Overview

overview

10

Static

static

10

e7d9701331...52.msi

windows7-x64

10

e7d9701331...52.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 12:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52.msi
  • Size 2.9MB
  • Sample241108-pnbslasdrl
  • SHA256 e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3412
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A2F93BB2EFAC82ADBCEC840493748BB9
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIDACF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638843 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:64
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIDCE4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639218 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3496
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE33E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240640875 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5008
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIEEEB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240643828 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1196
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BAEE730D5E80F42482D92B1561C21001 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2164
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4980
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1268
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000M0aRpIAJ" /AgentId="8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:1364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C417B5F2B56E235C13963020F3406745 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{888228A3-C956-4A4B-981E-C59249DBB355}
        3⤵
        • Executes dropped EXE
        PID:3680
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C6842010-24DB-4CCF-BBBE-BF257C61FA9D}
        3⤵
        • Executes dropped EXE
        PID:2572
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A33EEF94-0890-414B-91DF-7142009ABCC5}
        3⤵
        • Executes dropped EXE
        PID:4332
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30C7BB62-5AD9-413F-96CB-64C3595EFFC4}
        3⤵
        • Executes dropped EXE
        PID:5096
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEF6A716-DE40-4F69-8F4D-017FA10D9970}
        3⤵
        • Executes dropped EXE
        PID:1536
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEFC3E32-327F-4F9A-9484-509892C308E2}
        3⤵
        • Executes dropped EXE
        PID:1592
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3900D479-9BCD-47F0-AB7F-D9D763284AD9}
        3⤵
        • Executes dropped EXE
        PID:1028
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6EB1504B-10DE-4892-87B5-8575D14F8F99}
        3⤵
        • Executes dropped EXE
        PID:4628
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{615146FE-2C93-4CA2-867F-7A124F55DAAD}
        3⤵
        • Executes dropped EXE
        PID:3360
      • C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe
        C:\Windows\TEMP\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_is33FC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D93677D-74EF-4666-BA3C-8D2A0623C2F4}
        3⤵
        • Executes dropped EXE
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3228
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1788
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1132
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2572
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5076
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5096
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1576
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2332
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2460
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1464
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2096
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4272
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4400
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4384
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1464
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1216
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:368
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2804
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6CA1EF1C-8B8B-4391-9E6E-65BBD9FEDF73}
        3⤵
        • Executes dropped EXE
        PID:4332
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BB6AF987-6264-4184-949A-B12F14E51966}
        3⤵
        • Executes dropped EXE
        PID:924
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{98C394AE-2E5A-4C5A-96EF-908B9634B924}
        3⤵
        • Executes dropped EXE
        PID:4404
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8BE143B-7CAA-447E-926B-BCA41BC1C86A}
        3⤵
        • Executes dropped EXE
        PID:4020
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF38006D-E305-4D6F-9FED-290D1C39BCFF}
        3⤵
        • Executes dropped EXE
        PID:1028
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FC30DA99-C00F-44CF-A975-838C40E53B4B}
        3⤵
        • Executes dropped EXE
        PID:3924
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9B3DB59-A808-4D1B-AA12-A17F23208708}
        3⤵
        • Executes dropped EXE
        PID:1980
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6367617A-E73A-4926-AFE2-F036CC015E10}
        3⤵
        • Executes dropped EXE
        PID:2584
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D23A066-9BC9-497B-B2E8-28C84A67162E}
        3⤵
        • Executes dropped EXE
        PID:4332
      • C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
        C:\Windows\TEMP\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9AABD9D0-EC46-46B7-BE73-13DB7A3E5A32}
        3⤵
        • Executes dropped EXE
        PID:924
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F7D14AD-64C4-4665-95D7-B9BD22D6EA1A}
        3⤵
        • Executes dropped EXE
        PID:1980
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{724E9C9E-D1D1-4E3B-8279-3FFB8E8AFD78}
        3⤵
        • Executes dropped EXE
        PID:4080
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{434872D6-B096-45A2-9269-9810F3BD3CFE}
        3⤵
        • Executes dropped EXE
        PID:2780
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A666B495-4FF8-41AF-B5C7-91563EEEEEAB}
        3⤵
        • Executes dropped EXE
        PID:2332
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7ED26D72-A68C-477B-989F-46F3AA9C20F7}
        3⤵
        • Executes dropped EXE
        PID:3612
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E98D6E8-E971-44F2-81CE-D44D57FB9BE9}
        3⤵
        • Executes dropped EXE
        PID:3680
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B45BFE05-2747-4A36-87F1-0B38C79E7581}
        3⤵
        • Executes dropped EXE
        PID:2384
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52E9486D-B368-4871-86F2-1720061C221F}
        3⤵
        • Executes dropped EXE
        PID:3248
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C95A6D03-4ACA-418C-AA2E-AD33280608EB}
        3⤵
        • Executes dropped EXE
        PID:2040
      • C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe
        C:\Windows\TEMP\{9A1B05F3-E2EF-43B9-894E-38A3F92FB02A}\_is4A83.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3CF2C34E-A5A8-4E35-BE09-74B76DE44C4C}
        3⤵
        • Executes dropped EXE
        PID:3364
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4404
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1192
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3552
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:1268
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:3060
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1508
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D912543-3934-4202-9BC5-1E1666106DF2}
            3⤵
            • Executes dropped EXE
            PID:4496
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1CE5DCA-58D5-466A-B085-C6CDF257C8D5}
            3⤵
            • Executes dropped EXE
            PID:2552
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B0264FA-5D2D-4E5C-8210-90AFF60D266B}
            3⤵
            • Executes dropped EXE
            PID:232
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D422FFFA-8815-483A-8A09-2AC05FC4A72F}
            3⤵
            • Executes dropped EXE
            PID:544
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{085AABD7-03E8-4E2F-80A4-F279FBC6B490}
            3⤵
            • Executes dropped EXE
            PID:3248
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{80A9CB30-7C26-4751-82D9-EC2109D0B551}
            3⤵
            • Executes dropped EXE
            PID:3060
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{75F689D7-EBCC-4096-8FC2-C3889EB4ABD9}
            3⤵
            • Executes dropped EXE
            PID:4496
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{01A5E373-7C78-4D25-8575-9A8C45C99440}
            3⤵
            • Executes dropped EXE
            PID:2552
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9FE8F2B6-B14F-4D43-BBA2-B68A80B2D8B8}
            3⤵
            • Executes dropped EXE
            PID:4188
          • C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe
            C:\Windows\TEMP\{FCB4E0C3-BCEB-4436-8B5B-9A4CEF35112D}\_is5DEE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5590BAF0-BEF6-44CB-88CE-B95279FDED99}
            3⤵
            • Executes dropped EXE
            PID:3360
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2780
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B768989-DB4E-4A9A-BB17-50B0AF3BD821}
            3⤵
            • Executes dropped EXE
            PID:2436
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D08BBC44-5C82-4831-89C8-546BFA8A45E3}
            3⤵
            • Executes dropped EXE
            PID:4660
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3FB9D019-43DA-403B-9C9E-CE53AF38AFA1}
            3⤵
            • Executes dropped EXE
            PID:2116
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{69B1CDFC-4CE4-4ECA-982E-D3E2A44345C2}
            3⤵
            • Executes dropped EXE
            PID:2848
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0A2B38EC-4371-498F-B7B2-CFE10678A32F}
            3⤵
            • Executes dropped EXE
            PID:2536
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C05AB8A-E65F-4033-99E8-D90523549D54}
            3⤵
            • Executes dropped EXE
            PID:4188
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{517DADD3-6583-403D-A0E3-A282897CF706}
            3⤵
            • Executes dropped EXE
            PID:3336
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B08F494-918D-4F35-8F5C-D0113E26B712}
            3⤵
            • Executes dropped EXE
            PID:2592
          • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
            C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6F0BC400-67DF-4C08-8EF7-7B2F3BB0CA6D}
            3⤵
              PID:4808
            • C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe
              C:\Windows\TEMP\{56E866C0-82A2-4A69-8A0A-CDC68994B0A1}\_is6215.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13D7D859-8BBF-452E-A2B5-05EF0FDD2148}
              3⤵
                PID:924
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                3⤵
                • System Location Discovery: System Language Discovery
                PID:232
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 7CF22E6BB288D54148CA39B6C127C6CD E Global\MSI0000
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6032
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI9AD6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687937 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                3⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5296
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI9C3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688203 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                3⤵
                • Blocklisted process makes network request
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4748
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI9F8B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240689015 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                3⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4788
              • C:\Windows\SysWOW64\NET.exe
                "NET" STOP AteraAgent
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5560
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 STOP AteraAgent
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5480
              • C:\Windows\SysWOW64\TaskKill.exe
                "TaskKill.exe" /f /im AteraAgent.exe
                3⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5224
              • C:\Windows\syswow64\NET.exe
                "NET" STOP AteraAgent
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2360
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 STOP AteraAgent
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:6044
              • C:\Windows\syswow64\TaskKill.exe
                "TaskKill.exe" /f /im AteraAgent.exe
                3⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5624
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSIBD9C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240696750 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                3⤵
                • Blocklisted process makes network request
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5988
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
              2⤵
              • Drops file in System32 directory
              PID:2408
            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="0df2cd96-9fe3-4444-8e6d-55ba2260617c"
              2⤵
              • Modifies data under HKEY_USERS
              PID:5604
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:264
          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
            "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
            1⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5000
            • C:\Windows\System32\sc.exe
              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
              2⤵
              • Launches sc.exe
              PID:2548
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "f2609e48-fb53-404b-89e7-51ed9dd9cf7d" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
              2⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              PID:3176
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "caeca43b-451e-41e5-b7af-9480d497b59b" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
              2⤵
              • Executes dropped EXE
              PID:3276
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "c8e8b3fa-e1ca-4e8e-bf23-a6492caf91d4" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000M0aRpIAJ
              2⤵
              • Executes dropped EXE
              PID:3364
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "c341f568-988c-4283-ac9d-f5ace1e99e87" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000M0aRpIAJ
              2⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1028
                • C:\Windows\system32\cscript.exe
                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  4⤵
                  • Modifies data under HKEY_USERS
                  PID:2928
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "43b8d6a4-0066-47bc-87cb-5d2661c49c2d" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000M0aRpIAJ
              2⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4676
              • C:\Windows\TEMP\SplashtopStreamer.exe
                "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:748
                • C:\Windows\Temp\unpack\PreVerCheck.exe
                  "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1128
                  • C:\Windows\SysWOW64\msiexec.exe
                    msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4480
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "b9293b13-0f26-4a11-8302-849844926cbb" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000M0aRpIAJ
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4472
          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
            "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
            1⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:388
            • C:\Windows\System32\sc.exe
              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
              2⤵
              • Launches sc.exe
              PID:1960
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "9381dbb3-89ff-41dd-9cba-d0e94b0058f4" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
              2⤵
              • Drops file in Program Files directory
              PID:2928
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                3⤵
                  PID:3056
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:2876
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "c94d1785-ef70-4db0-a73f-6e95909b5d7e" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                2⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                PID:2560
                • C:\Windows\SYSTEM32\msiexec.exe
                  "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                  3⤵
                  • Modifies data under HKEY_USERS
                  PID:6028
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "d76e4868-b70f-4a6a-9eaf-3994742048c5" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                2⤵
                  PID:3648
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=6777b4d9d8d56050949ef7ade0d00e66&rmm_session_pwd_ttl=86400"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5244
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "d071c5ac-4938-4cc9-b169-47e78512f6e4" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                  2⤵
                  • Drops file in System32 directory
                  PID:5336
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "e0e543a8-9f43-4b2c-a3ac-7a00d5919d12" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                  2⤵
                  • Drops file in System32 directory
                  PID:5380
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "1da5d1b4-127a-4f3d-b223-dcb44a095834" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                  2⤵
                  • Drops file in Program Files directory
                  PID:5648
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "147dc1be-ae21-4747-8d90-87ae6e90db57" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                  2⤵
                  • Writes to the Master Boot Record (MBR)
                  • Modifies data under HKEY_USERS
                  PID:5744
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "4f14c543-3bf0-4bbf-98f2-bfa280f098bb" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                  2⤵
                  • Drops file in System32 directory
                  • Modifies registry class
                  PID:5836
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "ab621251-29c0-4bc7-ac33-62fcd04c5aaa" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                  2⤵
                    PID:6088
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "14173ad6-9bf4-4a65-9f85-a7196ea11612" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                    2⤵
                    • Drops file in System32 directory
                    PID:5376
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "e17eb32b-1922-4214-a129-7eed4ce43788" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    PID:6076
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "cd0100a7-ec51-4d7a-9977-3cc0f8ad646b" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                    2⤵
                      PID:1368
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "5ad234e5-3c12-4c49-8c33-3c7ca2037baf" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      PID:5328
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "986d976f-ec73-433c-94c0-a2927c40dfc8" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                      2⤵
                        PID:3332
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                          3⤵
                          • System Time Discovery
                          PID:5312
                          • C:\Program Files\dotnet\dotnet.exe
                            dotnet --list-runtimes
                            4⤵
                            • System Time Discovery
                            PID:5368
                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2448
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                        2⤵
                        • Drops file in System32 directory
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:952
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                          -h
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:4656
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                          3⤵
                          • Drops file in Program Files directory
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2848
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                            4⤵
                              PID:2356
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            PID:2256
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2832
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                              SRUtility.exe -r
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:3660
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3968
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                              4⤵
                                PID:1456
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ver
                                  5⤵
                                    PID:2460
                                  • C:\Windows\system32\sc.exe
                                    sc query ddmgr
                                    5⤵
                                    • Launches sc.exe
                                    PID:1464
                                  • C:\Windows\system32\sc.exe
                                    sc query lci_proxykmd
                                    5⤵
                                    • Launches sc.exe
                                    PID:2764
                                  • C:\Windows\system32\rundll32.exe
                                    rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                    5⤵
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Checks SCSI registry key(s)
                                    • Modifies data under HKEY_USERS
                                    PID:3444
                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                            1⤵
                            • Drops file in Program Files directory
                            • Modifies data under HKEY_USERS
                            PID:5188
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                              2⤵
                              • Launches sc.exe
                              PID:3292
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "b097b334-6818-484d-9b2e-f42cf50c8dd0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                              2⤵
                                PID:3264
                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "2269bff3-349d-495b-b8f6-1a8ce42688a5" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                2⤵
                                  PID:4568
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "8352ed1b-5fea-4b4f-a907-79d9301bdbee" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                                  2⤵
                                  • Drops file in Program Files directory
                                  PID:5896
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "0ece1dfc-cbc4-4a51-8472-9a096967c44b" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                                  2⤵
                                    PID:5288
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      3⤵
                                        PID:5748
                                        • C:\Windows\system32\cscript.exe
                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          4⤵
                                          • Modifies data under HKEY_USERS
                                          PID:3508
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "e2f82547-ba05-4d66-a95f-0e8ee3ed0e5b" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                                      2⤵
                                        PID:5264
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "e00986c2-ace2-4dbf-906c-2e2120ab012d" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                                        2⤵
                                          PID:5056
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "12f41eb6-0ad1-4d4c-934c-b25305898e2b" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                                          2⤵
                                            PID:3932
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "206225b5-2025-4558-93d9-7634d0a6c906" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                                            2⤵
                                              PID:5228
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "518fac19-f68b-422e-8b28-e047da227210" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                                              2⤵
                                                PID:4676
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:4080
                                                  • C:\Program Files\dotnet\dotnet.exe
                                                    dotnet --list-runtimes
                                                    4⤵
                                                    • System Time Discovery
                                                    PID:720
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "3d69c4c4-4542-45b2-bc76-110adfc6072e" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                                                2⤵
                                                  PID:2928
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=6777b4d9d8d56050949ef7ade0d00e66&rmm_session_pwd_ttl=86400"
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5604
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "b98336f6-17ee-4005-914f-648429dfd0a0" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                                                  2⤵
                                                    PID:1500
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "18be1a16-d06b-4ba3-b06a-4f2bd62acb0e" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:5100
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "2cbe76ef-b0ee-42e6-aea2-caa4d1b7ab43" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                                                    2⤵
                                                      PID:5424
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9" "2cbe76ef-b0ee-42e6-aea2-caa4d1b7ab43" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000M0aRpIAJ"
                                                        3⤵
                                                          PID:2356
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "2269bff3-349d-495b-b8f6-1a8ce42688a5" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                                        2⤵
                                                          PID:5164
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 8cf37ee6-9c9d-44dd-b5c7-e85ee4e3b8d9 "9a4216f3-1c9c-444b-b6b4-e7e11a64075f" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                                                          2⤵
                                                          • Modifies registry class
                                                          PID:5412
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                        1⤵
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:5204
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:5940
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000100" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:5868
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "000000000000017C"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in System32 directory
                                                          • Checks SCSI registry key(s)
                                                          PID:2168
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:5888

                                                      Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Event Triggered Execution

                                                            2
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Installer Packages

                                                            1
                                                            T1546.016

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Privilege Escalation

                                                            Event Triggered Execution

                                                            2
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Installer Packages

                                                            1
                                                            T1546.016

                                                            Defense Evasion

                                                            Modify Registry

                                                            1
                                                            T1112

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Subvert Trust Controls

                                                            1
                                                            T1553

                                                            Install Root Certificate

                                                            1
                                                            T1553.004

                                                            System Binary Proxy Execution

                                                            1
                                                            T1218

                                                            Msiexec

                                                            1
                                                            T1218.007

                                                            Credential Access

                                                            Discovery

                                                            Peripheral Device Discovery

                                                            2
                                                            T1120

                                                            Query Registry

                                                            4
                                                            T1012

                                                            System Information Discovery

                                                            3
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            e57da25.rbs
                                                            • Path C:\Config.Msi\e57da25.rbs
                                                            • Size 8KB
                                                            • SHA256 9d21b0fc83e1e5c0ddb22c857279a70fae6427f0ccdf2b6c1fdd6df0bd3e1c42
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57da2a.rbs
                                                            • Path C:\Config.Msi\e57da2a.rbs
                                                            • Size 74KB
                                                            • SHA256 e6d1012760f4ed46f3f12af274577e785fff9b4fe50bd7bb92a822714ab5198a
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57da2c.rbs
                                                            • Path C:\Config.Msi\e57da2c.rbs
                                                            • Size 464B
                                                            • SHA256 bf00a7be38235e27f7d1ee77f9a94aeda62c4c79a9f9546124ae2fe3c5fd15c4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            e57da32.rbs
                                                            • Path C:\Config.Msi\e57da32.rbs
                                                            • Size 9KB
                                                            • SHA256 c8b77d45e4d8bbd21422a626e7be1689c590c70507754de1f1f88065dccb528f
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57da3a.rbs
                                                            • Path C:\Config.Msi\e57da3a.rbs
                                                            • Size 8KB
                                                            • SHA256 36c9cee61b7df78a74aea1742c066ecd24c4e1d4fbc19ed4318545942a1f67db
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AteraAgent.InstallLog
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            • Size 753B
                                                            • SHA256 6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AteraAgent.InstallLog
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            • Size 1KB
                                                            • SHA256 ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AteraAgent.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                            • Size 142KB
                                                            • SHA256 a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AteraAgent.exe.config
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                            • Size 1KB
                                                            • SHA256 e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            ICSharpCode.SharpZipLib.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                            • Size 210KB
                                                            • SHA256 2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Newtonsoft.Json.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                            • Size 693KB
                                                            • SHA256 2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Agent.Package.Watchdog.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                            • Size 157KB
                                                            • SHA256 7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageADRemote.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                            • Size 51KB
                                                            • SHA256 5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageAgentInformation.INI
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                            • Size 12B
                                                            • SHA256 3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageAgentInformation.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                            • Size 173KB
                                                            • SHA256 36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageAgentInformation.exe.config
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                            • Size 546B
                                                            • SHA256 5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Newtonsoft.Json.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                            • Size 688KB
                                                            • SHA256 12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageHeartbeat.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            • Size 27KB
                                                            • SHA256 7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageInternalPoller.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                            • Size 214KB
                                                            • SHA256 9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMarketplace.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                            • Size 37KB
                                                            • SHA256 30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMonitoring.zip
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                            • Size 3.4MB
                                                            • SHA256 98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMonitoring.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                            • Size 389KB
                                                            • SHA256 01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 55867cb3e93ae8b05609335331cd38af997c905fe0f037698f602c787ac222a2
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageOsUpdates.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            • Size 196KB
                                                            • SHA256 0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageProgramManagement.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            • Size 55KB
                                                            • SHA256 44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.config
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                            • Size 9KB
                                                            • SHA256 11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.config.5648.update
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5648.update
                                                            • Size 9KB
                                                            • SHA256 6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.log
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                            • Size 8KB
                                                            • SHA256 7f2579848257242a8af86b32f90f392157563f81d1b44a6a217eca83f202504d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            cpush.exe.ignore
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                            • Size 2B
                                                            • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageRuntimeInstaller.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                            • Size 54KB
                                                            • SHA256 2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSTRemote.zip
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                            • Size 334KB
                                                            • SHA256 adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSTRemote.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            • Size 72KB
                                                            • SHA256 c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSystemTools.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                            • Size 50KB
                                                            • SHA256 6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageTicketing.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            • Size 32KB
                                                            • SHA256 30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageUpgradeAgent.exe
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                            • Size 54KB
                                                            • SHA256 11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Pubnub.dll
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                            • Size 588KB
                                                            • SHA256 13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            log.txt
                                                            • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                            • Size 218B
                                                            • SHA256 7ae4090d813e5439a6210142bd2dddef516421d47e4ca5e027858f58b14e70e2
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            DIFxCmd.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                            • Size 9KB
                                                            • SHA256 0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            DIFxCmd64.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                            • Size 10KB
                                                            • SHA256 a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            devcon.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                            • Size 76KB
                                                            • SHA256 800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            devcon64.exe
                                                            • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                            • Size 80KB
                                                            • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AteraAgent.InstallLog
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            • Size 717B
                                                            • SHA256 f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AteraAgent.InstallState
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                            • Size 7KB
                                                            • SHA256 1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Agent.Package.Watchdog.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                            • Size 1.9MB
                                                            • SHA256 2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageADRemote.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                            • Size 1.1MB
                                                            • SHA256 88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageAgentInformation.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                            • Size 375KB
                                                            • SHA256 29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageHeartbeat.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                            • Size 321KB
                                                            • SHA256 dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageInternalPoller.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                            • Size 814KB
                                                            • SHA256 09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMarketplace.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                            • Size 1.2MB
                                                            • SHA256 a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageMarketplace.ini
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                            • Size 11B
                                                            • SHA256 12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageMonitoring.ini
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                            • Size 12B
                                                            • SHA256 a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 796969aa1f8db390311c367c88f5f968e5fa69459399fab743c341f8d2c561ef
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            package_2.db
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            • Size 48KB
                                                            • SHA256 e1227ebdeb9a115ac07b0e505c8f858fd13d0981267f489ad638bae8e784cb82
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageOsUpdates.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                            • Size 2.8MB
                                                            • SHA256 5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageProgramManagement.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                            • Size 2.9MB
                                                            • SHA256 0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageRuntimeInstaller.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                            • Size 1.1MB
                                                            • SHA256 e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageSTRemote.exe.config
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                            • Size 541B
                                                            • SHA256 7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageSTRemote.ini
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                            • Size 12B
                                                            • SHA256 73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            AgentPackageSystemTools.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                            • Size 646KB
                                                            • SHA256 ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageTicketing.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                            • Size 3.1MB
                                                            • SHA256 d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AgentPackageUpgradeAgent.zip
                                                            • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                            • Size 569KB
                                                            • SHA256 dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            7609b77a0a19a91e196b5733d94a0c98
                                                            • Path C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\7609b77a0a19a91e196b5733d94a0c98
                                                            • Size 16KB
                                                            • SHA256 5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chocolatey.config
                                                            • Path C:\ProgramData\chocolatey\config\chocolatey.config
                                                            • Size 809B
                                                            • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            chocolatey.log
                                                            • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                                                            • Size 12KB
                                                            • SHA256 51c81091b44be7337888b822c94010fbd91bab66b939b8565da10acdfc9527d3
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Size 471B
                                                            • SHA256 6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Size 727B
                                                            • SHA256 69354ff510301b85c14cc1ecd0e5b3c98308b820cfbce483389a7b9a437f67d5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Size 727B
                                                            • SHA256 20d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            • Size 400B
                                                            • SHA256 1f85485c07e6311cf639a48e202b5c90eb03fada24c842dd1843b646207b40ad
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Size 404B
                                                            • SHA256 aca99b29c189792ea1c96cda64002306385b55907f8334eeff73d1edfbfcfc7a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Size 412B
                                                            • SHA256 dad5277db8dda8907995dd507e36fb6c283c615e4c43b4d040055efd87eed700
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            rundll32.exe.log
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                            • Size 651B
                                                            • SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            MSI49A5.tmp
                                                            • Path C:\Windows\Installer\MSI49A5.tmp
                                                            • Size 4.5MB
                                                            • SHA256 e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            System.Management.dll
                                                            • Path C:\Windows\Installer\MSI9AD6.tmp-\System.Management.dll
                                                            • Size 60KB
                                                            • SHA256 24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            MSIDACF.tmp
                                                            • Path C:\Windows\Installer\MSIDACF.tmp
                                                            • Size 509KB
                                                            • SHA256 87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AlphaControlAgentInstallation.dll
                                                            • Path C:\Windows\Installer\MSIDACF.tmp-\AlphaControlAgentInstallation.dll
                                                            • Size 25KB
                                                            • SHA256 e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Microsoft.Deployment.WindowsInstaller.dll
                                                            • Path C:\Windows\Installer\MSIDACF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            • Size 179KB
                                                            • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            CustomAction.config
                                                            • Path C:\Windows\Installer\MSIDCE4.tmp-\CustomAction.config
                                                            • Size 1KB
                                                            • SHA256 e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Newtonsoft.Json.dll
                                                            • Path C:\Windows\Installer\MSIDCE4.tmp-\Newtonsoft.Json.dll
                                                            • Size 695KB
                                                            • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            MSIE4D6.tmp
                                                            • Path C:\Windows\Installer\MSIE4D6.tmp
                                                            • Size 211KB
                                                            • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            e57da24.msi
                                                            • Path C:\Windows\Installer\e57da24.msi
                                                            • Size 2.9MB
                                                            • SHA256 e7d97013314341bbdb5abd3bdade00039a87ec865efc3df4a72feab27f82bf52
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxywddm.cat
                                                            • Path C:\Windows\System32\DriverStore\Temp\{7eda9647-02c9-ff4b-a043-7848c66a8fc6}\lci_proxywddm.cat
                                                            • Size 12KB
                                                            • SHA256 7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxywddm.inf
                                                            • Path C:\Windows\System32\DriverStore\Temp\{7eda9647-02c9-ff4b-a043-7848c66a8fc6}\lci_proxywddm.inf
                                                            • Size 2KB
                                                            • SHA256 d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            lci_proxyumd.dll
                                                            • Path C:\Windows\System32\DriverStore\Temp\{7eda9647-02c9-ff4b-a043-7848c66a8fc6}\x64\lci_proxyumd.dll
                                                            • Size 179KB
                                                            • SHA256 e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxyumd32.dll
                                                            • Path C:\Windows\System32\DriverStore\Temp\{7eda9647-02c9-ff4b-a043-7848c66a8fc6}\x64\lci_proxyumd32.dll
                                                            • Size 135KB
                                                            • SHA256 79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_proxywddm.sys
                                                            • Path C:\Windows\System32\DriverStore\Temp\{7eda9647-02c9-ff4b-a043-7848c66a8fc6}\x64\lci_proxywddm.sys
                                                            • Size 119KB
                                                            • SHA256 0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_iddcx.cat
                                                            • Path C:\Windows\System32\DriverStore\Temp\{cdd6ba80-2702-ee41-8459-616f20a31db0}\lci_iddcx.cat
                                                            • Size 10KB
                                                            • SHA256 85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_iddcx.inf
                                                            • Path C:\Windows\System32\DriverStore\Temp\{cdd6ba80-2702-ee41-8459-616f20a31db0}\lci_iddcx.inf
                                                            • Size 4KB
                                                            • SHA256 60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            lci_iddcx.dll
                                                            • Path C:\Windows\System32\DriverStore\Temp\{cdd6ba80-2702-ee41-8459-616f20a31db0}\x64\lci_iddcx.dll
                                                            • Size 52KB
                                                            • SHA256 148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            B7C5EA94-B96A-41F5-BE95-25D78B486678-12-28-44.dat
                                                            • Path C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-12-28-44.dat
                                                            • Size 602B
                                                            • SHA256 ab79bcef90fdbceb29bfc116c277e087e32c6546174762691182de198aa104ed
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            InstallUtil.log
                                                            • Path C:\Windows\Temp\InstallUtil.log
                                                            • Size 4KB
                                                            • SHA256 de819ba08658010c5ab9df6df06a34c230fcdd6a7b476197dc8ed00ccc98f223
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            InstallUtil.log
                                                            • Path C:\Windows\Temp\InstallUtil.log
                                                            • Size 1KB
                                                            • SHA256 131d182cf34f577fc85df11825565ccf253b5819a97025c481d76aadcf210020
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            PreVerCheck.exe
                                                            • Path C:\Windows\Temp\unpack\PreVerCheck.exe
                                                            • Size 3.2MB
                                                            • SHA256 7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            IsConfig.ini
                                                            • Path C:\Windows\Temp\{8311AEDD-761D-4170-9123-3ED374AE120B}\IsConfig.ini
                                                            • Size 571B
                                                            • SHA256 ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            String1033.txt
                                                            • Path C:\Windows\Temp\{8311AEDD-761D-4170-9123-3ED374AE120B}\String1033.txt
                                                            • Size 182KB
                                                            • SHA256 6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            _is3F38.exe
                                                            • Path C:\Windows\Temp\{8311AEDD-761D-4170-9123-3ED374AE120B}\_is3F38.exe
                                                            • Size 179KB
                                                            • SHA256 e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            setup.inx
                                                            • Path C:\Windows\Temp\{8311AEDD-761D-4170-9123-3ED374AE120B}\setup.inx
                                                            • Size 345KB
                                                            • SHA256 c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            ISRT.dll
                                                            • Path C:\Windows\Temp\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\ISRT.dll
                                                            • Size 427KB
                                                            • SHA256 70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            _isres_0x0409.dll
                                                            • Path C:\Windows\Temp\{B000B7DA-454C-4386-AED1-14C4152FC0D3}\_isres_0x0409.dll
                                                            • Size 1.8MB
                                                            • SHA256 9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            • Size 404B
                                                            • SHA256 34bc6e2018d4182266acb679663760465c5962b30a7be3505a40464166e403f9
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            • Size 412B
                                                            • SHA256 f20e666375005eae9561672519eaae21ab13efd45d6353fa1891da7eab31b21d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            metadata-2
                                                            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                            • Size 24.1MB
                                                            • SHA256 a587063d59a4539bde1daa3cd817c9ff0443173cfe8ca9b22505a71d7951a16f
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            {be37bbd2-3cd9-4285-84fd-e6db6920ec7e}_OnDiskSnapshotProp
                                                            • Path \??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{be37bbd2-3cd9-4285-84fd-e6db6920ec7e}_OnDiskSnapshotProp
                                                            • Size 6KB
                                                            • SHA256 4fce6b6103032e9f0e89c7d0de7f5b8d8159a0553fcac88b46122193b6ee71e1
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            memory/64-39-0x0000000004F90000-0x0000000004FBE000-memory.dmp
                                                            Download

                                                            memory/64-43-0x0000000004FD0000-0x0000000004FDC000-memory.dmp
                                                            Download

                                                            memory/952-1135-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/952-1215-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/952-2165-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/952-2166-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/952-1564-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/952-1563-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/952-1136-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/952-1214-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/1364-167-0x000001EBC2350000-0x000001EBC238C000-memory.dmp
                                                            Download

                                                            memory/1364-166-0x000001EBA8350000-0x000001EBA8362000-memory.dmp
                                                            Download

                                                            memory/1364-162-0x000001EBC2430000-0x000001EBC24C8000-memory.dmp
                                                            Download

                                                            memory/1364-150-0x000001EBA7F30000-0x000001EBA7F58000-memory.dmp
                                                            Download

                                                            memory/1368-2459-0x0000025754560000-0x000002575457A000-memory.dmp
                                                            Download

                                                            memory/1368-1798-0x0000025754000000-0x000002575401C000-memory.dmp
                                                            Download

                                                            memory/1368-2183-0x0000025754560000-0x000002575457A000-memory.dmp
                                                            Download

                                                            memory/1368-1791-0x0000025754400000-0x000002575444A000-memory.dmp
                                                            Download

                                                            memory/1368-1810-0x0000025754510000-0x000002575455A000-memory.dmp
                                                            Download

                                                            memory/1368-2316-0x0000025754560000-0x000002575457A000-memory.dmp
                                                            Download

                                                            memory/1368-1789-0x0000025753B30000-0x0000025753B64000-memory.dmp
                                                            Download

                                                            memory/1368-1804-0x0000025754450000-0x0000025754468000-memory.dmp
                                                            Download

                                                            memory/1368-1805-0x0000025754020000-0x000002575402A000-memory.dmp
                                                            Download

                                                            memory/2560-1258-0x000001F71F5F0000-0x000001F71F6A2000-memory.dmp
                                                            Download

                                                            memory/2560-1238-0x000001F706430000-0x000001F706442000-memory.dmp
                                                            Download

                                                            memory/2560-1394-0x000001F71FFC0000-0x000001F720014000-memory.dmp
                                                            Download

                                                            memory/2560-1245-0x000001F706DB0000-0x000001F706DCC000-memory.dmp
                                                            Download

                                                            memory/2848-3208-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/2848-3209-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/2848-1146-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/2848-1566-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/2848-1565-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/2848-1145-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/2876-1078-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/2876-899-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/2876-1006-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/2876-902-0x00000000036A0000-0x0000000003867000-memory.dmp
                                                            Download

                                                            memory/2876-481-0x0000000003660000-0x0000000003827000-memory.dmp
                                                            Download

                                                            memory/2876-478-0x0000000010000000-0x0000000010114000-memory.dmp
                                                            Download

                                                            memory/3176-278-0x0000029ED1B40000-0x0000029ED1B5C000-memory.dmp
                                                            Download

                                                            memory/3176-277-0x0000029EEA440000-0x0000029EEA4F0000-memory.dmp
                                                            Download

                                                            memory/3176-274-0x0000029ED12D0000-0x0000029ED1300000-memory.dmp
                                                            Download

                                                            memory/3332-1808-0x000002688A9E0000-0x000002688A9F2000-memory.dmp
                                                            Download

                                                            memory/3332-1811-0x000002688B2C0000-0x000002688B30A000-memory.dmp
                                                            Download

                                                            memory/3332-1812-0x000002688AEA0000-0x000002688AEBC000-memory.dmp
                                                            Download

                                                            memory/3496-80-0x00000000048B0000-0x00000000048D2000-memory.dmp
                                                            Download

                                                            memory/3496-77-0x0000000004930000-0x00000000049E2000-memory.dmp
                                                            Download

                                                            memory/3496-81-0x00000000049F0000-0x0000000004D44000-memory.dmp
                                                            Download

                                                            memory/3932-3163-0x00000228E5A10000-0x00000228E5A2A000-memory.dmp
                                                            Download

                                                            memory/4472-347-0x000001AFA3070000-0x000001AFA3078000-memory.dmp
                                                            Download

                                                            memory/4472-355-0x000001AFBBB90000-0x000001AFBBBBA000-memory.dmp
                                                            Download

                                                            memory/4472-344-0x000001AFA3080000-0x000001AFA309C000-memory.dmp
                                                            Download

                                                            memory/4472-357-0x000001AFBBB60000-0x000001AFBBB86000-memory.dmp
                                                            Download

                                                            memory/4472-356-0x000001AFBCA50000-0x000001AFBCA8A000-memory.dmp
                                                            Download

                                                            memory/4472-345-0x000001AFA3160000-0x000001AFA31AC000-memory.dmp
                                                            Download

                                                            memory/4472-348-0x000001AFA30A0000-0x000001AFA30AA000-memory.dmp
                                                            Download

                                                            memory/4472-343-0x000001AFA30B0000-0x000001AFA30FA000-memory.dmp
                                                            Download

                                                            memory/4472-342-0x000001AFA27D0000-0x000001AFA2834000-memory.dmp
                                                            Download

                                                            memory/4472-354-0x000001AFBBBD0000-0x000001AFBBC38000-memory.dmp
                                                            Download

                                                            memory/4472-353-0x000001AFBBAF0000-0x000001AFBBAF8000-memory.dmp
                                                            Download

                                                            memory/4472-351-0x000001AFA3140000-0x000001AFA3148000-memory.dmp
                                                            Download

                                                            memory/4472-346-0x000001AFA31B0000-0x000001AFA31F8000-memory.dmp
                                                            Download

                                                            memory/4472-349-0x000001AFBBC40000-0x000001AFBBD1C000-memory.dmp
                                                            Download

                                                            memory/4472-350-0x000001AFBBD20000-0x000001AFBBDD2000-memory.dmp
                                                            Download

                                                            memory/4472-352-0x000001AFA3200000-0x000001AFA3208000-memory.dmp
                                                            Download

                                                            memory/4656-2453-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/4656-1260-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/4656-3206-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/4656-3207-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/4656-1143-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/4656-2452-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/4656-1261-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/4676-300-0x000001DC4D800000-0x000001DC4D816000-memory.dmp
                                                            Download

                                                            memory/4676-302-0x000001DC4E180000-0x000001DC4E19C000-memory.dmp
                                                            Download

                                                            memory/4676-301-0x000001DC66940000-0x000001DC669F2000-memory.dmp
                                                            Download

                                                            memory/5000-198-0x00000196E8E20000-0x00000196E8E42000-memory.dmp
                                                            Download

                                                            memory/5000-243-0x00000196E9550000-0x00000196E9588000-memory.dmp
                                                            Download

                                                            memory/5000-197-0x00000196E9050000-0x00000196E9102000-memory.dmp
                                                            Download

                                                            memory/5008-112-0x00000000047C0000-0x0000000004826000-memory.dmp
                                                            Download

                                                            memory/5244-1829-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/5244-1806-0x0000000072930000-0x0000000072A4C000-memory.dmp
                                                            Download

                                                            memory/5244-1830-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/5244-1807-0x0000000072560000-0x000000007292D000-memory.dmp
                                                            Download

                                                            memory/5328-1790-0x000002BED28E0000-0x000002BED28EC000-memory.dmp
                                                            Download

                                                            memory/5328-1793-0x000002BED2CF0000-0x000002BED2D3A000-memory.dmp
                                                            Download

                                                            memory/5328-1803-0x000002BED2CA0000-0x000002BED2CBC000-memory.dmp
                                                            Download

                                                            memory/5328-1832-0x000002BEEBC70000-0x000002BEEBD20000-memory.dmp
                                                            Download

                                                            memory/5336-1527-0x00000253ABCB0000-0x00000253ABCC4000-memory.dmp
                                                            Download

                                                            memory/5336-1491-0x00000253AB440000-0x00000253AB450000-memory.dmp
                                                            Download

                                                            memory/5336-1525-0x00000253C4F40000-0x00000253C4FA6000-memory.dmp
                                                            Download

                                                            memory/5336-1522-0x00000253C45D0000-0x00000253C4682000-memory.dmp
                                                            Download

                                                            memory/5336-1521-0x00000253ABC90000-0x00000253ABCB0000-memory.dmp
                                                            Download

                                                            memory/5376-1831-0x000002984DDB0000-0x000002984E2D8000-memory.dmp
                                                            Download

                                                            memory/5376-1787-0x000002984D7C0000-0x000002984D872000-memory.dmp
                                                            Download

                                                            memory/5376-1750-0x0000029834F50000-0x0000029834F6A000-memory.dmp
                                                            Download

                                                            memory/5376-1719-0x00000298345D0000-0x00000298345DA000-memory.dmp
                                                            Download

                                                            memory/5380-1495-0x00000245E4E90000-0x00000245E4EDA000-memory.dmp
                                                            Download

                                                            memory/5380-1528-0x00000245FD910000-0x00000245FD9EC000-memory.dmp
                                                            Download

                                                            memory/5380-1518-0x00000245E4E10000-0x00000245E4E2C000-memory.dmp
                                                            Download

                                                            memory/5380-1529-0x00000245FD9F0000-0x00000245FDAA2000-memory.dmp
                                                            Download

                                                            memory/5380-1567-0x00000245E4E50000-0x00000245E4E58000-memory.dmp
                                                            Download

                                                            memory/5380-1482-0x00000245E45D0000-0x00000245E45E0000-memory.dmp
                                                            Download

                                                            memory/5648-1516-0x0000016784BA0000-0x0000016784C52000-memory.dmp
                                                            Download

                                                            memory/5648-1520-0x0000016784AC0000-0x0000016784AE0000-memory.dmp
                                                            Download

                                                            memory/5648-1792-0x000001679E4A0000-0x000001679EAFC000-memory.dmp
                                                            Download

                                                            memory/5648-1502-0x0000016784620000-0x0000016784630000-memory.dmp
                                                            Download

                                                            memory/5648-1500-0x0000016784260000-0x0000016784270000-memory.dmp
                                                            Download

                                                            memory/5744-1794-0x0000019AF4FE0000-0x0000019AF5006000-memory.dmp
                                                            Download

                                                            memory/5836-1524-0x0000024BEA510000-0x0000024BEA5C2000-memory.dmp
                                                            Download

                                                            memory/5836-1526-0x0000024BE9840000-0x0000024BE9860000-memory.dmp
                                                            Download

                                                            memory/5836-1523-0x0000024BE9820000-0x0000024BE9838000-memory.dmp
                                                            Download

                                                            memory/5836-1519-0x0000024BE9350000-0x0000024BE935C000-memory.dmp
                                                            Download

                                                            memory/6076-1795-0x00000238019D0000-0x0000023801A0A000-memory.dmp
                                                            Download