF5B0F2000-memory.dmp
                                                            Download

                                                            memory/1364-302-0x000002BF42730000-0x000002BF4274C000-memory.dmp
                                                            Download

                                                            memory/1364-300-0x000002BF41ED0000-0x000002BF41EE6000-memory.dmp
                                                            Download

                                                            memory/2224-43-0x0000000003260000-0x000000000326C000-memory.dmp
                                                            Download

                                                            memory/2224-39-0x0000000003220000-0x000000000324E000-memory.dmp
                                                            Download

                                                            memory/2628-196-0x000002B1E77A0000-0x000002B1E77C2000-memory.dmp
                                                            Download

                                                            memory/2628-241-0x000002B1E7950000-0x000002B1E7988000-memory.dmp
                                                            Download

                                                            memory/2628-195-0x000002B1FFF30000-0x000002B1FFFE2000-memory.dmp
                                                            Download

                                                            memory/2728-1135-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/2728-1336-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/2728-1337-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/2728-1335-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/2728-2182-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/2728-2183-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/2728-1218-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/2728-2181-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/2728-1215-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/2728-1212-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/2728-1136-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/2728-1137-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/2776-1277-0x00000246B36B0000-0x00000246B36C2000-memory.dmp
                                                            Download

                                                            memory/2776-1279-0x00000246CC840000-0x00000246CC8F2000-memory.dmp
                                                            Download

                                                            memory/2776-1278-0x00000246B3AA0000-0x00000246B3ABC000-memory.dmp
                                                            Download

                                                            memory/2776-1587-0x00000246B3FD0000-0x00000246B4024000-memory.dmp
                                                            Download

                                                            memory/2828-160-0x000002137C560000-0x000002137C5F8000-memory.dmp
                                                            Download

                                                            memory/2828-148-0x000002137A920000-0x000002137A948000-memory.dmp
                                                            Download

                                                            memory/2828-164-0x000002137AD30000-0x000002137AD42000-memory.dmp
                                                            Download

                                                            memory/2828-165-0x000002137CF10000-0x000002137CF4C000-memory.dmp
                                                            Download

                                                            memory/2836-1809-0x0000013162B30000-0x0000013162B64000-memory.dmp
                                                            Download

                                                            memory/2836-1810-0x000001317BBE0000-0x000001317BC2A000-memory.dmp
                                                            Download

                                                            memory/2836-1814-0x000001317BC30000-0x000001317BC48000-memory.dmp
                                                            Download

                                                            memory/2836-1812-0x000001317BB90000-0x000001317BBAC000-memory.dmp
                                                            Download

                                                            memory/2836-1817-0x000001317BCA0000-0x000001317BCEA000-memory.dmp
                                                            Download

                                                            memory/2836-1816-0x000001317BBB0000-0x000001317BBBA000-memory.dmp
                                                            Download

                                                            memory/3420-1334-0x000002148C750000-0x000002148C770000-memory.dmp
                                                            Download

                                                            memory/3420-1333-0x00000214A54C0000-0x00000214A5572000-memory.dmp
                                                            Download

                                                            memory/3420-1331-0x000002148C280000-0x000002148C28C000-memory.dmp
                                                            Download

                                                            memory/3420-1332-0x000002148C730000-0x000002148C748000-memory.dmp
                                                            Download

                                                            memory/3520-1792-0x0000026187640000-0x000002618764A000-memory.dmp
                                                            Download

                                                            memory/3520-1805-0x00000261A0790000-0x00000261A0842000-memory.dmp
                                                            Download

                                                            memory/3520-1796-0x0000026187E80000-0x0000026187E9A000-memory.dmp
                                                            Download

                                                            memory/3804-2113-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/4168-110-0x00000000054D0000-0x0000000005536000-memory.dmp
                                                            Download

                                                            memory/4224-348-0x0000024A33D30000-0x0000024A33D78000-memory.dmp
                                                            Download

                                                            memory/4224-355-0x0000024A33DE0000-0x0000024A33DE8000-memory.dmp
                                                            Download

                                                            memory/4224-357-0x0000024A33F30000-0x0000024A33F5A000-memory.dmp
                                                            Download

                                                            memory/4224-358-0x0000024A34DF0000-0x0000024A34E2A000-memory.dmp
                                                            Download

                                                            memory/4224-359-0x0000024A33F00000-0x0000024A33F26000-memory.dmp
                                                            Download

                                                            memory/4224-356-0x0000024A33F70000-0x0000024A33FD8000-memory.dmp
                                                            Download

                                                            memory/4224-354-0x0000024A33DD0000-0x0000024A33DD8000-memory.dmp
                                                            Download

                                                            memory/4224-353-0x0000024A1B4E0000-0x0000024A1B4E8000-memory.dmp
                                                            Download

                                                            memory/4224-352-0x0000024A340C0000-0x0000024A34172000-memory.dmp
                                                            Download

                                                            memory/4224-351-0x0000024A33FE0000-0x0000024A340BC000-memory.dmp
                                                            Download

                                                            memory/4224-350-0x0000024A1B440000-0x0000024A1B44A000-memory.dmp
                                                            Download

                                                            memory/4224-349-0x0000024A1B430000-0x0000024A1B438000-memory.dmp
                                                            Download

                                                            memory/4224-347-0x0000024A1B610000-0x0000024A1B65C000-memory.dmp
                                                            Download

                                                            memory/4224-346-0x0000024A1AFA0000-0x0000024A1AFBC000-memory.dmp
                                                            Download

                                                            memory/4224-342-0x0000024A1AB70000-0x0000024A1ABD4000-memory.dmp
                                                            Download

                                                            memory/4224-345-0x0000024A1B480000-0x0000024A1B4CA000-memory.dmp
                                                            Download

                                                            memory/4456-275-0x0000028276D40000-0x0000028276DF0000-memory.dmp
                                                            Download

                                                            memory/4456-80-0x00000000050C0000-0x0000000005414000-memory.dmp
                                                            Download

                                                            memory/4456-76-0x0000000005000000-0x00000000050B2000-memory.dmp
                                                            Download

                                                            memory/4456-277-0x000002825E240000-0x000002825E25C000-memory.dmp
                                                            Download

                                                            memory/4456-272-0x000002825DBD0000-0x000002825DC00000-memory.dmp
                                                            Download

                                                            memory/4456-79-0x0000000002C30000-0x0000000002C52000-memory.dmp
                                                            Download

                                                            memory/4696-1801-0x000002D240120000-0x000002D24015A000-memory.dmp
                                                            Download

                                                            memory/4696-1818-0x000002D259380000-0x000002D259432000-memory.dmp
                                                            Download

                                                            memory/5360-1758-0x00000217D6FC0000-0x00000217D6FE0000-memory.dmp
                                                            Download

                                                            memory/5360-1784-0x00000217EF820000-0x00000217EF8D2000-memory.dmp
                                                            Download

                                                            memory/5360-1746-0x00000217D6660000-0x00000217D6670000-memory.dmp
                                                            Download

                                                            memory/5360-1788-0x00000217EF760000-0x00000217EF7C6000-memory.dmp
                                                            Download

                                                            memory/5360-1789-0x00000217D6FE0000-0x00000217D6FF4000-memory.dmp
                                                            Download

                                                            memory/5512-1226-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/5512-1227-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/5512-1153-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/5512-1154-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/5512-1155-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/5512-2464-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/5512-2465-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/5512-2463-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/5512-1225-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/5520-1794-0x000001A67F920000-0x000001A67F96A000-memory.dmp
                                                            Download

                                                            memory/5520-1804-0x000001A67F8F0000-0x000001A67F90C000-memory.dmp
                                                            Download

                                                            memory/5520-1791-0x000001A67F590000-0x000001A67F59C000-memory.dmp
                                                            Download

                                                            memory/5584-1158-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/5584-1763-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/5584-1156-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/5584-1157-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/5584-1235-0x0000000072220000-0x000000007233C000-memory.dmp
                                                            Download

                                                            memory/5584-1234-0x0000000072340000-0x000000007243D000-memory.dmp
                                                            Download

                                                            memory/5584-1781-0x0000000071E50000-0x0000000072214000-memory.dmp
                                                            Download

                                                            memory/5796-1800-0x00000209885A0000-0x00000209885EA000-memory.dmp
                                                            Download

                                                            memory/5796-1799-0x0000020987D10000-0x0000020987D20000-memory.dmp
                                                            Download

                                                            memory/5796-1815-0x00000209A1050000-0x00000209A112C000-memory.dmp
                                                            Download

                                                            memory/5796-1807-0x0000020988280000-0x000002098829C000-memory.dmp
                                                            Download

                                                            memory/5900-1808-0x000001830A3E0000-0x000001830A42A000-memory.dmp
                                                            Download

                                                            memory/5900-1811-0x000001830A390000-0x000001830A3AC000-memory.dmp
                                                            Download

                                                            memory/5900-1806-0x0000018309B40000-0x0000018309B52000-memory.dmp
                                                            Download

                                                            memory/6140-1797-0x000001CC072E0000-0x000001CC07300000-memory.dmp
                                                            Download

                                                            memory/6140-1795-0x000001CC1FC10000-0x000001CC1FCC2000-memory.dmp
                                                            Download

                                                            memory/6140-1787-0x000001CC06E30000-0x000001CC06E40000-memory.dmp
                                                            Download

                                                            memory/6140-1783-0x000001CC06A70000-0x000001CC06A80000-memory.dmp
                                                            Download