Overview

overview

10

Static

static

10

RQ-5218.msi

windows7-x64

10

RQ-5218.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2025, 03:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RQ-5218.msi
  • Size 2.9MB
  • Sample250313-dx26csvky3
  • SHA256 cf13f22012ec3a6f27a878c417a4ca60fbe56a90069748d2ffc59f264e5451cd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ateraagentbootkitdiscoveryexecutionpersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RQ-5218.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4868
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4020
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6CBF0DB2D31AECE5F2BBCA00F386A49A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:880
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE9D3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642718 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5048
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIED5E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240643437 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIFF32.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648000 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3972
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID12.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651546 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2280
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 043C68B94DC8D8BD9F2B4AA63A9BD1BF E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1600
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4184
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000QWCvNIAX" /AgentId="62b5595c-df35-448c-b909-6882d8f81349"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4748
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 75E94E215479B66174E643F2D776ECD1 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5820
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F61A04B2-10D8-4C72-85ED-F22529E7576A}
        3⤵
        • Executes dropped EXE
        PID:5240
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D0ADC39-6456-4ED0-8D57-5EBCFD117038}
        3⤵
        • Executes dropped EXE
        PID:5288
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA1D4458-B3AC-41BB-A3C0-4873D9842AB2}
        3⤵
        • Executes dropped EXE
        PID:5304
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5ABCFDD9-22DB-40FF-89F8-E7A3DA0DDE20}
        3⤵
        • Executes dropped EXE
        PID:5324
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C293CF1-4539-42A1-9565-DC492CE83FC3}
        3⤵
        • Executes dropped EXE
        PID:5388
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{771E707A-2313-463A-9C02-8D341226C2D5}
        3⤵
        • Executes dropped EXE
        PID:5484
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26329D97-E0B1-4DA3-A348-65C0CDFB50EE}
        3⤵
        • Executes dropped EXE
        PID:5528
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1333ACE5-1564-481D-971E-A9DED9BFDCC9}
        3⤵
        • Executes dropped EXE
        PID:5572
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A110A09-F195-4B38-8FF9-8D0014DDE20D}
        3⤵
        • Executes dropped EXE
        PID:5620
      • C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe
        C:\Windows\TEMP\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_is5995.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E651DBEC-B58B-4389-A295-D45FA6235193}
        3⤵
        • Executes dropped EXE
        PID:5652
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5724
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2212
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3984
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5868
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5916
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5948
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:6004
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6032
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5768
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6140
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5680
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5224
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5284
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5352
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5304
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5392
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5436
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5480
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3C2613F-0FCB-4F1F-9445-B071AE36467F}
        3⤵
        • Executes dropped EXE
        PID:5704
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACBBD8F5-B20F-4B9E-8E13-9B05EB4A52A1}
        3⤵
        • Executes dropped EXE
        PID:5848
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1F31F7B-C460-49BD-AB43-AAC47D94D953}
        3⤵
        • Executes dropped EXE
        PID:5140
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C59CBB68-157C-4506-BE44-201D4C72A632}
        3⤵
        • Executes dropped EXE
        PID:3984
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DB8285D1-5D58-4D94-8AF4-494D4277D342}
        3⤵
        • Executes dropped EXE
        PID:5180
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9FFD8688-D357-4F4F-99CC-D4CE98AD3E01}
        3⤵
        • Executes dropped EXE
        PID:5900
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1200754-9F99-4687-A5C3-5F38E52C86CB}
        3⤵
        • Executes dropped EXE
        PID:184
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2639720E-3041-47E2-912F-05A5D91213F3}
        3⤵
        • Executes dropped EXE
        PID:6000
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6CD56D89-D332-4A0A-B66B-E898A17A03DC}
        3⤵
        • Executes dropped EXE
        PID:6044
      • C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
        C:\Windows\TEMP\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{756CA26C-E354-4665-AAB8-C18251FD3997}
        3⤵
        • Executes dropped EXE
        PID:3140
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{28FF3B8B-D9BB-4FF7-8C95-D3E91C3976D1}
        3⤵
        • Executes dropped EXE
        PID:1412
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C558844-8877-4AFD-8637-96E6C6ADDECE}
        3⤵
        • Executes dropped EXE
        PID:1964
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{042EC4E0-24F5-4E4C-ACA6-B385A2E938C4}
        3⤵
        • Executes dropped EXE
        PID:5928
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{527C7E9D-65C7-4D01-9396-C29E058D5801}
        3⤵
        • Executes dropped EXE
        PID:6004
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{03446F6B-6090-4AE9-9702-AF1DFF3F80B1}
        3⤵
        • Executes dropped EXE
        PID:5988
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11F0E112-6F8B-4FE5-92D5-5FE1ABCEF0CE}
        3⤵
        • Executes dropped EXE
        PID:5768
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{06FAA234-0DBA-44F6-B00E-74A4EC5DBFAB}
        3⤵
        • Executes dropped EXE
        PID:6072
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0099269C-6418-42C2-A8AB-96B006CF5E94}
        3⤵
        • Executes dropped EXE
        PID:6108
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DDD41EF6-75A4-41D0-AE79-4D5B7C75F476}
        3⤵
        • Executes dropped EXE
        PID:5656
      • C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe
        C:\Windows\TEMP\{B48E18A3-B38A-454C-A9A1-A6D43DFC38A4}\_is7C03.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9B261C3B-E212-4CBC-85BF-E990E59939C0}
        3⤵
        • Executes dropped EXE
        PID:6124
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5744
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5380
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5624
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:5652
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:1656
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:6128
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4D704FB-BA52-4910-AC92-14BFF3B85BB5}
            3⤵
            • Executes dropped EXE
            PID:2496
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E18D86EC-45F7-4921-B79F-94008DBEBB6D}
            3⤵
            • Executes dropped EXE
            PID:6116
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A758A21B-FAF1-4884-B747-161A3FBE8405}
            3⤵
            • Executes dropped EXE
            PID:1492
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AE2A5DF0-60EC-490D-BDD6-3E27887E5FC6}
            3⤵
            • Executes dropped EXE
            PID:5332
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{36C302B2-67DE-47A9-AFEC-406FAC2FB2F3}
            3⤵
            • Executes dropped EXE
            PID:5996
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8CAC7918-5E87-4EA2-B34A-218EBEE4BF61}
            3⤵
            • Executes dropped EXE
            PID:5460
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AED42BCC-A8C2-4DDE-9F6E-0A53CAA6A98E}
            3⤵
            • Executes dropped EXE
            PID:5532
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DC4CD50-5CA3-4117-A9C8-151CE9592462}
            3⤵
            • Executes dropped EXE
            PID:5504
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00893E9F-2E1B-4E69-973A-CDE069AC80AD}
            3⤵
            • Executes dropped EXE
            PID:5596
          • C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe
            C:\Windows\TEMP\{C16EE345-6F14-47A7-A64F-4B48C14559C9}\_is91B0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A40EA84-B6A1-44E7-A0C2-BBEC4526CCD1}
            3⤵
            • Executes dropped EXE
            PID:5732
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:1996
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CB96C06-963E-4E66-91CE-9D87941D7194}
            3⤵
            • Executes dropped EXE
            PID:2148
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB19939E-FD34-4877-9CBA-D73A164BCF76}
            3⤵
            • Executes dropped EXE
            PID:5972
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{53FC3614-84BE-41E5-8178-4161AA1672EC}
            3⤵
            • Executes dropped EXE
            PID:4512
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55764A33-B900-47E6-A803-E86E3AF11701}
            3⤵
            • Executes dropped EXE
            PID:2956
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5D136F08-8269-4491-8127-620AB1D7E264}
            3⤵
            • Executes dropped EXE
            PID:4472
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A06CEF0-2DF3-4071-B6A3-CF4AC457E43C}
            3⤵
            • Executes dropped EXE
            PID:5152
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C77CEC83-230D-4AE3-8A1F-7E60E499CAC0}
            3⤵
            • Executes dropped EXE
            PID:5224
          • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
            C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{459F91D2-34B1-444F-AAC5-C674CABA814F}
            3⤵
              PID:5876
            • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
              C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E3F25C3-9975-43EB-8F54-6A532BD2A766}
              3⤵
                PID:5940
              • C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe
                C:\Windows\TEMP\{693BE35A-4D67-4215-8CF1-3D959E06C335}\_is9981.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0C3A14C0-84D3-4B6D-9B12-68046638B70C}
                3⤵
                  PID:5352
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5440
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding E75CF30A9F342636CF4C0898F945CB9B E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5344
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 1AD3A6E74855ADE0A3386BE224ADBEB2 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2280
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding B64619BA15D140C455EB382FE00874DC E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5276
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding F5623ED4760A5BB2B0CCBAE174C353F0 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:7132
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSID53.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717156 484 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4980
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIDE1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717265 488 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:400
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI10B0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717968 493 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4692
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:6600
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:6512
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:6284
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3240
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4608
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:4956
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI349D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240727156 531 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3896
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:6260
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="2f2d225b-5e35-449d-b2c5-09d5a9ea88f6"
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:6576
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:836
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2932
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:3656
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 62b5595c-df35-448c-b909-6882d8f81349 "b0d752a2-e95c-498b-8350-958587f18e0b" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QWCvNIAX
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2424
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 62b5595c-df35-448c-b909-6882d8f81349 "150f7da7-6d38-45b7-9b20-683d6dc178b9" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000QWCvNIAX
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2272
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 62b5595c-df35-448c-b909-6882d8f81349 "98d7cdde-dd5d-44b0-add1-f0275ac6776e" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000QWCvNIAX
                2⤵
                • Executes dropped EXE
                PID:2984
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 62b5595c-df35-448c-b909-6882d8f81349 "13461064-bd10-4980-a70a-5838c1c31f50" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000QWCvNIAX
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4908
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                  3⤵
                  • Drops file in System32 directory
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1760
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1644
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:5048
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 62b5595c-df35-448c-b909-6882d8f81349 "b394e0bc-160b-4717-a9c1-977c1a158c32" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIiwiUmVxdWVzdFBlcm1pc3Npb25PcHRpb24iOjMsIlJlcXVpcmVQYXNzd29yZE9wdGlvbiI6bnVsbCwiUGFzc3dvcmQiOm51bGx9" 001Q300000QWCvNIAX
                2⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4476
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5216
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5636
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5748
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 62b5595c-df35-448c-b909-6882d8f81349 "5cb848c8-2e85-484d-bff8-560e730c5792" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000QWCvNIAX
                2⤵
                • Executes dropped EXE
                PID:4956
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2656
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4432
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 62b5595c-df35-448c-b909-6882d8f81349 "5cb848c8-2e85-484d-bff8-560e730c5792" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000QWCvNIAX
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5428
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 62b5595c-df35-448c-b909-6882d8f81349 "d241217e-95fb-4a39-8f97-7531a83e2494" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QWCvNIAX
                2⤵
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                PID:448
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                  3⤵
                  • Drops file in System32 directory
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies data under HKEY_USERS
                  PID:3360
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:6404
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:6468
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 62b5595c-df35-448c-b909-6882d8f81349 "bbc6f456-2c69-4fd6-a531-8a0746028c6c" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000QWCvNIAX
                  2⤵
                  • Writes to the Master Boot Record (MBR)
                  • Loads dropped DLL
                  • Modifies data under HKEY_USERS
                  PID:3984
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 62b5595c-df35-448c-b909-6882d8f81349 "0fc76f56-cc18-4587-b841-12ab7be96798" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QWCvNIAX
                  2⤵
                    PID:2776
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 62b5595c-df35-448c-b909-6882d8f81349 "7b80e41f-385f-4b20-b70a-6c1c04ad0f23" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QWCvNIAX
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    PID:1364
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 62b5595c-df35-448c-b909-6882d8f81349 "48e53766-4420-41b9-98bf-3e48b76cdf81" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9wYWNrYWdlc3N0b3JlLmJsb2IuY29yZS53aW5kb3dzLm5ldC9pbnN0YWxsZXJzL0FueURlc2svV2luZG93cy9BZ2VudF9BbnlEZXNrX0N1c3RvbV9DbGllbnRfOS4wLjMubXNpIiwiRm9yY2VJbnN0YWxsIjpmYWxzZSwiVGFyZ2V0VmVyc2lvbiI6IjkuMC4zIn0=" 001Q300000QWCvNIAX
                    2⤵
                    • Drops file in System32 directory
                    PID:5468
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 62b5595c-df35-448c-b909-6882d8f81349 "e21d17a6-53c0-46e6-b1b5-9732494b6a93" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000QWCvNIAX
                    2⤵
                      PID:5716
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 62b5595c-df35-448c-b909-6882d8f81349 "67c292d1-41ae-460f-94c6-46354c16b4f0" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QWCvNIAX
                      2⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:2904
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 62b5595c-df35-448c-b909-6882d8f81349 "4c4f974a-610f-4d66-8ed6-f365c68569df" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QWCvNIAX
                      2⤵
                      • Drops file in System32 directory
                      PID:5568
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 62b5595c-df35-448c-b909-6882d8f81349 "35da6cfa-545e-48b7-8395-415b39956889" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000QWCvNIAX
                      2⤵
                      • Drops file in System32 directory
                      PID:2644
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 62b5595c-df35-448c-b909-6882d8f81349 "db9edd96-a8e5-405b-8d41-b9fca7f88200" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QWCvNIAX
                      2⤵
                        PID:5512
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 62b5595c-df35-448c-b909-6882d8f81349 "260d8c8f-007f-4816-974f-4dd258646417" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000QWCvNIAX
                        2⤵
                          PID:4576
                          • C:\Windows\SYSTEM32\msiexec.exe
                            "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                            3⤵
                              PID:6872
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 62b5595c-df35-448c-b909-6882d8f81349 "da0fb324-7eb4-425e-9184-0903bd158337" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000QWCvNIAX
                            2⤵
                            • Downloads MZ/PE file
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            PID:5640
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:5868
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:6360
                            • C:\Program Files\dotnet\dotnet.exe
                              "C:\Program Files\dotnet\dotnet" --list-runtimes
                              3⤵
                              • System Time Discovery
                              PID:6540
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" /repair /quiet /norestart
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:7008
                              • C:\Windows\Temp\{037AD863-AD84-4078-A93C-FE99C56AA3A5}\.cr\8-0-11.exe
                                "C:\Windows\Temp\{037AD863-AD84-4078-A93C-FE99C56AA3A5}\.cr\8-0-11.exe" -burn.clean.room="C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\8-0-11.exe" -burn.filehandle.attached=720 -burn.filehandle.self=724 /repair /quiet /norestart
                                4⤵
                                • System Time Discovery
                                PID:7100
                                • C:\Windows\Temp\{4B8F85D9-5290-4B3E-83F2-798FBEF61832}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                  "C:\Windows\Temp\{4B8F85D9-5290-4B3E-83F2-798FBEF61832}\.be\dotnet-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{0C546386-5219-400D-8A4F-3AC8144AA16A} {70173D63-957B-4CD1-9698-EE6E70168EC1} 7100
                                  5⤵
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • System Time Discovery
                                  • Modifies registry class
                                  PID:6324
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:7036
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:7068
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:1372
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:5696
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 62b5595c-df35-448c-b909-6882d8f81349 "c35da2f0-e1f1-40db-b00e-de3ad72e8020" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QWCvNIAX
                            2⤵
                              PID:5344
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe" 62b5595c-df35-448c-b909-6882d8f81349 "90996a48-137e-4e9a-938c-4b56962a1edd" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIyZ2V0LWluc3RhbGxlZC1zb2Z0d2FyZVx1MDAyMixcdTAwMjJDYWNoZVR0bEhvdXJzXHUwMDIyOjEyfSJ9" 001Q300000QWCvNIAX
                              2⤵
                                PID:5352
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 62b5595c-df35-448c-b909-6882d8f81349 "822060b2-6a89-43b3-83ff-32911726a918" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000QWCvNIAX
                                2⤵
                                  PID:6820
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=919993ea773983306ccaf7e5e16ceda7&rmm_session_pwd_ttl=86400"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6968
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                1⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5500
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                  2⤵
                                  • Drops file in Program Files directory
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Modifies data under HKEY_USERS
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5728
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                    -h
                                    3⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6096
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5748
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                      4⤵
                                        PID:6064
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5732
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5556
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                        SRUtility.exe -r
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4728
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies data under HKEY_USERS
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4000
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                        4⤵
                                          PID:924
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ver
                                            5⤵
                                              PID:6248
                                            • C:\Windows\system32\sc.exe
                                              sc query ddmgr
                                              5⤵
                                              • Launches sc.exe
                                              PID:6172
                                            • C:\Windows\system32\sc.exe
                                              sc query lci_proxykmd
                                              5⤵
                                              • Launches sc.exe
                                              PID:6412
                                            • C:\Windows\system32\rundll32.exe
                                              rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                              5⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              • Checks SCSI registry key(s)
                                              • Modifies data under HKEY_USERS
                                              PID:6476
                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                      1⤵
                                      • Drops file in Program Files directory
                                      • Modifies data under HKEY_USERS
                                      PID:5536
                                      • C:\Windows\System32\sc.exe
                                        "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                        2⤵
                                        • Launches sc.exe
                                        PID:6388
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 62b5595c-df35-448c-b909-6882d8f81349 "a0999ff9-8666-4a37-a703-c33f116eb345" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9wYWNrYWdlc3N0b3JlLmJsb2IuY29yZS53aW5kb3dzLm5ldC9pbnN0YWxsZXJzL0FueURlc2svV2luZG93cy9BZ2VudF9BbnlEZXNrX0N1c3RvbV9DbGllbnRfOS4wLjMubXNpIiwiRm9yY2VJbnN0YWxsIjpmYWxzZSwiVGFyZ2V0VmVyc2lvbiI6IjkuMC4zIn0=" 001Q300000QWCvNIAX
                                        2⤵
                                          PID:3196
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" 62b5595c-df35-448c-b909-6882d8f81349 "67c96516-3fe5-413c-875e-ff8b1e7fef02" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 001Q300000QWCvNIAX
                                          2⤵
                                            PID:5756
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 62b5595c-df35-448c-b909-6882d8f81349 "fb071619-8495-4956-a196-7ebbecc90b3b" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjpmYWxzZSxcdTAwMjJSZXBlYXRJbnRlcnZhbE1pbnV0ZXNcdTAwMjI6MTAsXHUwMDIyRGF5c0ludGVydmFsXHUwMDIyOjEsXHUwMDIyUmVwZWF0RHVyYXRpb25EYXlzXHUwMDIyOjF9In0=" 001Q300000QWCvNIAX
                                            2⤵
                                              PID:5660
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 62b5595c-df35-448c-b909-6882d8f81349 "14a334fb-a1f8-4ace-a1c5-da39cc1d92e5" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000QWCvNIAX
                                              2⤵
                                                PID:3092
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 62b5595c-df35-448c-b909-6882d8f81349 "0465c8b3-4134-454e-a65e-66d1ef3f1d0f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000QWCvNIAX
                                                2⤵
                                                  PID:7144
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "powershell.exe" -NoProfile -File "C:\Windows\TEMP\Windows 11 Readiness.ps1"
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Modifies data under HKEY_USERS
                                                    PID:4608
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                    3⤵
                                                      PID:1116
                                                      • C:\Windows\system32\cscript.exe
                                                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                        4⤵
                                                          PID:4828
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe" 62b5595c-df35-448c-b909-6882d8f81349 "75b7b400-8ad1-4a8d-8d25-89b8ea247ed4" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIyZ2V0LWluc3RhbGxlZC1zb2Z0d2FyZVx1MDAyMixcdTAwMjJDYWNoZVR0bEhvdXJzXHUwMDIyOjEyfSJ9" 001Q300000QWCvNIAX
                                                      2⤵
                                                        PID:4908
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 62b5595c-df35-448c-b909-6882d8f81349 "4a5b5e3d-5950-4dea-92aa-2dd97206cf58" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000QWCvNIAX
                                                        2⤵
                                                          PID:3400
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 62b5595c-df35-448c-b909-6882d8f81349 "81014ad2-a961-46da-9939-5e59703e12e9" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000QWCvNIAX
                                                          2⤵
                                                            PID:5004
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 62b5595c-df35-448c-b909-6882d8f81349 "911cd393-969a-40cc-8e5f-97d704377714" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000QWCvNIAX
                                                            2⤵
                                                              PID:1092
                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=919993ea773983306ccaf7e5e16ceda7&rmm_session_pwd_ttl=86400"
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4344
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 62b5595c-df35-448c-b909-6882d8f81349 "a13eb0cd-1366-4ed6-8c69-79e3f020ad9d" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000QWCvNIAX
                                                              2⤵
                                                                PID:6708
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 62b5595c-df35-448c-b909-6882d8f81349 "92444c33-e2d4-4e45-800e-0ea186f15f6e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiOC4wLjExIiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU1ZWIyYTQ5LTI1MjMtNDAyZS1iNjIzLTdhOTAxN2I4YmRlZi84Y2NkNDBhMjEzZWMyOTY0YWY0MTlmOWY3MjI2MzAyNy9kb3RuZXQtcnVudGltZS04LjAuMTEtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8zZjkyNmRkMi1kMjM0LTQzN2EtOGY2YS1lYTZkNzdjMzY4NGMvM2U4MzZhMzQ1YjEzNjA5MTcxM2E3NjliODdmMzQ5OTMvZG90bmV0LXJ1bnRpbWUtOC4wLjExLW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzljZjYyYmI3LTAyZmEtNDA3Mi1iNzY1LTVlMDRhZDA4OTc4OC8zZjM0ZGQ1NjU5Zjk5MTcyYWVhN2M0Y2M5ZGM3YTk3NS9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci81M2U5ZTQxYy1iMzYyLTQ1OTgtOTk4NS00NWY5ODk1MTgwMTYvNTNjNWUxOTE5YmEyZmUyMzI3M2YyYWJhZmY2NTU5NWIvZG90bmV0LXJ1bnRpbWUtOC4wLjExLXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E4ZDFhNDg5LTYwZDYtNGU2My05M2VlLWFiOWM0NGQ3OGIwZC81NTE5Zjk5ZmY1MGRlNmUwOTZiYjFkMjY2ZGQwZTY2Ny9kb3RuZXQtcnVudGltZS04LjAuMTEtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6Im1kZUhHZFVWTllIM21IcW1FMGJMaG5mNUpqNWNVaUZvdHFVSUk3bXltVEZKTXkwYzNvNWZ2YlFJSFx1MDAyQlU4bHA2QVdWZllPeS9wbXFLREpZZ3lTN3gyNEE9PSIsIk1hY1g2NENoZWNrc3VtIjoiTUdaVmR6Z0xqbjlIWmFZU21OWi9oMDZibVNRWS9ZSVJQeTdhQzNkM0kveWtLTFx1MDAyQkNubmUweUtQd1h5TW9pSHpONEtqWGZIeGdwcW0wWHJuaDlNSE04Zz09IiwiV2luQVJNQ2hlY2tzdW0iOiJWMEs0bVZwbFx1MDAyQjkxd0FYMWlZWEZyV2EyTTdORldYSjAvT29KSjMzQklWRlV1WXRzSE14TUsydWxnaTdcdTAwMkJQc1QwY1paeFBORDlhZ2t0dWZXRnZwMDl0b1E9PSIsIldpblg2NENoZWNrc3VtIjoiM05UbUVqazRubEg2Tm5ra1RmS2N1L1E5M1FNRlZHUjUxa3hlSGFQQTlESXZZS0N2VmpkYUxUNEpVY2x6VkcyL2djQW1pXHUwMDJCVXlrYXJkV2piR1hEXHUwMDJCUUh3PT0iLCJXaW5YODZDaGVja3N1bSI6InREanNWcmljT3g4RkJ1TEFzUjFVTXd4d2tQUktLOHhVdURSVVQ0L0E1b3NrdjVKdE03UzFrejBuU2FFMXRzY2JtcDROeDZ3SUNPUmZxRkJINzNlUnF3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000QWCvNIAX
                                                                2⤵
                                                                  PID:6176
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                                    3⤵
                                                                    • System Time Discovery
                                                                    PID:7164
                                                                    • C:\Program Files\dotnet\dotnet.exe
                                                                      dotnet --list-runtimes
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:6468
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 62b5595c-df35-448c-b909-6882d8f81349 "6fa5dc0d-c9f7-43d6-9971-a0808b937ce0" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000QWCvNIAX
                                                                  2⤵
                                                                    PID:3348
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 62b5595c-df35-448c-b909-6882d8f81349 "2d5a0880-7e46-4a63-94fe-fa03d1ab896e" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000QWCvNIAX
                                                                    2⤵
                                                                      PID:6232
                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 62b5595c-df35-448c-b909-6882d8f81349 "84af759c-4bc2-4071-a952-011dafeb011f" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000QWCvNIAX
                                                                      2⤵
                                                                        PID:7104
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      • Checks SCSI registry key(s)
                                                                      PID:6492
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000160" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:1504
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000170" "WinSta0\Default" "00000000000000EC" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:4812
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000104"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Drops file in System32 directory
                                                                        • Checks SCSI registry key(s)
                                                                        PID:2244
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Checks SCSI registry key(s)
                                                                        PID:4184

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Command and Scripting Interpreter

                                                                          1
                                                                          T1059

                                                                          PowerShell

                                                                          1
                                                                          T1059.001

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Event Triggered Execution

                                                                          2
                                                                          T1546

                                                                          Component Object Model Hijacking

                                                                          1
                                                                          T1546.015

                                                                          Installer Packages

                                                                          1
                                                                          T1546.016

                                                                          Pre-OS Boot

                                                                          1
                                                                          T1542

                                                                          Bootkit

                                                                          1
                                                                          T1542.003

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          1
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Event Triggered Execution

                                                                          2
                                                                          T1546

                                                                          Component Object Model Hijacking

                                                                          1
                                                                          T1546.015

                                                                          Installer Packages

                                                                          1
                                                                          T1546.016

                                                                          Defense Evasion

                                                                          Modify Registry

                                                                          2
                                                                          T1112

                                                                          Pre-OS Boot

                                                                          1
                                                                          T1542

                                                                          Bootkit

                                                                          1
                                                                          T1542.003

                                                                          Subvert Trust Controls

                                                                          1
                                                                          T1553

                                                                          Install Root Certificate

                                                                          1
                                                                          T1553.004

                                                                          System Binary Proxy Execution

                                                                          1
                                                                          T1218

                                                                          Msiexec

                                                                          1
                                                                          T1218.007

                                                                          Credential Access

                                                                          Discovery

                                                                          Peripheral Device Discovery

                                                                          2
                                                                          T1120

                                                                          Query Registry

                                                                          4
                                                                          T1012

                                                                          System Information Discovery

                                                                          3
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          System Time Discovery

                                                                          1
                                                                          T1124

                                                                          Lateral Movement

                                                                          Collection

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          e57e948.rbs
                                                                          • Path C:\Config.Msi\e57e948.rbs
                                                                          • Size 8KB
                                                                          • SHA256 9c37a18ec7b7aaaedbb8e53fc0ee568cee2481233231ad926b345cd7ce4589e3
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e94d.rbs
                                                                          • Path C:\Config.Msi\e57e94d.rbs
                                                                          • Size 74KB
                                                                          • SHA256 90c4e61e31ca3a69d1050631e93c154d1d948717d2e279b43cb39e1103a32b55
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e94f.rbs
                                                                          • Path C:\Config.Msi\e57e94f.rbs
                                                                          • Size 464B
                                                                          • SHA256 6af7808590bc7027a625cde321ecac696777738585cb4c005135f2a4fa1209a1
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          e57e953.rbs
                                                                          • Path C:\Config.Msi\e57e953.rbs
                                                                          • Size 48KB
                                                                          • SHA256 5fbd97bbf99c0c1d565cc2b93d8ca820b65bbf436f08d0b9245ebe074d36ba43
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e958.rbs
                                                                          • Path C:\Config.Msi\e57e958.rbs
                                                                          • Size 9KB
                                                                          • SHA256 26adb43d142c9621019b5175c5fe42a8ea445a466ed6b1b29d30d0e468b875fb
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e95d.rbs
                                                                          • Path C:\Config.Msi\e57e95d.rbs
                                                                          • Size 11KB
                                                                          • SHA256 d0a9728ea2897919bcdf7e8e7d5c970dd8774bfcbca4117280edea7eebf0d89f
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e962.rbs
                                                                          • Path C:\Config.Msi\e57e962.rbs
                                                                          • Size 8KB
                                                                          • SHA256 f80d698eb272646d7bae9fca1e350b3db238e97f387b1d019f1ade2e6d9eea3c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e963.rbf
                                                                          • Path C:\Config.Msi\e57e963.rbf
                                                                          • Size 143KB
                                                                          • SHA256 587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e964.rbf
                                                                          • Path C:\Config.Msi\e57e964.rbf
                                                                          • Size 3B
                                                                          • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          e57e96a.rbs
                                                                          • Path C:\Config.Msi\e57e96a.rbs
                                                                          • Size 9KB
                                                                          • SHA256 fc5433ece4d857ec97b40757142cc1e5cb2409640281cf68421fc466f9f3e34b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e972.rbs
                                                                          • Path C:\Config.Msi\e57e972.rbs
                                                                          • Size 8KB
                                                                          • SHA256 3ae27cf9972f2655fd15903cbed3260183394285f6a48b63cde5e46c06da9c01
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AteraAgent.InstallLog
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                          • Size 1KB
                                                                          • SHA256 ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AteraAgent.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                          • Size 142KB
                                                                          • SHA256 a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AteraAgent.exe.config
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                          • Size 1KB
                                                                          • SHA256 e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          ICSharpCode.SharpZipLib.dll
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                          • Size 210KB
                                                                          • SHA256 2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Newtonsoft.Json.dll
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                          • Size 693KB
                                                                          • SHA256 2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Availability.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                                                                          • Size 146KB
                                                                          • SHA256 9eec91cdd39cbb560ad5b1d063df67088f412da4b851ae41e71304fb8a444293
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Software.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Software\Agent.Package.Software.exe
                                                                          • Size 145KB
                                                                          • SHA256 f87117e19652d814a8f4126696a16e83902ac733beee3b00b24eeb555a07df1b
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Watchdog.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                          • Size 145KB
                                                                          • SHA256 977d48979e30a146417937d7e11b26334edec2abddfae1369a9c4348e34857b1
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageADRemote.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                          • Size 51KB
                                                                          • SHA256 5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageAgentInformation.INI
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                          • Size 12B
                                                                          • SHA256 ed104ab4d69e5d34ccdebe12d317c4c8cbb7ddfd60b36f0461db0032a11d288f
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AgentPackageAgentInformation.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                          • Size 248KB
                                                                          • SHA256 0f0425430b83a340883c9c4318cda20e91c8db1febcf0f1b731ae93f2d119020
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageAgentInformation.exe.config
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                          • Size 1021B
                                                                          • SHA256 f1461b023e02fac832979ebf9bfa59ee7043885c90fc8ee6f8077f07a1cb7097
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Atera.AgentPackage.Common.dll
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                          • Size 109KB
                                                                          • SHA256 e02d6383678b394db45f11dcd06f309745b30f9e94ffbc33c9c9433a6b211cca
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Newtonsoft.Json.dll
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                          • Size 693KB
                                                                          • SHA256 e4ccf5985d2f5006d42cfe002b39651ef0c9f1b8db60453d0f682d6d62cac23f
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageHeartbeat.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                          • Size 27KB
                                                                          • SHA256 7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageInternalPoller.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                          • Size 214KB
                                                                          • SHA256 9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageMarketplace.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                          • Size 37KB
                                                                          • SHA256 30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageMonitoring.zip
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                          • Size 3.5MB
                                                                          • SHA256 0b1afe081f2e2aefdcf40cada67e79e287536999e99145748aeeb4f0010730f5
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageMonitoring.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                          • Size 396KB
                                                                          • SHA256 d7b43a4807e1841b94353656fcfd45b69f7550adf137c56aefb85104883fb821
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          package_2.db
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          • Size 48KB
                                                                          • SHA256 680ed1cb6d044b07bf5407da31a77a534d96a0a3157c56c46c7eb1bbc10943eb
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageOsUpdates.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                          • Size 214KB
                                                                          • SHA256 f820a82e28b7db8c8af494d8d14f83d79a3446e3d52d27713b1ad13e5fd18a99
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageRuntimeInstaller.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                          • Size 54KB
                                                                          • SHA256 2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageSTRemote.zip
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                          • Size 333KB
                                                                          • SHA256 e35302995dad1d5e4b7147d8763f7262500271cf01eac8edfa896b392ac7139f
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageSTRemote.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                          • Size 70KB
                                                                          • SHA256 bff4de54dacec104e1e63659857ca99d3e9658dcc09d6e1cbf54dc7b22629cbf
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageSystemTools.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                          • Size 50KB
                                                                          • SHA256 963a4c7863beae55b1058f10f38b5f0d026496c28c78246230d992fd7b19b70a
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageTicketing.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                          • Size 32KB
                                                                          • SHA256 e3da2a27ea6767c32e181f850dd2dfb14cac8a679f42f2b5e42d6bf1255e2e81
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageUpgradeAgent.exe
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                          • Size 60KB
                                                                          • SHA256 9159d0f626aebaca406d0ff9abfe19d6153f3d6eefbc1f831a48c17f4aea7a81
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Pubnub.dll
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                          • Size 588KB
                                                                          • SHA256 13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AteraAgent.InstallLog
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\ToBeRemoved\AteraAgent.InstallLog
                                                                          • Size 753B
                                                                          • SHA256 6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          log.txt
                                                                          • Path C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                          • Size 218B
                                                                          • SHA256 9c45a90e8443b1441d5e290914f8c63c99e410255936a9f3c9f6f13b5f62e981
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          DIFxCmd.exe
                                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                          • Size 9KB
                                                                          • SHA256 0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          DIFxCmd64.exe
                                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                          • Size 10KB
                                                                          • SHA256 a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          devcon.exe
                                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                          • Size 76KB
                                                                          • SHA256 800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          devcon64.exe
                                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                          • Size 80KB
                                                                          • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          SRAgent.sqlite3
                                                                          • Path C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                          • Size 92KB
                                                                          • SHA256 8514f5ee530a0f33cfa5464f2154269280ae813f87aeefe26401eac72ad3167e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AteraAgent.InstallLog
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                          • Size 287B
                                                                          • SHA256 7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AteraAgent.InstallState
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                          • Size 7KB
                                                                          • SHA256 1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Availability.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability.zip
                                                                          • Size 1.3MB
                                                                          • SHA256 f037309cf6b0174ba282106da31c141e3912486c69c438a53afe7ff589743dc2
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Software.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Software.zip
                                                                          • Size 1.6MB
                                                                          • SHA256 de34a5193566b7dcb3365c283dbe3e2644e2fe65fb3915f20e0a9a60424f8d62
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Watchdog.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                          • Size 1.8MB
                                                                          • SHA256 33583a8e2dcf039382e80bfa855944407bcba71976ec41c52810cb8358f42043
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Agent.Package.Watchdog.runtimeconfig.json
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.runtimeconfig.json
                                                                          • Size 375B
                                                                          • SHA256 c4a84cdd787cb31aaa46e8282f7d288f0641fdaa4252ac78979340131c8b9110
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AgentPackageADRemote.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                          • Size 1.1MB
                                                                          • SHA256 88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageAgentInformation.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                          • Size 673KB
                                                                          • SHA256 66c414c255ef75c6ffe9955b4d27cb84704e187b1997a8d6cb3734c94967190a
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageHeartbeat.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                          • Size 321KB
                                                                          • SHA256 dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageInternalPoller.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                          • Size 814KB
                                                                          • SHA256 09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageMarketplace.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                          • Size 1.2MB
                                                                          • SHA256 a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageMarketplace.ini
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                          • Size 11B
                                                                          • SHA256 12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AgentPackageMonitoring.ini
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                          • Size 12B
                                                                          • SHA256 a7a70e5be36672e698230c01904255958bf3e5d81bb5655ffc8dc9221b6134be
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          package_2.db
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          • Size 48KB
                                                                          • SHA256 5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          package_2.db
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          • Size 48KB
                                                                          • SHA256 ed9b0dfb8dc6fc028df2b6a828d8a51e0da88d979427eb4e65af282d4e08b0e7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          package_2.db
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          • Size 48KB
                                                                          • SHA256 5dc35d29c45aa8df2e87a3b1ad79fad8bc24c02299f5034d3282cfda702b7283
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageOsUpdates.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                          • Size 2.8MB
                                                                          • SHA256 925ad251788435923e07523736f1f3908d3c84a5ced6699d7f8a940c255f617d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageRuntimeInstaller.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                          • Size 1.1MB
                                                                          • SHA256 e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageSTRemote.exe.config
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                          • Size 541B
                                                                          • SHA256 7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AgentPackageSTRemote.ini
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                          • Size 12B
                                                                          • SHA256 425adf50cf113d68bd6aa8dc1015db43422bbc1c977933d5f8c1ecaabf18eb2e
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AgentPackageSystemTools.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                          • Size 670KB
                                                                          • SHA256 a3ad00ccb61bc87d58eb7977f68130b78a0b95e74d61e6a4624ac114ccde5736
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AgentPackageTicketing.zip
                                                                          • Path C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                          • Size 3.1MB
                                                                          • SHA256 1bb7671a2ccd6505183f60d33b53eeb9f36ede0a3c4af92dfcf30fa7fa25dae4
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          dotnet.exe
                                                                          • Path C:\Program Files\dotnet\dotnet.exe
                                                                          • Size 143KB
                                                                          • SHA256 11058e8c2cd05f30dcf1775644bf19d2913c9a6d674c12f91d1896d95d9cc5c2
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          c05142d8e8096dc76d37759fb5cd8625
                                                                          • Path C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\c05142d8e8096dc76d37759fb5cd8625
                                                                          • Size 16KB
                                                                          • SHA256 5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                          • Size 471B
                                                                          • SHA256 87cb1cf084c4cc7ed934f98a7681f6826f16b4913f62126adbe4af6606b25f14
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC
                                                                          • Size 727B
                                                                          • SHA256 24bd916bf9f9413d4e527659e56b953fe1a396cdf2c664e0798c3f520ec348ac
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          • Size 727B
                                                                          • SHA256 b9e9bad95aee50d6e2ff0c7a88fe83dd97ddda6d9bc63324749721b0a0abaa39
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                          • Size 400B
                                                                          • SHA256 64f5b44e826bd27aa5cd5fd8f9116bd5a6e00f2f0dfbe5d5a1302ddee117d3f3
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_93E8F0A6DF0B1F1414474691911362FC
                                                                          • Size 412B
                                                                          • SHA256 6ed86c660d42a2f395d3a10543445dbc0d650d3f9218fb5e3b9b0e476cf9b056
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          • Size 412B
                                                                          • SHA256 37f6803e6023bdc981fab832e04a2015162726c91efadfd05a4f4645ce8df3f6
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          rundll32.exe.log
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                          • Size 651B
                                                                          • SHA256 549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          MSI166.tmp
                                                                          • Path C:\Windows\Installer\MSI166.tmp
                                                                          • Size 211KB
                                                                          • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MSI7B25.tmp
                                                                          • Path C:\Windows\Installer\MSI7B25.tmp
                                                                          • Size 4.5MB
                                                                          • SHA256 3334a7025ff6cd58d38155a8f9b9867f1a2d872964c72776c9bf4c50f51f9621
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          System.Management.dll
                                                                          • Path C:\Windows\Installer\MSID53.tmp-\System.Management.dll
                                                                          • Size 60KB
                                                                          • SHA256 24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MSIE9D3.tmp
                                                                          • Path C:\Windows\Installer\MSIE9D3.tmp
                                                                          • Size 509KB
                                                                          • SHA256 87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          AlphaControlAgentInstallation.dll
                                                                          • Path C:\Windows\Installer\MSIE9D3.tmp-\AlphaControlAgentInstallation.dll
                                                                          • Size 25KB
                                                                          • SHA256 e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          Microsoft.Deployment.WindowsInstaller.dll
                                                                          • Path C:\Windows\Installer\MSIE9D3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                          • Size 179KB
                                                                          • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          CustomAction.config
                                                                          • Path C:\Windows\Installer\MSIED5E.tmp-\CustomAction.config
                                                                          • Size 1KB
                                                                          • SHA256 e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Newtonsoft.Json.dll
                                                                          • Path C:\Windows\Installer\MSIED5E.tmp-\Newtonsoft.Json.dll
                                                                          • Size 695KB
                                                                          • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MSIFEC3.tmp
                                                                          • Path C:\Windows\Installer\MSIFEC3.tmp
                                                                          • Size 219KB
                                                                          • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e947.msi
                                                                          • Path C:\Windows\Installer\e57e947.msi
                                                                          • Size 2.9MB
                                                                          • SHA256 cf13f22012ec3a6f27a878c417a4ca60fbe56a90069748d2ffc59f264e5451cd
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e954.msi
                                                                          • Path C:\Windows\Installer\e57e954.msi
                                                                          • Size 26.3MB
                                                                          • SHA256 2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          e57e955.msi
                                                                          • Path C:\Windows\Installer\e57e955.msi
                                                                          • Size 772KB
                                                                          • SHA256 4f9ac5a094e9b1b4f0285e6e69c2e914e42dcc184dfe6fe93894f8e03ca6c193
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_proxywddm.cat
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{03bfe7c1-e760-0543-b7eb-3c8c9069c8b9}\lci_proxywddm.cat
                                                                          • Size 12KB
                                                                          • SHA256 7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_proxywddm.inf
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{03bfe7c1-e760-0543-b7eb-3c8c9069c8b9}\lci_proxywddm.inf
                                                                          • Size 2KB
                                                                          • SHA256 d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          lci_proxyumd.dll
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{03bfe7c1-e760-0543-b7eb-3c8c9069c8b9}\x64\lci_proxyumd.dll
                                                                          • Size 179KB
                                                                          • SHA256 e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_proxyumd32.dll
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{03bfe7c1-e760-0543-b7eb-3c8c9069c8b9}\x64\lci_proxyumd32.dll
                                                                          • Size 135KB
                                                                          • SHA256 79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_proxywddm.sys
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{03bfe7c1-e760-0543-b7eb-3c8c9069c8b9}\x64\lci_proxywddm.sys
                                                                          • Size 119KB
                                                                          • SHA256 0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_iddcx.cat
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{217efda6-0332-8c49-847d-a9dfa2199f2e}\lci_iddcx.cat
                                                                          • Size 10KB
                                                                          • SHA256 85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_iddcx.inf
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{217efda6-0332-8c49-847d-a9dfa2199f2e}\lci_iddcx.inf
                                                                          • Size 4KB
                                                                          • SHA256 60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          lci_iddcx.dll
                                                                          • Path C:\Windows\System32\DriverStore\Temp\{217efda6-0332-8c49-847d-a9dfa2199f2e}\x64\lci_iddcx.dll
                                                                          • Size 52KB
                                                                          • SHA256 148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          B7C5EA94-B96A-41F5-BE95-25D78B486678-03-24-55.dat
                                                                          • Path C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-03-24-55.dat
                                                                          • Size 602B
                                                                          • SHA256 d69e8e9b98c22440c8f16dcd8bc71a53ddfdf018a82090d5336392c11a929ceb
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          InstallUtil.log
                                                                          • Path C:\Windows\Temp\InstallUtil.log
                                                                          • Size 1KB
                                                                          • SHA256 f05e84ed06a4c6d185cf1cdff958d3d79e6ee6e9041f5e2b5caaf299564d80f5
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          InstallUtil.log
                                                                          • Path C:\Windows\Temp\InstallUtil.log
                                                                          • Size 4KB
                                                                          • SHA256 61d56df5dffbeb64049c183befaea70333989f28fdb487f69e8ba49a721017d9
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          PreVer.log
                                                                          • Path C:\Windows\Temp\PreVer.log
                                                                          • Size 2KB
                                                                          • SHA256 47e004d9f42ce9a534bfe110f90b2525af45e7842553e5cd30ae24e1e6f14952
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          __PSScriptPolicyTest_1apat2sl.szt.ps1
                                                                          • Path C:\Windows\Temp\__PSScriptPolicyTest_1apat2sl.szt.ps1
                                                                          • Size 60B
                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          unpack.log
                                                                          • Path C:\Windows\Temp\unpack.log
                                                                          • Size 4KB
                                                                          • SHA256 5114ee6382b52e288b417d5dff7e183d8412f41682981cfd552cc1f965a9230e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          PreVerCheck.exe
                                                                          • Path C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                          • Size 3.2MB
                                                                          • SHA256 ae06a5a23b6c61d250e8c28534ed0ffa8cc0c69b891c670ffaf54a43a9bf43be
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          bg.png
                                                                          • Path C:\Windows\Temp\{4B8F85D9-5290-4B3E-83F2-798FBEF61832}\.ba\bg.png
                                                                          • Size 4KB
                                                                          • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          dotnet-runtime-8.0.11-win-x64.exe
                                                                          • Path C:\Windows\Temp\{4B8F85D9-5290-4B3E-83F2-798FBEF61832}\.be\dotnet-runtime-8.0.11-win-x64.exe
                                                                          • Size 607KB
                                                                          • SHA256 2240e6318171b3cddcee6a801488f59145c1f54ca123068c2a73564535954677
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          IsConfig.ini
                                                                          • Path C:\Windows\Temp\{FC5642D6-348B-4D09-8FBD-3050296241FB}\IsConfig.ini
                                                                          • Size 571B
                                                                          • SHA256 0ce4b4c69344a2d099dd6ca99e44801542fa2011b5505dd9760f023570049b73
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          String1033.txt
                                                                          • Path C:\Windows\Temp\{FC5642D6-348B-4D09-8FBD-3050296241FB}\String1033.txt
                                                                          • Size 182KB
                                                                          • SHA256 57ceff2d980d9224c53a910a6f9e06475dc170f42a0070ae4934868ccd13d2dc
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          _is6EB4.exe
                                                                          • Path C:\Windows\Temp\{FC5642D6-348B-4D09-8FBD-3050296241FB}\_is6EB4.exe
                                                                          • Size 179KB
                                                                          • SHA256 e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          setup.inx
                                                                          • Path C:\Windows\Temp\{FC5642D6-348B-4D09-8FBD-3050296241FB}\setup.inx
                                                                          • Size 345KB
                                                                          • SHA256 c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          ISRT.dll
                                                                          • Path C:\Windows\Temp\{FFB26694-1855-44FD-84DC-C7875D0DF971}\ISRT.dll
                                                                          • Size 427KB
                                                                          • SHA256 70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          _isres_0x0409.dll
                                                                          • Path C:\Windows\Temp\{FFB26694-1855-44FD-84DC-C7875D0DF971}\_isres_0x0409.dll
                                                                          • Size 1.8MB
                                                                          • SHA256 9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          • Size 412B
                                                                          • SHA256 6c7fc9ff3ac92f017ff715b92baa3f81cc7413791316f54114ddf5aa0019e34b
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          AgentPackageAgentInformation.exe.log
                                                                          • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log
                                                                          • Size 1KB
                                                                          • SHA256 b2d273fa926ebf6946e69e8808ad332db42bc65f449748082e088aa732e408ca
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          metadata-2
                                                                          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                          • Size 24.1MB
                                                                          • SHA256 718b1255b76d1fb6fad822425297e2e5bcd4c3749c9f1bc2f3591b1440f7a596
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          {4b946eca-80b8-4891-8450-f81d4df1c902}_OnDiskSnapshotProp
                                                                          • Path \??\Volume{25f6f61f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4b946eca-80b8-4891-8450-f81d4df1c902}_OnDiskSnapshotProp
                                                                          • Size 6KB
                                                                          • SHA256 00cc6627b01582275fdd8d353034d3f0869440a2ee063329b8eefa15b2778dd8
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          memory/1364-1843-0x0000015D85E20000-0x0000015D85E38000-memory.dmp
                                                                          Download

                                                                          memory/1364-1849-0x0000015D9E770000-0x0000015D9E822000-memory.dmp
                                                                          Download

                                                                          memory/1364-1840-0x0000015D855E0000-0x0000015D855EC000-memory.dmp
                                                                          Download

                                                                          memory/1364-1852-0x0000015D85E40000-0x0000015D85E60000-memory.dmp
                                                                          Download

                                                                          memory/2272-298-0x0000018D430C0000-0x0000018D430E0000-memory.dmp
                                                                          Download

                                                                          memory/2424-296-0x0000029035310000-0x00000290353C2000-memory.dmp
                                                                          Download

                                                                          memory/2424-293-0x0000029034810000-0x0000029034852000-memory.dmp
                                                                          Download

                                                                          memory/2644-1891-0x000001A0A9BD0000-0x000001A0A9C36000-memory.dmp
                                                                          Download

                                                                          memory/2644-1889-0x000001A0A99D0000-0x000001A0A9A82000-memory.dmp
                                                                          Download

                                                                          memory/2644-1875-0x000001A090840000-0x000001A090850000-memory.dmp
                                                                          Download

                                                                          memory/2644-1893-0x000001A0910A0000-0x000001A0910B4000-memory.dmp
                                                                          Download

                                                                          memory/2644-1884-0x000001A091080000-0x000001A0910A0000-memory.dmp
                                                                          Download

                                                                          memory/2776-1803-0x000001FA44E50000-0x000001FA44E6A000-memory.dmp
                                                                          Download

                                                                          memory/2776-1887-0x000001FA5DD90000-0x000001FA5E2B8000-memory.dmp
                                                                          Download

                                                                          memory/2776-1844-0x000001FA5D650000-0x000001FA5D702000-memory.dmp
                                                                          Download

                                                                          memory/2776-1787-0x000001FA44500000-0x000001FA4450A000-memory.dmp
                                                                          Download

                                                                          memory/2852-81-0x0000000004D50000-0x00000000050A4000-memory.dmp
                                                                          Download

                                                                          memory/2852-80-0x0000000002830000-0x0000000002852000-memory.dmp
                                                                          Download

                                                                          memory/2852-77-0x0000000004C90000-0x0000000004D42000-memory.dmp
                                                                          Download

                                                                          memory/2904-1865-0x000001A7341F0000-0x000001A7341FC000-memory.dmp
                                                                          Download

                                                                          memory/2904-1896-0x000001A74D500000-0x000001A74D5B0000-memory.dmp
                                                                          Download

                                                                          memory/2904-1912-0x000001A74D450000-0x000001A74D46C000-memory.dmp
                                                                          Download

                                                                          memory/2904-1910-0x000001A74D690000-0x000001A74D76C000-memory.dmp
                                                                          Download

                                                                          memory/2904-1866-0x000001A734A70000-0x000001A734ABA000-memory.dmp
                                                                          Download

                                                                          memory/2904-1868-0x000001A734A40000-0x000001A734A5C000-memory.dmp
                                                                          Download

                                                                          memory/2932-200-0x0000020C299D0000-0x0000020C299F2000-memory.dmp
                                                                          Download

                                                                          memory/2932-191-0x0000020C298D0000-0x0000020C29982000-memory.dmp
                                                                          Download

                                                                          memory/2932-239-0x0000020C29EE0000-0x0000020C29F18000-memory.dmp
                                                                          Download

                                                                          memory/3972-110-0x0000000004730000-0x0000000004796000-memory.dmp
                                                                          Download

                                                                          memory/3984-1244-0x0000026948F70000-0x0000026948F96000-memory.dmp
                                                                          Download

                                                                          memory/4476-322-0x000001C7AB030000-0x000001C7AB0E2000-memory.dmp
                                                                          Download

                                                                          memory/4476-321-0x000001C791DB0000-0x000001C791DC6000-memory.dmp
                                                                          Download

                                                                          memory/4476-323-0x000001C792190000-0x000001C7921AC000-memory.dmp
                                                                          Download

                                                                          memory/4576-1892-0x000001EDB8D20000-0x000001EDB8DD2000-memory.dmp
                                                                          Download

                                                                          memory/4576-1909-0x000001EDB8F20000-0x000001EDB8F74000-memory.dmp
                                                                          Download

                                                                          memory/4576-1890-0x000001EDA0500000-0x000001EDA051C000-memory.dmp
                                                                          Download

                                                                          memory/4576-1888-0x000001ED9FBB0000-0x000001ED9FBC2000-memory.dmp
                                                                          Download

                                                                          memory/4748-159-0x00000272F94F0000-0x00000272F9588000-memory.dmp
                                                                          Download

                                                                          memory/4748-147-0x00000272F6EC0000-0x00000272F6EE8000-memory.dmp
                                                                          Download

                                                                          memory/4748-163-0x00000272F8B90000-0x00000272F8BA2000-memory.dmp
                                                                          Download

                                                                          memory/4748-164-0x00000272F92D0000-0x00000272F930C000-memory.dmp
                                                                          Download

                                                                          memory/5048-41-0x0000000002EF0000-0x0000000002F1E000-memory.dmp
                                                                          Download

                                                                          memory/5048-45-0x0000000002F30000-0x0000000002F3C000-memory.dmp
                                                                          Download

                                                                          memory/5428-451-0x0000025958CC0000-0x0000025958CDC000-memory.dmp
                                                                          Download

                                                                          memory/5428-491-0x0000025958E60000-0x0000025958E68000-memory.dmp
                                                                          Download

                                                                          memory/5428-445-0x0000025958420000-0x0000025958486000-memory.dmp
                                                                          Download

                                                                          memory/5428-450-0x0000025971550000-0x000002597159A000-memory.dmp
                                                                          Download

                                                                          memory/5428-452-0x0000025971640000-0x000002597168C000-memory.dmp
                                                                          Download

                                                                          memory/5428-459-0x0000025971690000-0x00000259716D8000-memory.dmp
                                                                          Download

                                                                          memory/5428-460-0x0000025958CB0000-0x0000025958CB8000-memory.dmp
                                                                          Download

                                                                          memory/5428-461-0x0000025958CE0000-0x0000025958CEA000-memory.dmp
                                                                          Download

                                                                          memory/5428-480-0x00000259718C0000-0x000002597199C000-memory.dmp
                                                                          Download

                                                                          memory/5428-488-0x00000259719A0000-0x0000025971A52000-memory.dmp
                                                                          Download

                                                                          memory/5428-490-0x0000025958E50000-0x0000025958E58000-memory.dmp
                                                                          Download

                                                                          memory/5428-498-0x0000025971810000-0x0000025971836000-memory.dmp
                                                                          Download

                                                                          memory/5428-493-0x0000025971850000-0x00000259718B8000-memory.dmp
                                                                          Download

                                                                          memory/5428-492-0x0000025958E70000-0x0000025958E78000-memory.dmp
                                                                          Download

                                                                          memory/5428-494-0x00000259717E0000-0x000002597180A000-memory.dmp
                                                                          Download

                                                                          memory/5428-497-0x0000025971A60000-0x0000025971A9A000-memory.dmp
                                                                          Download

                                                                          memory/5468-1838-0x0000024905210000-0x0000024905220000-memory.dmp
                                                                          Download

                                                                          memory/5468-1841-0x000002491E2C0000-0x000002491E30A000-memory.dmp
                                                                          Download

                                                                          memory/5468-1894-0x0000024905A80000-0x0000024905A88000-memory.dmp
                                                                          Download

                                                                          memory/5468-1854-0x0000024905A40000-0x0000024905A5C000-memory.dmp
                                                                          Download

                                                                          memory/5468-1876-0x000002491E580000-0x000002491E65C000-memory.dmp
                                                                          Download

                                                                          memory/5468-1886-0x000002491E660000-0x000002491E712000-memory.dmp
                                                                          Download

                                                                          memory/5568-1881-0x000001F33BAA0000-0x000001F33BADA000-memory.dmp
                                                                          Download

                                                                          memory/5568-1902-0x000001F33C450000-0x000001F33C46C000-memory.dmp
                                                                          Download

                                                                          memory/5568-1907-0x000001F354C50000-0x000001F354C98000-memory.dmp
                                                                          Download

                                                                          memory/5568-1899-0x000001F354CC0000-0x000001F354D72000-memory.dmp
                                                                          Download

                                                                          memory/5640-1878-0x000001D23BCB0000-0x000001D23BCCC000-memory.dmp
                                                                          Download

                                                                          memory/5640-1874-0x000001D23BE20000-0x000001D23BE6A000-memory.dmp
                                                                          Download

                                                                          memory/5640-1873-0x000001D23B450000-0x000001D23B462000-memory.dmp
                                                                          Download

                                                                          memory/5640-1911-0x000001D254710000-0x000001D25472A000-memory.dmp
                                                                          Download

                                                                          memory/5640-1897-0x000001D254770000-0x000001D254822000-memory.dmp
                                                                          Download

                                                                          memory/5640-1898-0x000001D254910000-0x000001D2549EC000-memory.dmp
                                                                          Download

                                                                          memory/5716-1872-0x000002771AB60000-0x000002771AB78000-memory.dmp
                                                                          Download

                                                                          memory/5716-1846-0x000002771A210000-0x000002771A24A000-memory.dmp
                                                                          Download

                                                                          memory/5716-1867-0x000002771A5F0000-0x000002771A60C000-memory.dmp
                                                                          Download

                                                                          memory/5716-1851-0x000002771AB10000-0x000002771AB5A000-memory.dmp
                                                                          Download

                                                                          memory/5716-1903-0x0000027733570000-0x00000277335D2000-memory.dmp
                                                                          Download

                                                                          memory/5716-1904-0x0000027733520000-0x000002773353C000-memory.dmp
                                                                          Download

                                                                          memory/5716-1900-0x00000277336C0000-0x0000027733772000-memory.dmp
                                                                          Download

                                                                          memory/5716-1885-0x00000277333B0000-0x00000277333FA000-memory.dmp
                                                                          Download

                                                                          memory/5716-1895-0x00000277335E0000-0x00000277336BC000-memory.dmp
                                                                          Download

                                                                          memory/5716-1877-0x000002771A620000-0x000002771A62A000-memory.dmp
                                                                          Download

                                                                          memory/5728-1209-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/5728-2162-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/5728-2578-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/5728-1915-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/5728-1942-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/5728-1941-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/5728-2579-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/5728-2163-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/5728-1210-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/5748-1784-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/5748-1785-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/5820-974-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                          Download

                                                                          memory/5820-1155-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                          Download

                                                                          memory/5820-553-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                          Download

                                                                          memory/5820-556-0x00000000035A0000-0x0000000003767000-memory.dmp
                                                                          Download

                                                                          memory/5820-1117-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                          Download

                                                                          memory/5820-977-0x00000000035E0000-0x00000000037A7000-memory.dmp
                                                                          Download

                                                                          memory/5820-1029-0x0000000010000000-0x0000000010114000-memory.dmp
                                                                          Download

                                                                          memory/6096-2597-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/6096-2596-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/6096-2856-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/6096-1429-0x0000000072DB0000-0x000000007317D000-memory.dmp
                                                                          Download

                                                                          memory/6096-1428-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download

                                                                          memory/6096-2855-0x0000000073180000-0x000000007329C000-memory.dmp
                                                                          Download