Edit tour

macOS Analysis Report
AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg

Overview

General Information

Sample name:	AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg
Analysis ID:	1638554
MD5:	0c4913bc52df24b80409570358c81e96
SHA1:	8a2ebc29232d3f3d1b679eca0b44e4d1d57c68cd
SHA256:	97eeac45e7e201c6e0e60b43d46666673eecb23423879a8779a376cda1f9cf03
Infos:

Detection

Score:	48
Range:	0 - 100

Signatures

Creates a notice file (html or txt) to demand a ransom

Writes Mach-O files to hidden directories

Changes permissions of written Mach-O files

Creates hidden files, links and/or directories

Creates system-wide 'launchd' managed services aka launch daemons

Executes the "curl" command used to transfer data via the network (typically using HTTP/S)

Executes the "grep" command used to find patterns in files or piped streams

Executes the "mkdir" command used to create folders

Executes the "mktemp" command used to create a temporary unique file name

Executes the "rm" command used to delete files or directories

Executes the "sudo" command used to execute a command as another user

Executes the "touch" command used to create files or modify time stamps

Executes the "uname" command used to read OS and architecture name

Explicitly unloads, stops, and/or removes launch services

Reads hardware related sysctl values

Reads the systems OS release and/or type

Reads the systems hostname

Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Uses Security framework containing interfaces for system-level user authentication and authorization

Writes 64-bit Mach-O files to disk

Writes HTML files containing JavaScript to disk

Writes Mach-O files to the tmp directory

Writes a file containing only its PID

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638554
Start date and time:	2025-03-14 14:28:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Sample name:	AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg
Detection:	MAL
Classification:	mal48.rans.evad.macPKG@0/449@4/0

Warnings

Excluded IPs from analysis (whitelisted): 104.18.38.233, 23.207.53.102, 172.64.149.23, 17.253.7.140, 17.253.7.135, 17.253.7.138, 17.36.200.79, 17.253.7.143, 17.253.7.133, 184.31.52.29, 96.7.224.10, 96.7.224.34
Excluded domains from analysis (whitelisted): e11408.d.akamaiedge.net, updates.cdn-apple.com.akadns.net, builds.dotnet.microsoft.com.edgesuite.net, crl.apple.com, ocsp.comodoca.com, itunes.apple.com.edgekey.net, a441.dscd.akamai.net, help.apple.com, init.itunes.apple.com, lcdn-locator-usuqo.apple.com.akadns.net, dotnetcli.trafficmanager.net, ocsp.comodoca.com.cdn.cloudflare.net, ocsp.usertrust.com, e673.dsce9.akamaiedge.net, help-ar.apple.com.edgekey.net, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, builds.dotnet.microsoft.com, lcdn-locator.apple.com.akadns.net, help.origin-apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, mesu.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net
Report creation exceeded maximum number of non-whitelisted processes and may have missing process information.
VT rate limit hit for: http://www.mono-project.com/docs/about-mono/
VT rate limit hit for: http://www.novell.com)
VT rate limit hit for: http://www.ookii.org/software/dialogs/
VT rate limit hit for: http://www.ryanjuckett.com/
VT rate limit hit for: http://www.xamarin.com)
VT rate limit hit for: https://www.newtonsoft.com/json
VT rate limit hit for: https://zlib.net/zlib_license.html

Runtime Messages

Command:	open "/Users/bernard/Desktop/AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg"
PID:	622
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 622, Parent: 537)

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: /usr/bin/open /Users/bernard/Desktop/AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg

xpcproxy New Fork (PID: 623, Parent: 1)

Installer (MD5: 50c84168359b295c12427b3461315322) Arguments: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer

xpcproxy New Fork (PID: 628, Parent: 1)

installd (MD5: 4a55e40799072bad8663cf8f5d2d845a) Arguments: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd

install_monitor New Fork (PID: 661, Parent: 628)

preinstall New Fork (PID: 662, Parent: 628)

bash New Fork (PID: 663, Parent: 662)

bash New Fork (PID: 664, Parent: 663)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 665, Parent: 662)

bash New Fork (PID: 666, Parent: 665)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 667, Parent: 662)

basename (MD5: a04543e587bc0beaee437aaaa90ea4f8) Arguments: basename /Users/bernard/Desktop/AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg .pkg

bash New Fork (PID: 668, Parent: 662)

bash New Fork (PID: 669, Parent: 668)

bash New Fork (PID: 670, Parent: 668)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr _ \n

bash New Fork (PID: 671, Parent: 662)

bash New Fork (PID: 672, Parent: 671)

bash New Fork (PID: 673, Parent: 671)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr - /

bash New Fork (PID: 674, Parent: 662)

bash New Fork (PID: 675, Parent: 674)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 676, Parent: 662)

bash New Fork (PID: 677, Parent: 676)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 678, Parent: 662)

sudo (MD5: ce7f467d6b8b6fda34a09a23288e5eef) Arguments: sudo launchctl unload /Library/LaunchDaemons/com.atera.agent.plist

sudo New Fork (PID: 679, Parent: 678)

launchctl (MD5: 319fb0be5351f6db28b612cb36df9704) Arguments: launchctl unload /Library/LaunchDaemons/com.atera.agent.plist

bash New Fork (PID: 680, Parent: 662)

sudo (MD5: ce7f467d6b8b6fda34a09a23288e5eef) Arguments: sudo launchctl stop com.atera.agent

sudo New Fork (PID: 681, Parent: 680)

launchctl (MD5: 319fb0be5351f6db28b612cb36df9704) Arguments: launchctl stop com.atera.agent

bash New Fork (PID: 682, Parent: 662)

bash New Fork (PID: 683, Parent: 682)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

shove New Fork (PID: 684, Parent: 628)

postinstall New Fork (PID: 685, Parent: 628)

bash New Fork (PID: 686, Parent: 685)

bash New Fork (PID: 687, Parent: 686)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 688, Parent: 685)

bash New Fork (PID: 689, Parent: 688)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 690, Parent: 685)

bash New Fork (PID: 691, Parent: 690)

date (MD5: 7b68e7f0831d96715d519e8138529cfd) Arguments: date +%Y-%m-%d %H:%M:%S

bash New Fork (PID: 692, Parent: 685)

sudo (MD5: ce7f467d6b8b6fda34a09a23288e5eef) Arguments: sudo curl -sSL https://dot.net/v1/dotnet-install.sh

sudo New Fork (PID: 695, Parent: 692)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl -sSL https://dot.net/v1/dotnet-install.sh

bash New Fork (PID: 693, Parent: 685)

sudo (MD5: ce7f467d6b8b6fda34a09a23288e5eef) Arguments: sudo bash -s -- -Runtime dotnet -Channel 8.0 -InstallDir /Library/Application Support/com.atera.ateraagent/Agent/.dotnet

sudo New Fork (PID: 694, Parent: 693)

bash (MD5: b513c6e7c86e43eb93f4fd56e28bd540) Arguments: bash -s -- -Runtime dotnet -Channel 8.0 -InstallDir /Library/Application Support/com.atera.ateraagent/Agent/.dotnet

bash New Fork (PID: 697, Parent: 694)

basename (MD5: a04543e587bc0beaee437aaaa90ea4f8) Arguments: basename bash

bash New Fork (PID: 698, Parent: 694)

bash New Fork (PID: 699, Parent: 698)

bash New Fork (PID: 700, Parent: 699)

bash New Fork (PID: 701, Parent: 699)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr [:upper:] [:lower:]

bash New Fork (PID: 702, Parent: 698)

bash New Fork (PID: 703, Parent: 702)

bash New Fork (PID: 704, Parent: 703)

uname (MD5: cb4c9f54edc8f93c8abf482e3a020915) Arguments: uname -m

bash New Fork (PID: 705, Parent: 694)

bash New Fork (PID: 706, Parent: 705)

bash New Fork (PID: 707, Parent: 706)

bash New Fork (PID: 708, Parent: 706)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr [:upper:] [:lower:]

bash New Fork (PID: 709, Parent: 705)

bash New Fork (PID: 710, Parent: 709)

bash New Fork (PID: 711, Parent: 710)

uname (MD5: cb4c9f54edc8f93c8abf482e3a020915) Arguments: uname

bash New Fork (PID: 712, Parent: 694)

bash New Fork (PID: 713, Parent: 712)

bash New Fork (PID: 714, Parent: 713)

bash New Fork (PID: 715, Parent: 713)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr [:upper:] [:lower:]

bash New Fork (PID: 716, Parent: 694)

bash New Fork (PID: 717, Parent: 716)

bash New Fork (PID: 718, Parent: 717)

bash New Fork (PID: 719, Parent: 717)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr [:upper:] [:lower:]

bash New Fork (PID: 720, Parent: 694)

bash New Fork (PID: 721, Parent: 720)

bash New Fork (PID: 722, Parent: 721)

bash New Fork (PID: 723, Parent: 721)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr [:upper:] [:lower:]

bash New Fork (PID: 724, Parent: 694)

bash New Fork (PID: 725, Parent: 694)

bash New Fork (PID: 726, Parent: 725)

bash New Fork (PID: 727, Parent: 725)

bash New Fork (PID: 728, Parent: 725)

bash New Fork (PID: 729, Parent: 728)

bash New Fork (PID: 730, Parent: 729)

uname (MD5: cb4c9f54edc8f93c8abf482e3a020915) Arguments: uname

bash New Fork (PID: 731, Parent: 694)

bash New Fork (PID: 732, Parent: 731)

bash New Fork (PID: 733, Parent: 731)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr [:upper:] [:lower:]

bash New Fork (PID: 734, Parent: 694)

bash New Fork (PID: 735, Parent: 734)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/8.0/dotnet-runtime-osx-x64.tar.gz

bash New Fork (PID: 737, Parent: 694)

bash New Fork (PID: 738, Parent: 737)

bash New Fork (PID: 739, Parent: 737)

awk (MD5: c2a01c11db999f97496e09e12f468956) Arguments: awk $1 ~ /^HTTP/ {print $2}

bash New Fork (PID: 740, Parent: 694)

bash New Fork (PID: 741, Parent: 740)

bash New Fork (PID: 742, Parent: 740)

sed (MD5: 1fee8e981be8ca03f8775ada9b315085) Arguments: sed $d

bash New Fork (PID: 743, Parent: 740)

grep (MD5: 6ff93214c22e9c46b9ac021cfe18c9aa) Arguments: grep -v 301

bash New Fork (PID: 744, Parent: 694)

bash New Fork (PID: 745, Parent: 744)

bash New Fork (PID: 746, Parent: 744)

tail (MD5: 5b752d30895886eae5e001800b8604bd) Arguments: tail -n 1

bash New Fork (PID: 747, Parent: 694)

bash New Fork (PID: 748, Parent: 747)

bash New Fork (PID: 749, Parent: 747)

awk (MD5: c2a01c11db999f97496e09e12f468956) Arguments: awk $1 ~ /^Location/{print $2}

bash New Fork (PID: 750, Parent: 747)

tail (MD5: 5b752d30895886eae5e001800b8604bd) Arguments: tail -1

bash New Fork (PID: 751, Parent: 747)

tr (MD5: 724974697a9bccefdb750e3667f33cf7) Arguments: tr -d \r

bash New Fork (PID: 752, Parent: 694)

bash New Fork (PID: 753, Parent: 752)

bash New Fork (PID: 754, Parent: 753)

bash New Fork (PID: 755, Parent: 754)

bash New Fork (PID: 756, Parent: 754)

grep (MD5: 6ff93214c22e9c46b9ac021cfe18c9aa) Arguments: grep ://

bash New Fork (PID: 757, Parent: 754)

sed (MD5: 1fee8e981be8ca03f8775ada9b315085) Arguments: sed -es,^$.*://$.*,\1,g

bash New Fork (PID: 758, Parent: 753)

bash New Fork (PID: 759, Parent: 758)

bash New Fork (PID: 760, Parent: 758)

grep (MD5: 6ff93214c22e9c46b9ac021cfe18c9aa) Arguments: grep /

bash New Fork (PID: 761, Parent: 758)

cut (MD5: a74f5002e91fff202cb650f65fadabdd) Arguments: cut -d/ -f2-

bash New Fork (PID: 762, Parent: 753)

bash New Fork (PID: 763, Parent: 762)

bash New Fork (PID: 764, Parent: 762)

cut (MD5: a74f5002e91fff202cb650f65fadabdd) Arguments: cut -d/ -f2-

bash New Fork (PID: 765, Parent: 752)

bash New Fork (PID: 766, Parent: 765)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl --head -o /dev/null -w %{http_code} -s --fail https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/dotnet-runtime-8.0.14-osx-x64.tar.gz

bash New Fork (PID: 767, Parent: 694)

bash New Fork (PID: 768, Parent: 767)

bash New Fork (PID: 769, Parent: 767)

bash New Fork (PID: 770, Parent: 767)

bash New Fork (PID: 771, Parent: 770)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl -s --fail https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/runtime-productVersion.txt

bash New Fork (PID: 772, Parent: 694)

bash New Fork (PID: 773, Parent: 772)

bash New Fork (PID: 774, Parent: 773)

bash New Fork (PID: 775, Parent: 773)

bash New Fork (PID: 776, Parent: 772)

bash New Fork (PID: 777, Parent: 772)

bash New Fork (PID: 778, Parent: 694)

mkdir (MD5: bbbaafd2a4d7dcb9ddd178d814fea708) Arguments: mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet

bash New Fork (PID: 779, Parent: 694)

mktemp (MD5: ab78cb00857fefb979f3e8e4ba05b0be) Arguments: mktemp /tmp/dotnet.XXXXXXXXX

bash New Fork (PID: 780, Parent: 694)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl --retry 20 --retry-delay 2 --connect-timeout 15 -sSL -f --create-dirs -o /tmp/dotnet.apAJI0d8n https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/dotnet-runtime-8.0.14-osx-x64.tar.gz

bash New Fork (PID: 781, Parent: 694)

bash New Fork (PID: 782, Parent: 781)

bash New Fork (PID: 783, Parent: 782)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl -sI https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/dotnet-runtime-8.0.14-osx-x64.tar.gz

bash New Fork (PID: 784, Parent: 782)

grep (MD5: 6ff93214c22e9c46b9ac021cfe18c9aa) Arguments: grep -i content-length

bash New Fork (PID: 785, Parent: 782)

awk (MD5: c2a01c11db999f97496e09e12f468956) Arguments: awk { num = $2 + 0 print num }

bash New Fork (PID: 786, Parent: 694)

mktemp (MD5: ab78cb00857fefb979f3e8e4ba05b0be) Arguments: mktemp -d /tmp/dotnet.XXXXXXXXX

bash New Fork (PID: 787, Parent: 694)

tar (MD5: 822f00f28da9b6b443e79b6e27b859f6) Arguments: tar -xzf /tmp/dotnet.apAJI0d8n -C /tmp/dotnet.DUZHkmnca

bash New Fork (PID: 788, Parent: 694)

find (MD5: 1fe4dde0bbb34131dcd3598dac59751d) Arguments: find /tmp/dotnet.DUZHkmnca -type f

bash New Fork (PID: 789, Parent: 694)

grep (MD5: 6ff93214c22e9c46b9ac021cfe18c9aa) Arguments: grep -Eo ^.*/[0-9]+\.[0-9]+[^/]+/

bash New Fork (PID: 790, Parent: 694)

sort (MD5: eb767b75f4b5035fc9bbeaff838daf4b) Arguments: sort

bash New Fork (PID: 791, Parent: 694)

bash New Fork (PID: 792, Parent: 791)

bash New Fork (PID: 793, Parent: 791)

bash New Fork (PID: 794, Parent: 791)

bash New Fork (PID: 795, Parent: 794)

bash New Fork (PID: 796, Parent: 795)

mktemp (MD5: ab78cb00857fefb979f3e8e4ba05b0be) Arguments: mktemp -d

bash New Fork (PID: 797, Parent: 794)

touch (MD5: 4740c7336a3cb2914b528fbce2d5edc7) Arguments: touch /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile

bash New Fork (PID: 798, Parent: 794)

cp (MD5: c6c784e59743c03a85e53ac39bf4b1c1) Arguments: cp -u /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile2

bash New Fork (PID: 799, Parent: 794)

rm (MD5: 99891a42b47f8a1016bf065e62dfe5b0) Arguments: rm -f /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile2

bash New Fork (PID: 800, Parent: 794)

rm (MD5: 99891a42b47f8a1016bf065e62dfe5b0) Arguments: rm -rf /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u

bash New Fork (PID: 801, Parent: 791)

cat (MD5: d4db1aa640ed6d80a0bd350e72d6fa8e) Arguments: cat

bash New Fork (PID: 802, Parent: 791)

uniq (MD5: cc0b12df22d202dc57b5efc4b5d9f6f4) Arguments: uniq

bash New Fork (PID: 803, Parent: 791)

bash New Fork (PID: 804, Parent: 803)

bash New Fork (PID: 805, Parent: 803)

bash New Fork (PID: 806, Parent: 805)

bash New Fork (PID: 807, Parent: 803)

dirname (MD5: 1d082aa299fbbdc31625e0729e1e5271) Arguments: dirname host/fxr/8.0.14/

bash New Fork (PID: 808, Parent: 803)

mkdir (MD5: bbbaafd2a4d7dcb9ddd178d814fea708) Arguments: mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr

bash New Fork (PID: 809, Parent: 803)

cp (MD5: c6c784e59743c03a85e53ac39bf4b1c1) Arguments: cp -R /tmp/dotnet.DUZHkmnca/host/fxr/8.0.14/ /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr/8.0.14/

bash New Fork (PID: 810, Parent: 803)

bash New Fork (PID: 811, Parent: 803)

bash New Fork (PID: 812, Parent: 811)

bash New Fork (PID: 813, Parent: 803)

dirname (MD5: 1d082aa299fbbdc31625e0729e1e5271) Arguments: dirname shared/Microsoft.NETCore.App/8.0.14/

bash New Fork (PID: 814, Parent: 803)

mkdir (MD5: bbbaafd2a4d7dcb9ddd178d814fea708) Arguments: mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App

bash New Fork (PID: 815, Parent: 803)

cp (MD5: c6c784e59743c03a85e53ac39bf4b1c1) Arguments: cp -R /tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/ /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/

bash New Fork (PID: 816, Parent: 694)

find (MD5: 1fe4dde0bbb34131dcd3598dac59751d) Arguments: find /tmp/dotnet.DUZHkmnca -type f

bash New Fork (PID: 817, Parent: 694)

grep (MD5: 6ff93214c22e9c46b9ac021cfe18c9aa) Arguments: grep -Ev ^.*/[0-9]+\.[0-9]+[^/]+/

bash New Fork (PID: 818, Parent: 694)

bash New Fork (PID: 819, Parent: 818)

bash New Fork (PID: 820, Parent: 818)

bash New Fork (PID: 821, Parent: 818)

bash New Fork (PID: 822, Parent: 818)

cat (MD5: d4db1aa640ed6d80a0bd350e72d6fa8e) Arguments: cat

bash New Fork (PID: 823, Parent: 818)

uniq (MD5: cc0b12df22d202dc57b5efc4b5d9f6f4) Arguments: uniq

bash New Fork (PID: 824, Parent: 818)

bash New Fork (PID: 825, Parent: 824)

bash New Fork (PID: 826, Parent: 824)

dirname (MD5: 1d082aa299fbbdc31625e0729e1e5271) Arguments: dirname ThirdPartyNotices.txt

bash New Fork (PID: 827, Parent: 824)

mkdir (MD5: bbbaafd2a4d7dcb9ddd178d814fea708) Arguments: mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/.

bash New Fork (PID: 828, Parent: 824)

cp (MD5: c6c784e59743c03a85e53ac39bf4b1c1) Arguments: cp -R /tmp/dotnet.DUZHkmnca/ThirdPartyNotices.txt /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/ThirdPartyNotices.txt

bash New Fork (PID: 829, Parent: 824)

bash New Fork (PID: 830, Parent: 824)

dirname (MD5: 1d082aa299fbbdc31625e0729e1e5271) Arguments: dirname dotnet

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.76.201.171:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.25.166.183:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49419 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49421 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.68
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.53.25
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /v1/dotnet-install.sh HTTP/1.1Host: dot.netUser-Agent: curl/7.54.0Accept: */*

Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: dot.net
Source: global traffic	DNS traffic detected: DNS query: aka.ms

Source: /usr/bin/curl (PID: 695)	Reads from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 735)	Reads from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 766)	Reads from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 771)	Reads from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 780)	Reads from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 783)	Reads from socket in process: data	Jump to behavior

Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://7-zip.org/sdk.html
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://angular.io/license
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg	String found in binary or memory: http://crl.apple.com/applerootcag3.crl0
Source: preinstall, 00000662.00000334.1.0000000119f0e000.0000000119f37000.r--.sdmp, preinstall, 00000662.00000334.1.000000010d457000.000000010d461000.r--.sdmp, postinstall, 00000685.00000370.1.000000010610f000.0000000106119000.r--.sdmp, postinstall, 00000685.00000370.1.0000000113258000.0000000113281000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg, libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: http://crl.apple.com/root.crl0
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg, libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: http://crl.apple.com/timestamp.crl0
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: .BC.T_Nvks1x.271.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: System.Private.Xml.dll.558.dr, System.Private.Xml.dll.514.dr	String found in binary or memory: http://exslt.org/common
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://llvm.org
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg	String found in binary or memory: http://ocsp.apple.com/ocsp03-applerootcag307
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg	String found in binary or memory: http://ocsp.apple.com/ocsp03-asica4020
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg	String found in binary or memory: http://ocsp.apple.com/ocsp03-devid070
Source: libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: http://ocsp.apple.com/ocsp03-devid080
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: System.Private.Xml.dll.558.dr, System.Private.Xml.dll.514.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://sourceforge.net/projects/slicing-by-8/
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: preinstall, 00000662.00000334.1.0000000119f0e000.0000000119f37000.r--.sdmp, preinstall, 00000662.00000334.1.000000010d457000.000000010d461000.r--.sdmp, postinstall, 00000685.00000370.1.000000010610f000.0000000106119000.r--.sdmp, postinstall, 00000685.00000370.1.0000000113258000.0000000113281000.r--.sdmp, libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: preinstall, 00000662.00000334.1.0000000119f0e000.0000000119f37000.r--.sdmp, preinstall, 00000662.00000334.1.000000010d457000.000000010d461000.r--.sdmp, postinstall, 00000685.00000370.1.000000010610f000.0000000106119000.r--.sdmp, postinstall, 00000685.00000370.1.0000000113258000.0000000113281000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg, libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: http://www.apple.com/appleca0
Source: AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg	String found in binary or memory: http://www.apple.com/certificateauthority/0
Source: preinstall, 00000662.00000334.1.0000000119f0e000.0000000119f37000.r--.sdmp, preinstall, 00000662.00000334.1.000000010d457000.000000010d461000.r--.sdmp, postinstall, 00000685.00000370.1.000000010610f000.0000000106119000.r--.sdmp, postinstall, 00000685.00000370.1.0000000113258000.0000000113281000.r--.sdmp, libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: .BC.T_Nvks1x.271.dr, .BC.T_KBmNT2.271.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.mono-project.com/docs/about-mono/
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.novell.com)
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.ookii.org/software/dialogs/
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.html.
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.ryanjuckett.com/
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: http://www.xamarin.com)
Source: System.Runtime.Serialization.Formatters.dll.558.dr, .BC.T_f7W9g9.271.dr	String found in binary or memory: https://aka.ms/binaryformatter
Source: libhostfxr.dylib.549.dr, dotnet.514.dr	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: libhostfxr.dylib.549.dr	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os
Source: .BC.T_f7W9g9.271.dr, System.Transactions.Local.dll.558.dr, System.IO.IsolatedStorage.dll.558.dr, System.ComponentModel.Annotations.dll.514.dr, System.Net.Http.dll.514.dr, Microsoft.VisualBasic.Core.dll.558.dr, System.Security.AccessControl.dll.514.dr, System.ComponentModel.Annotations.dll.558.dr, System.IO.FileSystem.DriveInfo.dll.558.dr, System.Private.Xml.dll.514.dr, System.Net.HttpListener.dll.514.dr, System.ComponentModel.Primitives.dll.514.dr, System.Net.WebSockets.dll.514.dr, System.IO.FileSystem.Watcher.dll.558.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: libhostfxr.dylib.549.dr, dotnet.514.dr	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: libhostfxr.dylib.549.dr	String found in binary or memory: https://aka.ms/dotnet/download
Source: libhostfxr.dylib.549.dr	String found in binary or memory: https://aka.ms/dotnet/downloadUsage:
Source: libhostfxr.dylib.549.dr	String found in binary or memory: https://aka.ms/dotnet/info
Source: libhostfxr.dylib.549.dr	String found in binary or memory: https://aka.ms/dotnet/sdk-not-found
Source: libhostfxr.dylib.549.dr	String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundFailed
Source: System.Data.Common.dll.514.dr, .BC.T_f7W9g9.271.dr	String found in binary or memory: https://aka.ms/serializationformat-binary-obsolete
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://arxiv.org/pdf/2102.06959.pdf
Source: .BC.T_ysxAdH.271.dr, postinstall	String found in binary or memory: https://dot.net/v1/dotnet-install.sh
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/BurntSushi/aho-corasick
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json/blob/master/LICENSE.md
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/Microsoft/MSBuildLocator
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/Microsoft/RoslynClrHeapAllocationAnalyzer
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/NuGet/NuGet.Client/blob/dev/LICENSE.txt
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/SixLabors/ImageSharp/blob/f4f689ce67ecbcc35cebddba5aacb603e6d1068a/LICENSE
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/SixLabors/ImageSharp/blob/f4f689ce67ecbcc35cebddba5aacb603e6d1068a/src/ImageSharp
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/WojciechMula/sse4-strstr)
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp
Source: .BC.T_Nvks1x.271.dr	String found in binary or memory: https://github.com/dotnet/MQTTnet
Source: .BC.T_Nvks1x.271.dr	String found in binary or memory: https://github.com/dotnet/MQTTnet.git
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/dotnet/aspnetcore/blob/main/LICENSE.txt
Source: System.Net.Requests.dll.558.dr, System.Net.WebClient.dll.558.dr, System.Net.Ping.dll.558.dr, System.Reflection.Emit.Lightweight.dll.514.dr, System.Runtime.CompilerServices.VisualC.dll.514.dr, System.Reflection.Emit.dll.558.dr, System.Resources.Reader.dll.558.dr, System.Net.WebProxy.dll.558.dr, System.IO.FileSystem.Primitives.dll.514.dr, System.Linq.Queryable.dll.558.dr, System.Data.Common.dll.514.dr, System.AppContext.dll.514.dr, System.Web.dll.514.dr, .BC.T_mY9F9q.271.dr, System.Private.Xml.dll.558.dr, System.Runtime.Numerics.dll.514.dr, System.Security.Principal.dll.514.dr, System.Threading.Tasks.Dataflow.dll.558.dr, System.ObjectModel.dll.514.dr, System.Data.DataSetExtensions.dll.558.dr, System.AppContext.dll.558.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: System.Resources.Reader.dll.558.dr, System.Data.DataSetExtensions.dll.558.dr, System.Data.DataSetExtensions.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtime#
Source: System.Xml.XmlDocument.dll.558.dr	String found in binary or memory: https://github.com/dotnet/runtime#I
Source: System.Net.dll.558.dr, System.Net.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtime&-
Source: System.Private.Xml.dll.558.dr, System.Private.Xml.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtime/issues/50820
Source: System.Resources.ResourceManager.dll.558.dr	String found in binary or memory: https://github.com/dotnet/runtime9
Source: System.Xml.Linq.dll.558.dr, System.Xml.Linq.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtimeE
Source: Microsoft.VisualBasic.Core.dll.514.dr, Microsoft.VisualBasic.Core.dll.558.dr	String found in binary or memory: https://github.com/dotnet/runtimeR
Source: System.Security.Cryptography.Encoding.dll.558.dr, System.Security.Cryptography.Encoding.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtimeW
Source: System.Security.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtimeZ
Source: Microsoft.VisualBasic.dll.558.dr, System.Web.dll.514.dr, System.Web.dll.558.dr	String found in binary or memory: https://github.com/dotnet/runtimea
Source: System.Security.AccessControl.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtimed
Source: .BC.T_mY9F9q.271.dr	String found in binary or memory: https://github.com/dotnet/runtimel
Source: System.Threading.Tasks.Extensions.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtimelJ
Source: netstandard.dll.558.dr	String found in binary or memory: https://github.com/dotnet/runtimep
Source: System.Diagnostics.Tools.dll.514.dr	String found in binary or memory: https://github.com/dotnet/runtimes_
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/dotnet/templating/blob/main/build/nuget.exe
Source: .BC.T_IJBzQD.271.dr	String found in binary or memory: https://github.com/icsharpcode/SharpZipLib
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/intel/isa-l/blob/33a2d9484595c2d6516c920ce39a694c144ddf69/crc/crc32_ieee_by4.asm
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/intel/isa-l/blob/33a2d9484595c2d6516c920ce39a694c144ddf69/crc/crc64_ecma_norm_by8
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/lemire/fastmod)
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/lemire/fastrange)
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/madler/zlib
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/microsoft/DirectXMath/blob/master/LICENSE
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/microsoft/msquic/blob/main/LICENSE
Source: System.Data.Common.dll.514.dr	String found in binary or memory: https://github.com/mono/linker/issues/1187
Source: .BC.T_9WjK8k.271.dr, Microsoft.CSharp.dll.514.dr	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: System.Reflection.DispatchProxy.dll.514.dr, Microsoft.VisualBasic.Core.dll.514.dr, Microsoft.VisualBasic.Core.dll.558.dr	String found in binary or memory: https://github.com/mono/linker/issues/1731
Source: Microsoft.CSharp.dll.514.dr	String found in binary or memory: https://github.com/mono/linker/issues/1906.
Source: System.Data.Common.dll.514.dr	String found in binary or memory: https://github.com/mono/linker/issues/1981
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/nigeltao/parse-number-fxx-test-data)
Source: .BC.T_IZ39Jr.271.dr	String found in binary or memory: https://github.com/serilog/serilog-extensions-hosting
Source: .BC.T_IZ39Jr.271.dr	String found in binary or memory: https://github.com/serilog/serilog-extensions-hostingd
Source: .BC.T_RbFfSO.271.dr	String found in binary or memory: https://github.com/serilog/serilog.git
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/ucb-bar/berkeley-softfloat-3
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://github.com/ucb-bar/berkeley-softfloat-3/blob/master/COPYING.txt
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://llvm.org/LICENSE.txt
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://opensource.org/licenses/MIT
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://sindresorhus.com)
Source: preinstall, 00000662.00000334.1.0000000119f0e000.0000000119f37000.r--.sdmp, preinstall, 00000662.00000334.1.000000010d457000.000000010d461000.r--.sdmp, postinstall, 00000685.00000370.1.000000010610f000.0000000106119000.r--.sdmp, postinstall, 00000685.00000370.1.0000000113258000.0000000113281000.r--.sdmp, AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg, libhostfxr.dylib.549.dr, libclrjit.dylib.514.dr, libcoreclr.dylib.558.dr, dotnet.514.dr, libSystem.Net.Security.Native.dylib.558.dr, libSystem.Security.Cryptography.Native.Apple.dylib.558.dr, createdump.514.dr, libSystem.Security.Cryptography.Native.OpenSsl.dylib.514.dr, libSystem.Native.dylib.558.dr, libmscordaccore.dylib.558.dr, libclrjit.dylib.558.dr, libSystem.Native.dylib.514.dr	String found in binary or memory: https://www.apple.com/appleca/0
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: .BC.T_KBmNT2.271.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://www.unicode.org/copyright.html.
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://www.unicode.org/license.html
Source: ThirdPartyNotices.txt.578.dr	String found in binary or memory: https://zlib.net/zlib_license.html

Source: unknown	Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown	Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49418
Source: unknown	Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49391
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49390
Source: unknown	Network traffic detected: HTTP traffic on port 49392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443

Source: /usr/bin/curl (PID: 695)	Writes from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 735)	Writes from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 766)	Writes from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 771)	Writes from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 780)	Writes from socket in process: data	Jump to behavior
Source: /usr/bin/curl (PID: 783)	Writes from socket in process: data	Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.76.201.171:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.25.166.183:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49419 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49421 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Creates a notice file (html or txt) to demand a ransom

Source: /usr/bin/tar	File dropped: /private/tmp/dotnet.DUZHkmnca/ThirdPartyNotices.txt -> instructions. the unsigned division incorporates the"round down" optimization per ridiculous_fish.this is free and unencumbered software. any copyright is dedicated to the public domain.license notice for mimalloc---------------------------mit licensecopyright (c) 2019 microsoft corporation, daan leijenpermission is hereby granted, free of charge, to any person obtaining a copyof this software and associated documentation files (the "software"), to dealin the software without restriction, including without limitation the rightsto use, copy, modify, merge, publish, distribute, sublicense, and/or sellcopies of the software, and to permit persons to whom the software isfurnished to do so, subject to the following conditions:the above copyright notice and this permission notice shall be included in allcopies or substantial portions of the software.the software is provided "as is", without warranty of any kind, express orimplied, including but not limited to the warranties of merchantability			Jump to dropped file
Source: /bin/cp	File dropped: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/ThirdPartyNotices.txt -> instructions. the unsigned division incorporates the"round down" optimization per ridiculous_fish.this is free and unencumbered software. any copyright is dedicated to the public domain.license notice for mimalloc---------------------------mit licensecopyright (c) 2019 microsoft corporation, daan leijenpermission is hereby granted, free of charge, to any person obtaining a copyof this software and associated documentation files (the "software"), to dealin the software without restriction, including without limitation the rightsto use, copy, modify, merge, publish, distribute, sublicense, and/or sellcopies of the software, and to permit persons to whom the software isfurnished to do so, subject to the following conditions:the above copyright notice and this permission notice shall be included in allcopies or substantial portions of the software.the software is provided "as is", without warranty of any kind, express orimplied, including but not limited to the warranties of merchantability			Jump to dropped file

Source: /usr/bin/tar (PID: 787)	HTML file containing JavaScript created: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib			Jump to dropped file
Source: /bin/cp (PID: 815)	HTML file containing JavaScript created: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib			Jump to dropped file

Source: classification engine

Classification label: mal48.rans.evad.macPKG@0/449@4/0

Persistence and Installation Behavior

Writes Mach-O files to hidden directories

Source: /bin/cp (PID: 809)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr/8.0.14/libhostfxr.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/createdump	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	64-bit Mach-O written to hidden directory: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib	Jump to dropped file

Source: /bin/cp (PID: 809)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr/8.0.14/libhostfxr.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/createdump: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file
Source: /bin/cp (PID: 815)	Permissions modified for written 64-bit Mach-O /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib: bits: - usr: rx grp: rx all: rwx	Jump to dropped file

Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd (PID: 628)	Hidden File moved: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.sandbox/.dat.nosync0274.LHA6rM -> /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.sandbox/.SessionUUID	Jump to behavior
Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor (PID: 661)	Hidden File created: /var/db/.dat.nosync0295.Ai2DQE	Jump to behavior
Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor (PID: 661)	Hidden File moved: /var/db/.dat.nosync0295.Ai2DQE -> /var/db/.InstallerTMExcludes.plist	Jump to behavior
Source: /usr/bin/tar (PID: 787)	Hidden File created: shared/Microsoft.NETCore.App/8.0.14/.version	Jump to behavior
Source: /bin/cp (PID: 815)	Hidden File created: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/.version	Jump to behavior

Source: /usr/bin/sudo (PID: 695)	Curl executable: /usr/bin/curl -> curl -sSL https://dot.net/v1/dotnet-install.sh	Jump to behavior
Source: /bin/bash (PID: 735)	Curl executable: /usr/bin/curl -> curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/8.0/dotnet-runtime-osx-x64.tar.gz	Jump to behavior
Source: /bin/bash (PID: 766)	Curl executable: /usr/bin/curl -> curl --head -o /dev/null -w %{http_code} -s --fail https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/dotnet-runtime-8.0.14-osx-x64.tar.gz	Jump to behavior
Source: /bin/bash (PID: 771)	Curl executable: /usr/bin/curl -> curl -s --fail https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/runtime-productVersion.txt	Jump to behavior
Source: /bin/bash (PID: 780)	Curl executable: /usr/bin/curl -> curl --retry 20 --retry-delay 2 --connect-timeout 15 -sSL -f --create-dirs -o /tmp/dotnet.apAJI0d8n https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/dotnet-runtime-8.0.14-osx-x64.tar.gz	Jump to behavior
Source: /bin/bash (PID: 783)	Curl executable: /usr/bin/curl -> curl -sI https://builds.dotnet.microsoft.com/dotnet/Runtime/8.0.14/dotnet-runtime-8.0.14-osx-x64.tar.gz	Jump to behavior

Source: /bin/bash (PID: 743)	Grep executable: /usr/bin/grep -> grep -v 301	Jump to behavior
Source: /bin/bash (PID: 756)	Grep executable: /usr/bin/grep -> grep ://	Jump to behavior
Source: /bin/bash (PID: 760)	Grep executable: /usr/bin/grep -> grep /	Jump to behavior
Source: /bin/bash (PID: 784)	Grep executable: /usr/bin/grep -> grep -i content-length	Jump to behavior
Source: /bin/bash (PID: 789)	Grep executable: /usr/bin/grep -> grep -Eo ^.*/[0-9]+\.[0-9]+[^/]+/	Jump to behavior
Source: /bin/bash (PID: 817)	Grep executable: /usr/bin/grep -> grep -Ev ^.*/[0-9]+\.[0-9]+[^/]+/	Jump to behavior

Source: /bin/bash (PID: 778)	Mkdir executable: /bin/mkdir -> mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet	Jump to behavior
Source: /bin/bash (PID: 808)	Mkdir executable: /bin/mkdir -> mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr	Jump to behavior
Source: /bin/bash (PID: 814)	Mkdir executable: /bin/mkdir -> mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App	Jump to behavior
Source: /bin/bash (PID: 827)	Mkdir executable: /bin/mkdir -> mkdir -p /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/.	Jump to behavior

Source: /bin/bash (PID: 779)	Mktemp executable: /usr/bin/mktemp -> mktemp /tmp/dotnet.XXXXXXXXX	Jump to behavior
Source: /bin/bash (PID: 786)	Mktemp executable: /usr/bin/mktemp -> mktemp -d /tmp/dotnet.XXXXXXXXX	Jump to behavior
Source: /bin/bash (PID: 796)	Mktemp executable: /usr/bin/mktemp -> mktemp -d	Jump to behavior

Source: /bin/bash (PID: 799)	Rm executable: /bin/rm -> rm -f /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile2			Jump to behavior
Source: /bin/bash (PID: 800)	Rm executable: /bin/rm -> rm -rf /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u			Jump to behavior

Source: /bin/bash (PID: 678)	Sudo executable: /usr/bin/sudo -> sudo launchctl unload /Library/LaunchDaemons/com.atera.agent.plist	Jump to behavior
Source: /bin/bash (PID: 680)	Sudo executable: /usr/bin/sudo -> sudo launchctl stop com.atera.agent	Jump to behavior
Source: /bin/bash (PID: 692)	Sudo executable: /usr/bin/sudo -> sudo curl -sSL https://dot.net/v1/dotnet-install.sh	Jump to behavior
Source: /bin/bash (PID: 693)	Sudo executable: /usr/bin/sudo -> sudo bash -s -- -Runtime dotnet -Channel 8.0 -InstallDir /Library/Application Support/com.atera.ateraagent/Agent/.dotnet	Jump to behavior

Source: /bin/bash (PID: 797)

Touch executable: /usr/bin/touch -> touch /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/tmp.nMeqc27u/testfile

Jump to behavior

Source: /usr/bin/sudo (PID: 679)	Launch agent/daemon unloaded: launchctl unload /Library/LaunchDaemons/com.atera.agent.plist			Jump to behavior
Source: /usr/bin/sudo (PID: 681)	Launch agent/daemon stopped: launchctl stop com.atera.agent			Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)

CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Security framework info plist opened: /System/Library/Frameworks/Security.framework/Resources/Info.plist			Jump to behavior
Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd (PID: 628)	Security framework info plist opened: /System/Library/Frameworks/Security.framework/Resources/Info.plist			Jump to behavior

Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/dotnet	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/host/fxr/8.0.14/libhostfxr.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/createdump	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	File written: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib	Jump to dropped file
Source: /bin/cp (PID: 809)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr/8.0.14/libhostfxr.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/createdump	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib	Jump to dropped file
Source: /bin/cp (PID: 815)	File written: /Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib	Jump to dropped file

Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/dotnet	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/host/fxr/8.0.14/libhostfxr.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/createdump	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib	Jump to dropped file
Source: /usr/bin/tar (PID: 787)	64-bit Mach-O written to tmp path: /private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib	Jump to dropped file

Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd (PID: 628)

File written: /private/var/run/.dat.nosync0274.qgOXVG -> contains PID 628

Jump to dropped file

Source: /bin/bash (PID: 739)	Awk executable: /usr/bin/awk -> awk $1 ~ /^HTTP/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 749)	Awk executable: /usr/bin/awk -> awk $1 ~ /^Location/{print $2}	Jump to behavior
Source: /bin/bash (PID: 785)	Awk executable: /usr/bin/awk -> awk { num = $2 + 0 print num }	Jump to behavior

Source: /bin/bash (PID: 742)	Sed executable: /usr/bin/sed -> sed $d			Jump to behavior
Source: /bin/bash (PID: 757)	Sed executable: /usr/bin/sed -> sed -es,^$.://$.,\1,g			Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd (PID: 628)	Binary plist file created: /private/var/db/receipts/com.atera.agent.plist	Jump to dropped file
Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd (PID: 628)	XML plist file created: /Library/Receipts/InstallHistory.plist	Jump to dropped file
Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor (PID: 661)	XML plist file created: /private/var/db/.dat.nosync0295.Ai2DQE	Jump to dropped file

Source: /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove (PID: 684)

Launch daemon created File moved: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/LaunchDaemons/com.atera.agent.plist -> /Library/LaunchDaemons/com.atera.agent.plist

Jump to behavior

Source: libSystem.Native.dylib.514.dr	Binary or memory string: vmhgfs
Source: libSystem.Native.dylib.514.dr	Binary or memory string: Unknown socket error%sadfsaffsanoninodeapfsaufsautofsbefsbdevfsbpf_fsbinfmt_miscbootfsbtrfscephcgroupfscgroup2fscifscodacoherentconfigfscpusetcramfsctfsdevfsdevptsecryptfsexofsext2_oldext2ext3ext4f2fsfdfhgfsfusegfs2gpfshpfshugetlbfsinotifyfsisofsjffsjffs2kafslofslogfslustreminix_oldminixminix2minix2v2minix3mntfsmqueuemsdosnfsdnilfsnovellntfsobjfsocfs2openpromomfsoverlayfspanfspipefsprocpstorefsqnx4qnx6ramfsreiserfsromfsrootfsrpc_pipefssambasdcardfssecurityfssffssmb2sockfssquashfssysfssysv2sysv4tmpfsubifsufscigamufs2usbdevicev9fsvboxfsvmhgfsvxfsvzfsxenfsxenixudevnet.inet.tcp.statsnet.inet.tcp.pcbcountnet.inet.ip.statsnet.inet.ip.ttlnet.inet.ip.forwardingnet.inet.udp.statsnet.inet.udp.pcbcountnet.inet.icmp.statsnet.inet6.icmp6.statsnet.inet.tcp.pcblistnet.inet.udp.pcblist%s %s %saarch64arm64armv6armx86_64amd64sysctl.proc_translateds390xppc64leloongarch64riscv64libc/usr/lib/libc.dylib.NET SigHandler=B
Source: libSystem.Native.dylib.558.dr, System.IO.FileSystem.DriveInfo.dll.558.dr, libSystem.Native.dylib.514.dr	Binary or memory string: fhgfs

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl read request: hw.cpu_freq (6.15)	Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl read request: hw.ncpu (6.3)	Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl read request: hw.memsize (6.24)	Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl read request: hw.availcpu (6.25)	Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/bin/uname (PID: 704)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/bin/uname (PID: 704)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/bin/uname (PID: 711)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/bin/uname (PID: 711)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/bin/uname (PID: 730)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/bin/uname (PID: 730)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /tmp/PKInstallSandbox.rGQEHd/Scripts/com.atera.agent.ul7Ws7/preinstall (PID: 662)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /tmp/PKInstallSandbox.rGQEHd/Scripts/com.atera.agent.ul7Ws7/postinstall (PID: 685)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 694)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/uname (PID: 704)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/uname (PID: 711)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/uname (PID: 730)	Sysctl requested: kern.hostname (1.10)	Jump to behavior

Source: /usr/bin/open (PID: 622)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 623)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior

Source: /bin/bash (PID: 704)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /bin/bash (PID: 711)	Uname executable: /usr/bin/uname -> uname	Jump to behavior
Source: /bin/bash (PID: 730)	Uname executable: /usr/bin/uname -> uname	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 LC_LOAD_DYLIB Addition	1 LC_LOAD_DYLIB Addition	1 Hide Artifacts	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Launchctl	1 Launch Daemon	1 Launch Daemon	11 Hidden Files and Directories	LSASS Memory	41 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Sudo and Sudo Caching	1 Indicator Removal	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Sudo and Sudo Caching	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Source	Detection	Scanner
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.CSharp.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.Core.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Primitives.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Registry.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.AppContext.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Buffers.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Concurrent.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Immutable.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.NonGeneric.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Specialized.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Annotations.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.DataAnnotations.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.EventBasedAsync.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Primitives.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.TypeConverter.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Configuration.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Console.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Core.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.Common.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.DataSetExtensions.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Contracts.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Debug.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.DiagnosticSource.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.FileVersionInfo.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Process.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.StackTrace.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.TextWriterTraceListener.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Tools.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.TraceSource.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Tracing.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Drawing.Primitives.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Drawing.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Dynamic.Runtime.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Formats.Asn1.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Formats.Tar.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.Calendars.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.Extensions.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.Brotli.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.FileSystem.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.ZipFile.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.AccessControl.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.DriveInfo.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.Primitives.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.Watcher.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.IsolatedStorage.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.MemoryMappedFiles.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Pipes.AccessControl.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Pipes.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.UnmanagedMemoryStream.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Expressions.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Parallel.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Queryable.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Memory.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Http.Json.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Http.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.HttpListener.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Mail.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.NameResolution.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.NetworkInformation.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Ping.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Primitives.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Quic.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Requests.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Security.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.ServicePoint.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Sockets.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebClient.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebHeaderCollection.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebProxy.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebSockets.Client.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebSockets.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Numerics.Vectors.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Numerics.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ObjectModel.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.CoreLib.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.DataContractSerialization.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.Uri.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.Xml.Linq.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.Xml.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.DispatchProxy.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.ILGeneration.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.Lightweight.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Extensions.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Metadata.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Primitives.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.TypeExtensions.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Resources.Reader.dll	0%	ReversingLabs
/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Resources.ResourceManager.dll	0%	ReversingLabs

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.novell.com)	0%	Avira URL Cloud	safe
http://www.xamarin.com)	0%	Avira URL Cloud	safe
https://www.newtonsoft.com/json	0%	Avira URL Cloud	safe
http://www.ookii.org/software/dialogs/	0%	Avira URL Cloud	safe
https://zlib.net/zlib_license.html	0%	Avira URL Cloud	safe
http://www.opensource.org/licenses/bsd-license.html.	0%	Avira URL Cloud	safe
http://www.mono-project.com/docs/about-mono/	0%	Avira URL Cloud	safe
https://sindresorhus.com)	0%	Avira URL Cloud	safe
http://exslt.org/common	0%	Avira URL Cloud	safe
http://www.ryanjuckett.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dot.net	20.76.201.171	true	false	high
aka.ms	184.25.166.183	true	false	high
h3.apis.apple.map.fastly.net	151.101.3.6	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://dot.net/v1/dotnet-install.sh	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mono/linker/issues/1731	System.Reflection.DispatchProxy.dll.514.dr, Microsoft.VisualBasic.Core.dll.514.dr, Microsoft.VisualBasic.Core.dll.558.dr	false		high
https://github.com/dotnet/templating/blob/main/build/nuget.exe	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/dotnet/runtime9	System.Resources.ResourceManager.dll.558.dr	false		high
https://aka.ms/dotnet/info	libhostfxr.dylib.549.dr	false		high
https://github.com/lemire/fastrange)	ThirdPartyNotices.txt.578.dr	false		high
http://www.novell.com)	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime&-	System.Net.dll.558.dr, System.Net.dll.514.dr	false		high
https://github.com/dotnet/runtimeE	System.Xml.Linq.dll.558.dr, System.Xml.Linq.dll.514.dr	false		high
https://llvm.org/LICENSE.txt	ThirdPartyNotices.txt.578.dr	false		high
https://opensource.org/licenses/MIT	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/aappleby/smhasher/blob/master/src/MurmurHash3.cpp	ThirdPartyNotices.txt.578.dr	false		high
https://www.newtonsoft.com/json	.BC.T_KBmNT2.271.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/app-launch-failed	libhostfxr.dylib.549.dr, dotnet.514.dr	false		high
https://github.com/dotnet/runtimes_	System.Diagnostics.Tools.dll.514.dr	false		high
http://llvm.org	ThirdPartyNotices.txt.578.dr	false		high
http://creativecommons.org/publicdomain/zero/1.0/	ThirdPartyNotices.txt.578.dr	false		high
http://www.mono-project.com/docs/about-mono/	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
http://www.xamarin.com)	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/sdk-not-foundFailed	libhostfxr.dylib.549.dr	false		high
https://aka.ms/dotnet-core-applaunch?	libhostfxr.dylib.549.dr, dotnet.514.dr	false		high
https://github.com/dotnet/runtime	System.Net.Requests.dll.558.dr, System.Net.WebClient.dll.558.dr, System.Net.Ping.dll.558.dr, System.Reflection.Emit.Lightweight.dll.514.dr, System.Runtime.CompilerServices.VisualC.dll.514.dr, System.Reflection.Emit.dll.558.dr, System.Resources.Reader.dll.558.dr, System.Net.WebProxy.dll.558.dr, System.IO.FileSystem.Primitives.dll.514.dr, System.Linq.Queryable.dll.558.dr, System.Data.Common.dll.514.dr, System.AppContext.dll.514.dr, System.Web.dll.514.dr, .BC.T_mY9F9q.271.dr, System.Private.Xml.dll.558.dr, System.Runtime.Numerics.dll.514.dr, System.Security.Principal.dll.514.dr, System.Threading.Tasks.Dataflow.dll.558.dr, System.ObjectModel.dll.514.dr, System.Data.DataSetExtensions.dll.558.dr, System.AppContext.dll.558.dr	false		high
http://7-zip.org/sdk.html	ThirdPartyNotices.txt.578.dr	false		high
http://www.ryanjuckett.com/	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtimelJ	System.Threading.Tasks.Extensions.dll.514.dr	false		high
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os	libhostfxr.dylib.549.dr	false		high
https://github.com/dotnet/runtimeW	System.Security.Cryptography.Encoding.dll.558.dr, System.Security.Cryptography.Encoding.dll.514.dr	false		high
https://aka.ms/dotnet-warnings/	.BC.T_f7W9g9.271.dr, System.Transactions.Local.dll.558.dr, System.IO.IsolatedStorage.dll.558.dr, System.ComponentModel.Annotations.dll.514.dr, System.Net.Http.dll.514.dr, Microsoft.VisualBasic.Core.dll.558.dr, System.Security.AccessControl.dll.514.dr, System.ComponentModel.Annotations.dll.558.dr, System.IO.FileSystem.DriveInfo.dll.558.dr, System.Private.Xml.dll.514.dr, System.Net.HttpListener.dll.514.dr, System.ComponentModel.Primitives.dll.514.dr, System.Net.WebSockets.dll.514.dr, System.IO.FileSystem.Watcher.dll.558.dr	false		high
https://github.com/SixLabors/ImageSharp/blob/f4f689ce67ecbcc35cebddba5aacb603e6d1068a/LICENSE	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/dotnet/runtimeZ	System.Security.dll.514.dr	false		high
https://github.com/BurntSushi/aho-corasick	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/JamesNK/Newtonsoft.Json/blob/master/LICENSE.md	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/dotnet/runtimed	System.Security.AccessControl.dll.514.dr	false		high
https://aka.ms/serializationformat-binary-obsolete	System.Data.Common.dll.514.dr, .BC.T_f7W9g9.271.dr	false		high
https://github.com/dotnet/runtimea	Microsoft.VisualBasic.dll.558.dr, System.Web.dll.514.dr, System.Web.dll.558.dr	false		high
http://www.ookii.org/software/dialogs/	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/sdk-not-found	libhostfxr.dylib.549.dr	false		high
https://aka.ms/binaryformatter	System.Runtime.Serialization.Formatters.dll.558.dr, .BC.T_f7W9g9.271.dr	false		high
https://github.com/Microsoft/MSBuildLocator	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/dotnet/aspnetcore/blob/main/LICENSE.txt	ThirdPartyNotices.txt.578.dr	false		high
https://zlib.net/zlib_license.html	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://github.com/microsoft/msquic/blob/main/LICENSE	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/JamesNK/Newtonsoft.Json	.BC.T_KBmNT2.271.dr	false		high
https://github.com/dotnet/runtimeR	Microsoft.VisualBasic.Core.dll.514.dr, Microsoft.VisualBasic.Core.dll.558.dr	false		high
https://github.com/dotnet/MQTTnet.git	.BC.T_Nvks1x.271.dr	false		high
https://github.com/madler/zlib	ThirdPartyNotices.txt.578.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	ThirdPartyNotices.txt.578.dr	false		high
http://www.opensource.org/licenses/bsd-license.html.	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://github.com/WojciechMula/sse4-strstr)	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/ucb-bar/berkeley-softfloat-3	ThirdPartyNotices.txt.578.dr	false		high
https://www.unicode.org/license.html	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/serilog/serilog.git	.BC.T_RbFfSO.271.dr	false		high
https://github.com/dotnet/runtime#I	System.Xml.XmlDocument.dll.558.dr	false		high
https://sindresorhus.com)	ThirdPartyNotices.txt.578.dr	false	Avira URL Cloud: safe	unknown
https://github.com/icsharpcode/SharpZipLib	.BC.T_IJBzQD.271.dr	false		high
http://exslt.org/common	System.Private.Xml.dll.558.dr, System.Private.Xml.dll.514.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mono/linker/issues/1416.	.BC.T_9WjK8k.271.dr, Microsoft.CSharp.dll.514.dr	false		high
https://github.com/dotnet/MQTTnet	.BC.T_Nvks1x.271.dr	false		high
https://github.com/serilog/serilog-extensions-hostingd	.BC.T_IZ39Jr.271.dr	false		high
https://github.com/dotnet/runtimel	.BC.T_mY9F9q.271.dr	false		high
http://opensource.org/licenses/MIT	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/NuGet/NuGet.Client/blob/dev/LICENSE.txt	ThirdPartyNotices.txt.578.dr	false		high
http://angular.io/license	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/intel/isa-l/blob/33a2d9484595c2d6516c920ce39a694c144ddf69/crc/crc32_ieee_by4.asm	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/nigeltao/parse-number-fxx-test-data)	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/ucb-bar/berkeley-softfloat-3/blob/master/COPYING.txt	ThirdPartyNotices.txt.578.dr	false		high
http://james.newtonking.com/projects/json	.BC.T_KBmNT2.271.dr	false		high
https://github.com/microsoft/DirectXMath/blob/master/LICENSE	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/dotnet/runtimep	netstandard.dll.558.dr	false		high
https://aka.ms/dotnet/downloadUsage:	libhostfxr.dylib.549.dr	false		high
https://github.com/Microsoft/RoslynClrHeapAllocationAnalyzer	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/SixLabors/ImageSharp/blob/f4f689ce67ecbcc35cebddba5aacb603e6d1068a/src/ImageSharp	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/mono/linker/issues/1981	System.Data.Common.dll.514.dr	false		high
https://arxiv.org/pdf/2102.06959.pdf	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/lemire/fastmod)	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/dotnet/runtime#	System.Resources.Reader.dll.558.dr, System.Data.DataSetExtensions.dll.558.dr, System.Data.DataSetExtensions.dll.514.dr	false		high
https://github.com/mono/linker/issues/1906.	Microsoft.CSharp.dll.514.dr	false		high
http://schemas.xmlsoap.org/wsdl/	System.Private.Xml.dll.558.dr, System.Private.Xml.dll.514.dr	false		high
https://www.newtonsoft.com/jsonschema	.BC.T_KBmNT2.271.dr	false		high
https://github.com/dotnet/runtime/issues/50820	System.Private.Xml.dll.558.dr, System.Private.Xml.dll.514.dr	false		high
http://sourceforge.net/projects/slicing-by-8/	ThirdPartyNotices.txt.578.dr	false		high
https://github.com/serilog/serilog-extensions-hosting	.BC.T_IZ39Jr.271.dr	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	.BC.T_KBmNT2.271.dr	false		high
https://github.com/intel/isa-l/blob/33a2d9484595c2d6516c920ce39a694c144ddf69/crc/crc64_ecma_norm_by8	ThirdPartyNotices.txt.578.dr	false		high
https://www.unicode.org/copyright.html.	ThirdPartyNotices.txt.578.dr	false		high
https://aka.ms/dotnet/download	libhostfxr.dylib.549.dr	false		high
https://github.com/mono/linker/issues/1187	System.Data.Common.dll.514.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.76.201.171	dot.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.31.53.25	unknown	United States	16625	AKAMAI-ASUS	false
184.25.166.183	aka.ms	United States	9498	BBIL-APBHARTIAirtelLtdIN	false
151.101.3.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
151.101.195.6	unknown	United States	54113	FASTLYUS	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.76.201.171	1AIemYSAZy.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	outlook2.com/administrator/
151.101.3.6	Chrome	Get hash	malicious	AMOS Stealer	Browse
	http://www.citibank2.com/citibank/citi/index	Get hash	malicious	Unknown	Browse
	AvayaWorkplaceMacOS-3.38.0.147.18.dmg	Get hash	malicious	Unknown	Browse
	https://jok.darfeistud.ru/n0raBLCJ/	Get hash	malicious	Unknown	Browse
	https://vdot.virginia-ticketrb.xin/us/	Get hash	malicious	Unknown	Browse
	TotalAV.dmg	Get hash	malicious	Unknown	Browse
	Factura.pdf	Get hash	malicious	Unknown	Browse
	Chrome_7.13.dmg-Malware.dmg	Get hash	malicious	AMOS Stealer	Browse
	https://u1.tightlyreporter.shop/sosalkino.mov	Get hash	malicious	Unknown	Browse
	https://email.m.teachable.com/c/eJwsjjmO7CAYBk8DoQUfZgsIXuJrtH4WP9DYsgVMn3_kVsdVKlUO0RTyvARplYO2UjleTmrHq5dU2j1fLQcGSOu8kMY5zwBeg4_KRMRd7xnaU8YaNZHNWpTVi2R4CxDQQiohrYR0SwasszBxjzkqZdgqzmUWSpXiUZZ0nfwIdc57MPWPYWPYcm-jzkb5PR_OsNHvrPwsY9D_8j1TqzBeq2erh5N6esLUf65-f6Ij1es6vjIUrBUf-R3wFwAA__9VN0p8#a2FzcGFyYXNrckB1bml0eTNkLmNvbQ==	Get hash	malicious	Unknown	Browse
184.31.53.25	Chrome	Get hash	malicious	AMOS Stealer	Browse
151.101.195.6	http://www.citibank2.com/citibank/citi/index	Get hash	malicious	Unknown	Browse
	https://jok.darfeistud.ru/n0raBLCJ/	Get hash	malicious	Unknown	Browse
	https://vdot.virginia-ticketrb.xin/us	Get hash	malicious	Unknown	Browse
	TotalAV.dmg	Get hash	malicious	Unknown	Browse
	https://DvRg.atbuovpkz.com/TYjSz/	Get hash	malicious	Unknown	Browse
	Factura.pdf	Get hash	malicious	Unknown	Browse
	https://streetfurniture.com/r-u-ok/	Get hash	malicious	Unknown	Browse
	Chrome_7.13.dmg-Malware.dmg	Get hash	malicious	AMOS Stealer	Browse
	Chrome	Get hash	malicious	AMOS Stealer	Browse
	https://share-na2.hsforms.com/1PjEWHU0rTgy9Ph9sIQQEsg403mgg	Get hash	malicious	Unknown	Browse
184.25.166.183	Nezur.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h3.apis.apple.map.fastly.net	http://www.citibank2.com/citibank/citi/index	Get hash	malicious	Unknown	Browse	151.101.195.6
	AvayaWorkplaceMacOS-3.38.0.147.18.dmg	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://jok.darfeistud.ru/n0raBLCJ/	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://vdot.virginia-ticketrb.xin/us	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://vdot.virginia-ticketrb.xin/us/	Get hash	malicious	Unknown	Browse	151.101.67.6
	TotalAV.dmg	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://DvRg.atbuovpkz.com/TYjSz/	Get hash	malicious	Unknown	Browse	151.101.131.6
	Factura.pdf	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://streetfurniture.com/r-u-ok/	Get hash	malicious	Unknown	Browse	151.101.195.6
	Chrome_7.13.dmg-Malware.dmg	Get hash	malicious	AMOS Stealer	Browse	151.101.131.6
aka.ms	https://aka.ms/getTSS	Get hash	malicious	Unknown	Browse	173.223.118.95
	ID_60232912649455456988.eml	Get hash	malicious	HTMLPhisher	Browse	72.246.170.70
	(No subject) (1).eml	Get hash	malicious	Unknown	Browse	92.122.18.57
	(No subject) (1).eml	Get hash	malicious	Unknown	Browse	2.20.158.181
	SecuriteInfo.com.Win64.Trojan.Agent.3CB6HA.7357.22454.exe	Get hash	malicious	Unknown	Browse	104.123.42.57
	GlxMassive.exe	Get hash	malicious	Unknown	Browse	104.119.110.121
	(No subject).eml	Get hash	malicious	Unknown	Browse	92.123.22.10
	UFMp7JcgA2.exe	Get hash	malicious	GhostRat	Browse	23.32.221.157
	14_49 PM.eml	Get hash	malicious	Unknown	Browse	92.122.18.57
	14_30 PM.eml	Get hash	malicious	Unknown	Browse	92.123.45.160

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	http://allstareventsmiami.com	Get hash	malicious	Unknown	Browse	92.123.12.13
	Spacey Sun 11.12.411.exe	Get hash	malicious	Vidar	Browse	23.57.90.79
	https://www.google.co.zm/url?q=https%3A%2F%2Fembalagenspontual.com%2F.dnd%2F&sa=D&sntz=1&usg=AOvVaw2fQzlrSA6WjuVq4o5C-GZh#?470265860475745Family=X2NlYzY3QG5hc2hpbnRsLmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	92.123.12.186
	Chrome	Get hash	malicious	AMOS Stealer	Browse	184.31.53.25
	http://188.114.96.0	Get hash	malicious	Unknown	Browse	2.23.65.88
	Quotation.xls	Get hash	malicious	Unknown	Browse	23.60.203.209
	http://188.114.97.3	Get hash	malicious	Unknown	Browse	104.73.230.208
	http://188.114.96.3	Get hash	malicious	Unknown	Browse	104.73.230.208
	Quotation.xls	Get hash	malicious	Unknown	Browse	23.199.214.10
	RV Please verify your email preferences.msg	Get hash	malicious	Unknown	Browse	23.60.203.209
BBIL-APBHARTIAirtelLtdIN	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	182.73.94.192
	nabx86.elf	Get hash	malicious	Unknown	Browse	125.20.166.169
	mpsl.elf	Get hash	malicious	Mirai	Browse	23.211.224.113
	nabx86.elf	Get hash	malicious	Unknown	Browse	184.26.54.85
	jklm68k.elf	Get hash	malicious	Unknown	Browse	23.211.211.83
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	203.101.2.158
	morte.arm.elf	Get hash	malicious	Unknown	Browse	203.101.87.145
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	203.101.16.31
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	203.101.39.207
	morte.sh4.elf	Get hash	malicious	Unknown	Browse	203.101.39.208
MICROSOFT-CORP-MSN-AS-BLOCKUS	Spacey Sun 11.12.411.exe	Get hash	malicious	Vidar	Browse	204.79.197.203
	http://188.114.96.0	Get hash	malicious	Unknown	Browse	13.107.42.14
	VM Orger Acknowledged.zip	Get hash	malicious	Unknown	Browse	52.109.76.144
	Quotation.xls	Get hash	malicious	Unknown	Browse	13.89.179.8
	http://188.114.97.3	Get hash	malicious	Unknown	Browse	13.107.42.14
	Quotation.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	http://188.114.96.3	Get hash	malicious	Unknown	Browse	13.107.42.14
	Quotation.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://boaoni-001-site1.ktempurl.com/	Get hash	malicious	Unknown	Browse	52.247.36.244
	RV Please verify your email preferences.msg	Get hash	malicious	Unknown	Browse	52.109.32.39
FASTLYUS	https://www.google.co.zm/url?q=https%3A%2F%2Fembalagenspontual.com%2F.dnd%2F&sa=D&sntz=1&usg=AOvVaw2fQzlrSA6WjuVq4o5C-GZh#?470265860475745Family=X2NlYzY3QG5hc2hpbnRsLmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://fortuneurl.com/qdQgK	Get hash	malicious	Unknown	Browse	151.101.194.137
	Chrome	Get hash	malicious	AMOS Stealer	Browse	151.101.67.6
	http://188.114.96.0	Get hash	malicious	Unknown	Browse	151.101.65.229
	https://encryption-marinha.jkndfuzv.ru/PtM2i/$nadia.sofia.rijo@marinha.pt	Get hash	malicious	Unknown	Browse	185.199.108.133
	VM Orger Acknowledged.zip	Get hash	malicious	Unknown	Browse	151.101.66.137
	http://188.114.97.3	Get hash	malicious	Unknown	Browse	151.101.65.140
	http://188.114.96.3	Get hash	malicious	Unknown	Browse	151.101.1.140
	https://unifranckm.weebly.com	Get hash	malicious	Unknown	Browse	151.101.1.46
	https://mietamasklogiene.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	151.101.1.140

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5c118da645babe52f060d0754256a73c	Chrome	Get hash	malicious	AMOS Stealer	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	AvayaWorkplaceMacOS-3.38.0.147.18.dmg	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	https://jok.darfeistud.ru/n0raBLCJ/	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	https://vdot.virginia-ticketrb.xin/us	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	https://vdot.virginia-ticketrb.xin/us/	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	TotalAV.dmg	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	https://DvRg.atbuovpkz.com/TYjSz/	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	Factura.pdf	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	https://streetfurniture.com/r-u-ok/	Get hash	malicious	Unknown	Browse	151.101.3.6 151.101.195.6 151.101.67.6
	Chrome_7.13.dmg-Malware.dmg	Get hash	malicious	AMOS Stealer	Browse	151.101.3.6 151.101.195.6 151.101.67.6
a7a5e32c2ca29907256b5de4fbdf61ed	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	184.25.166.183 20.76.201.171
	extracted-pkg.ziphttps://fluencydirect-distro.s3.amazonaws.com/releases.macOS/FluencyDirect-11.0.10.40.pkg	Get hash	malicious	Unknown	Browse	184.25.166.183 20.76.201.171
	Aunteficator-installer-1it5dZOj.pkg	Get hash	malicious	Unknown	Browse	184.25.166.183 20.76.201.171
	MacKeeper.6.7.1.pkg	Get hash	malicious	Unknown	Browse	184.25.166.183 20.76.201.171

Process:	/bin/cp
File Type:	Unicode text, UTF-8 text, with very long lines (755)
Category:	dropped
Size (bytes):	94355
Entropy (8bit):	5.215380552271277
Encrypted:	false
SSDEEP:	1536:oV1VXrAatwbImlxJBD2XbUntFRavzWCHr9N4rlKS7SIuVZ1d6iA1QGdVbU9erlNc:oV1Jr/8l7BqAFQvaqrIr8ZVArerlCpSh
MD5:	94D8370133696C4CA9F8B09E82CE7B65
SHA1:	BFD81CE77A8F92D80077180658A8DEEBC007F887
SHA-256:	FB47C97D2919D9584F25564058F973DE424DA8B500D51B46E406391C6E9ADCA6
SHA-512:	42267A7F2A361B94D7205E7D8D125928F58C8BF80DF876345FF1A5B8D247B6852E01A373A1E28F0BD146A75136B190089CF46A690A3D89E55BACED3A9CFBE558
Malicious:	true
Reputation:	low
Preview:	.NET Runtime uses third-party libraries or other resources that may be.distributed under licenses different than the .NET Runtime software...In the event that we accidentally failed to list a required notice, please.bring it to our attention. Post an issue or email us:.. dotnet@microsoft.com..The attached notices are provided for information only...License notice for ASP.NET.-------------------------------..Copyright (c) .NET Foundation. All rights reserved..Licensed under the Apache License, Version 2.0...Available at.https://github.com/dotnet/aspnetcore/blob/main/LICENSE.txt..License notice for Slicing-by-8.-------------------------------..http://sourceforge.net/projects/slicing-by-8/..Copyright (c) 2004-2006 Intel Corporation - All Rights Reserved...This software program is licensed subject to the BSD License, available at.http://www.opensource.org/licenses/bsd-license.html...License notice for Unicode data.-------------------------------..https://www.unicode.org/license.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr/8.0.14/libhostfxr.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	403456
Entropy (8bit):	6.054297017429264
Encrypted:	false
SSDEEP:	6144:AD4khGL0OoQDAGnd7VxDO5d7rUReW6o/Iv3dG0weA4cNkB50:AEGtOoAnd7V1U7rUR+v3dGrm5
MD5:	1C28E7D994D5ECC1B72A30E917BA8C47
SHA1:	E14C084FB13D94269ED67D43C22996C256387E26
SHA-256:	A7742CC60E52E2072BDB0CB6AD250DEE7355F22AB00573A899157CAA69D0557C
SHA-512:	90D36ED10AAA8184BC236739EA3CF236E95C49FC33F2DE493ECDDEA1D57F88CC05EAE5E1BB569BE99509F764B92195908ADD149F5A21DA6A48A11C2300254F21
Malicious:	true
Reputation:	low
Preview:	....................(...............(...__TEXT..........................................................__text..........__TEXT..........`.......!#......`...............................__stubs.........__TEXT...........6...............6..............................__gcc_except_tab__TEXT..........d9......l$......d9..............................__cstring.......__TEXT...........].......B.......]..............................__const.........__TEXT.................m......................................__unwind_info...__TEXT..........`...............`...................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST............P...........................{...........__mod_init_func.__DATA_CONST....P...............P...............................__const.........__DATA_CONST....`...............`.......................................__DATA...................@...............@......................__data..........__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/.version

Download File

Process:	/bin/cp
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	3.9371795021836387
Encrypted:	false
SSDEEP:	3:JQoGam2U3NdSJ:OaKYJ
MD5:	0321B8DC4DB46BE37ACA15CD74389CE3
SHA1:	B647C035F83F9A4405D2B08689077A54628163EF
SHA-256:	F123C77A26CB846F50C9C8836F2808860A19866C94D926A7ADBAA069F73DDAF8
SHA-512:	5733AE2C7DB77F4EB96D2C69342D18FBE005851D157C9A16AA0CC3471BC4C93203F2A5F90C6BDBD8BC2022D3B0385A28D7D69BFF734BA20B754BD5CB5FFBE885
Malicious:	false
Reputation:	low
Preview:	1584e493603cfc4e9b36b77d6d4afe97de6363f9.8.0.14.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.CSharp.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	806912
Entropy (8bit):	6.860811981292832
Encrypted:	false
SSDEEP:	24576:R+fGvVDWdtBruWQUtBfH3u9yHeBpRGkQss:R+fGVDWdtBZthH3u9yHerRGkQ
MD5:	485E81D860F1C892817D4E39295A224D
SHA1:	79B270EE5CBF63B418AB6114BEB192C12E0AADBA
SHA-256:	05CD4CFFD2C58DC43878A37408EEEDCB1A0D430AC1E9C062AD64DF5888BBB51F
SHA-512:	5146C0B04C25F0B0122E64EE5C47F99455BAC9213C5FE36269071458C46F3516FFDDE847B3AF0D1FEF4A356944F866002B892421896AF9AB07A0D321CCE65262
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....t...................................................P............`...@......@............... ..................................d...H....B...........@..t...P...T...........................................................h...H............text...\|r.......t.................. ..`.data........v.......v..............@....reloc..t....@.......@..............@..B............................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...C.S.h.a.r.p.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....M.i.c.r.o.s.o.f.t...

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json

Download File

Process:	/bin/cp
File Type:	JSON data
Category:	dropped
Size (bytes):	29252
Entropy (8bit):	4.18849947968303
Encrypted:	false
SSDEEP:	384:2Bvm0M7HqawqACXmT5ba9iCJ2splCefqVrKjqRU/AJ4K:2UP+F
MD5:	BD081E0C99C97038C18EDB0E6348430B
SHA1:	E69184260280F2D590F3A3D85C52E75AA92D28B6
SHA-256:	881C19DF65042A52FFBC3BEEB1B1D95D351BC0028F9F05FE6CFCC04C8F4E2FF7
SHA-512:	7054A1C7A9AACF31C9C18FB864D100E09984F2A8079F53442FE6A1F4A83A7EA2C993CD6CBA0586209EBE057F9F952CBAF283549995627F4ADA48D374D17A132D
Malicious:	false
Reputation:	low
Preview:	{. "runtimeTarget": {. "name": ".NETCoreApp,Version=v8.0/osx-x64",. "signature": "". },. "compilationOptions": {},. "targets": {. ".NETCoreApp,Version=v8.0": {},. ".NETCoreApp,Version=v8.0/osx-x64": {. "Microsoft.NETCore.App.Runtime.osx-x64/8.0.14": {. "runtime": {. "System.Private.CoreLib.dll": {. "assemblyVersion": "8.0.0.0",. "fileVersion": "8.0.1425.11118". },. "Microsoft.VisualBasic.dll": {. "assemblyVersion": "10.0.0.0",. "fileVersion": "8.0.1425.11118". },. "Microsoft.Win32.Primitives.dll": {. "assemblyVersion": "8.0.0.0",. "fileVersion": "8.0.1425.11118". },. "mscorlib.dll": {. "assemblyVersion": "4.0.0.0",. "fileVersion": "8.0.1425.11118". },. "netstandard.dll": {. "assemblyVersion": "2.1.0.0",. "fileVersion": "8.0.1425.11118". },. "System.AppC

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.runtimeconfig.json

Download File

Process:	/bin/cp
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	3.951772222577167
Encrypted:	false
SSDEEP:	3:Kn/m/FzDI/pAt9FCY:K/W6hAUY
MD5:	6185B156B8A7C4A61D9A801AAA9A10D2
SHA1:	74AD292B4B1863E38E683D5E3FFAFD9EEF2F9E94
SHA-256:	4A798DA45BC138AE224341FEEBF984C9E330A4BEE2EBB7A821505D95D17124FB
SHA-512:	9B0143B8512B4909DCF4DD2F7FB429F866E104D41BB21BE48015E6C502C66EF723EC774D55912AA9D138CDB7C0FDA021068B261146DE84EA45E32C7819A2E038
Malicious:	false
Reputation:	low
Preview:	{. "runtimeOptions": {. "tfm": "net8.0". }.}

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.Core.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1207808
Entropy (8bit):	6.813494276237294
Encrypted:	false
SSDEEP:	12288:jfzvbVQWelLwt/L0pOQ2VijXpzzORAyK1xASX3DIkvY+uzmW6UFCrqABPJqWsVb/:zzveWowz0X1X7Ln1v6guAkanOF
MD5:	31874264F7DCD413F70662600B359B7B
SHA1:	8AC78D2E645F46A28BCA89BC323B59921BD26BA2
SHA-256:	E2D66800846ABD20A7D74CE296FF46DB43E10EA7C203336F9F45A2D784158119
SHA-512:	3E0585B62FC7A457B3361D0A4DC935548B9E89BCFB9344A7FA02E73C7B863FECAB0DA0B94C631038D5E4425C2C8CA0787979AC4DDDE3B84D0004088096775CA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...f............" .........................................................n............`...@......@............... .......................................^...]...........\..t.......T...............................................................H............text............................... ..`.data...K...........................@....reloc..t....\.......\..............@..B............................................0...........................^.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...V.i.s.u.a.l.B.a.s.i.c...C.o.r.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.1496131215588665
Encrypted:	false
SSDEEP:	96:2MlPBUyk4ulENH5gJombTc0uaxvjUFuDmDsDx7ZUN4xWmH639QdWc:PICHu3csxAcxWmH639QdW
MD5:	94B81502E9454B5A4141B7CFED3696AF
SHA1:	0FAA18A5CBE9A973376B996F5E8EFAD91481FE4E
SHA-256:	35537A7A6120B102C077A15F2D41639789EE4EB80DBAD4DE61486BD010D2C5E9
SHA-512:	646811008D273E99E8C045E0212142D17118E271CBE5FE84FEC09C6FE2D77F68457F07776ADF8ACEE329FB75C31A017DF6C563E573F9ECD9560DB0E18DEB7929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c..........." ..0.............>1... ...@....... ....................................`..................................0..O....@.......................`.......0..T............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......P ..4..................../......................................BSJB............v4.0.30319......l.......#~..,...t...#Strings............#US.........#GUID...........#Blob......................3................................K.....C.................................J.....~...........b...........G...........c.....................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.1138356843673565
Encrypted:	false
SSDEEP:	96:rOE5YrdiCAcqxvOEPDmDsDHixIGWhPMpW:XiBpqxkWhPMpW
MD5:	719F2C6F0E306C9B0CBB1945CC115567
SHA1:	3BECDFC496FE546302347B8056A43C1848D71C9F
SHA-256:	0C3C5048F3F654C3B9DA64502BD3FB6E633147F378BA07114B70006411E61ADA
SHA-512:	51DB5C42A0AF5745F3B418FFB53E8F6FBA9421B63F40CF33AA9D778D817796CBCA4D40BA52076C86C8E8E83D44B74A88299172D992C6C760EBDCE941CD2F3697
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+^............"!..0..............)... ........@.. ....................................`..................................)..N....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..(.......#Strings............#GUID... .......#Blob......................3................................................"...........;.l.........f.....!.E.....E.....>.................E...[.E.....E.....E.....E...B.E...O.E...v.............

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Registry.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.294828560733334
Encrypted:	false
SSDEEP:	384:wWnW5GWcLRjwr79fllE7bBQjiNXCrKesmkBViacmO3k:mGwrTlkbBQASOe4ViF
MD5:	22861480D78A2A32C48A9EA42FF47D83
SHA1:	35BB937EF65230179230CF4CC4B65550E8A00A9A
SHA-256:	86CD7335E9C429A6C2546FC1A7917557D1D1D745D125929FE7FC1C6BA9D0D645
SHA-512:	FC0C9EC83FA8612B034D25F63F65C619906B0F69DC0BB45486A4438C91C01862D01D2242CD135DD3449383B5F1FC86C8E4D4CD4E133EAD1DECEFA6B0D3678102
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...@C..........." .....P...................................................X............`...@......@............... .......................................S...............V..........T...............................................................H............text...\N.......P.................. ..`.data........R.......R..............@....reloc.......V.......V..............@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...J.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...W.i.n.3.2...R.e.g.i.s.t.r.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...Z.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....M.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.AppContext.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.761227106986154
Encrypted:	false
SSDEEP:	96:u6mYlVdyVl1xvjUBDmDsDOw3KWe3poYWW:oYjgxA9aW+S7W
MD5:	097EB602BD9E1D3F337CB967B4BE0DBD
SHA1:	256718C7F20093C2F1354521F267F5122E554866
SHA-256:	3E33431F95F4B49C3BD88B49516CD1F54B4A9609D72468D263E1B628203C776E
SHA-512:	0CD3E3C8487EBCECB21226942B5F4D6A0E778C037B1929443D30B97C6FE790ECC4D2D79339A1C0F44B3EA6E2866A614F4C0786C4AB4D962B975E20F1E6C1AC2D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........." ..0..............(... ...@....... ....................................`..................................(..O....@..h....................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................(......H.......P ......................('......................................BSJB............v4.0.30319......l.......#~......<...#Strings....H.......#US.L.......#GUID...\...\|...#Blob......................3......................................................x.....3...........^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Buffers.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.967297521758999
Encrypted:	false
SSDEEP:	96:d+Wql/qbDBryWDlpRUODmDsDFG3qFWYZ2W:OlEgCGeWYZ2W
MD5:	447796CD10409401E02BE5B5B6D1080D
SHA1:	ADD4C349CC799BFA6CA9F14BB2A5902D417EC97F
SHA-256:	F7225E08986B34ACC3C246F886021CBE22AC6C63BD89A523F3AF12103D4F31FD
SHA-512:	F5F966C6B7E048B97D4DDB6C024E0216A743247B51559B3DEBFBD00A0E3C122D316FAD078B79BE8CEA267934EFA98B3D5224D89093BD30A93FFA888FC61E328D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.S..........." ..0..............(... ...@....... ..............................b.....`..................................(..O....@..X....................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................(......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~......@...#Strings....L.......#US.P.......#GUID...`...\|...#Blob......................3............................................................?.....!.....j.....%...........U.....k.....:.......................!.....S...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Concurrent.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.84650249408809
Encrypted:	false
SSDEEP:	6144:HbgV4VkHkisGGFeq5PpMba3GGzmT3LBx0hyO2z7yfg2rjt:HO4VFhD2z7qRj
MD5:	73234F77D49E8E32A6E37A96ED47AB7D
SHA1:	A0DA64EA285F6C3DE6F42EA534C1DF3B77B53B6C
SHA-256:	3A3CE35F4C81EEECB2CB7A82B36E8D095EFC1998BFAF406EF6E05B4384478277
SHA-512:	26B58041C8AEFFF9C9D428B0207346041C6D5664EE63B4A34AD6AEF3152A88082FE0334CEA0B40DEBC940A43384184E4C169B7AA364A4670917B7244487DFE86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." ......................................................................`...@......@............... ......................................@...T.......................T...............................................................H............text.............................. ..`.data...4...........................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...C.o.n.c.u.r.r.e.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Immutable.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	6.798707666985778
Encrypted:	false
SSDEEP:	12288:DXNnnD1hULWNtbrm0T9YLVgiy9UWvSWxYAkb9p6:pDrrIZy95J1O
MD5:	B893BF88DDFC50B5D43E895DA0D05975
SHA1:	79EF3681E85DD2DD2DC7F1CA17E8EC13CB1FEAB4
SHA-256:	F9C978A0BE5DC63E80F0D10000480E511D74030E3D98F4913B4B82B33D4E3F1D
SHA-512:	BE25735091BC4AB454167A7F419348A7857E054584FC887972B43486AB40EF1C1B10BA7809B5F58288E2C2FA22789087C818A28F7B2DDFB56B45BD3BA98A25AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...G.1..........." .....@...................................................^............`...@......@............... ......................................@....b...........J..h.......T...............................................................H............text...(?.......@.................. ..`.data........B.......B..............@....reloc..h....J.......J..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...j.....C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e. .p.r.o.v.i.d.e.s. .c.o.l.l.e.c.t.i.o.n.s. .t.h.a.t. .a.r.e. .t.h.r.e.a.d. .s.a.f.e. .a.n.d. .g.u.a.r.a.n.t.e.e.d. .t.o. .n.e.v.e.r. .c.h.a.n.g.e. .

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.NonGeneric.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.322592762217019
Encrypted:	false
SSDEEP:	1536:GcvRofU61nSm1CVrMZ2+AQWWLtgZTl3d:GoR03rgGZGQfeh
MD5:	429B5045C68BECBABC17FCFDC07BD5EB
SHA1:	54B2C129F8CF01634006AB012004654261753900
SHA-256:	5E35321B36D2EB7BB421F05602EE2BFC9E729B2E9C37A31BF2D171CDFF5235A2
SHA-512:	6D919BE79329F942496FC14C8E4200E6769937FA5509D628FB6CFFF9A56ED670166155EEA42D7DF45F1CD1DC221581BB237610346EE1C314784004D8151C8672
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....._..........." .........D...............................................D............`...@......@............... .......................................................B..........T...............................................................H............text............................... ..`.data....@.......B..................@....reloc.......B.......B..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...N.o.n.G.e.n.e.r.i.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Specialized.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.468663706888897
Encrypted:	false
SSDEEP:	1536:oH7g214zQEtHA3kNtH620sCbmgcPAO8xocgu509KERWfn/kq:obFKtA3StaeOcAOSocgua9VRWv/k
MD5:	304C879DF8BB681755F23D9703EBD6F0
SHA1:	ED4ADAF69ABF597EC7E5949A839186DA728CEA53
SHA-256:	E750CFE1AC26F2FF74FA0182B7CF61832994B58515C96B2D45CD21B44CE8BFAF
SHA-512:	5271CB7DBD8DB2DD61268DFF11A4DE6C58A77F5648E591A9500D26D143F3B5C74A005377C838DFACE7F26364FD7A8FA8CAB639AF14F159A250D5922173D5BC51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...M............." .........F...............................................D............`...@......@............... .......................................................B..........T...............................................................H............text............................... ..`.data....C.......D..................@....reloc.......B.......B..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...S.p.e.c.i.a.l.i.z.e.d.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	6.742344820796916
Encrypted:	false
SSDEEP:	3072:nj0b1vowuxUZ3mZZN76mQ0Kryplm1ZPqcgF5K36pKJL0eYIDp5WkI/K:j0hvowuE27kryS18cgy3sKJLj15WkmK
MD5:	1D2882A1F312CF8AF42846E01D4DDB4A
SHA1:	63F201E08031DF01FB6610CFAE2B98B25E4C1010
SHA-256:	26D37481453F3719883CB0F46B93CED68E2F81D472E523350EBF2CE310B79A24
SHA-512:	E35882EE4B7063E8890CBA9A2196765BD1CAE731F20C2B14E081A637B637F625D092038800A99DDD057916F57E6482561AE6D221B80D2BFF00678B93736CB068
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...'............." ......................................................................`...@......@............... ..................................t...........................`...T...........................................................x...H............text...(........................... ..`.data...............................@....reloc..............................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...C.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Annotations.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	6.38907401096189
Encrypted:	false
SSDEEP:	3072:qBOTlBKM218gxrKjjeU1QKhadCLLeXY+z43wmMWQArD5/oE5bF6a+SMse7w:E4SMB9+U3wzWQAra17w
MD5:	0D55A3B3100CE69B55CEAE17AE4023BF
SHA1:	AD69657BCF526A4A71BA147DA2A10CE993753D6D
SHA-256:	C2BFAD3C148FA9020C1A848588F9A7D4C808F8AA496BC2FE22721FF49608F03B
SHA-512:	30A636F6CF75BAE4931A28BB2335D8452816230DE19990FFEB654B936D32D7A5B8576824BBA0B32C929D7A32E8BFE4BB286A46295E084BE04E34A4CFAFCBF961
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....Qo..........." .....0................................................................`...@......@............... ......................................@h..p...............L.......T...............................................................H............text..../.......0.................. ..`.data...'....2.......2..............@....reloc..L...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...\."...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...A.n.n.o.t.a.t.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...l."...F.i.l.e.D.e.s.c.r.i.p.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.DataAnnotations.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.142509089257399
Encrypted:	false
SSDEEP:	96:koC61lUO+yLA4ptors4lKaeIeGXrNeTpFUnfDmDsDyrGjaWu+XW:LXg4pmr/lKaeIeGXx3nMrGmWu+XW
MD5:	222D6743E183CB489064AFAA1B114816
SHA1:	39C054C1FE6BB871DC9439B644B04AA06A6673A2
SHA-256:	E2325D1791CF6C46BDF974AF68A23DE291978DDB209D8191AE6AEF9A76EF3C47
SHA-512:	856E6387CC3DB7819F42F5198AC411E69C4526429D8D2B7E32F6784FB672571F43EB9A152AAF74014B88544980A0A0B9A64FBCBE2CFC6CCD19CCB2793188D0BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../@..........." ..0.................. ...@....... ....................................`.....................................O....@.......................`.......-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H.......P ...................... -......................................BSJB............v4.0.30319......l.......#~..l.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3................................+.....S...........................3.......9...O.............}.........}...........$.....A.....d.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.EventBasedAsync.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.889492942439257
Encrypted:	false
SSDEEP:	384:r3WvPwW4ofWRdWBC2uPFhAGKmY2t2wL9ukF0De5BJXfCvDXxO88+aEZ4jIwVcBvD:r0nWIOG2t2wBADe5C88IVmcnUX7h
MD5:	A3FD8B1DE09DD3170DC901B543BD7A58
SHA1:	0E003FB841636CCC7477AD18FD9DCFDBFD7449DB
SHA-256:	CEE8B106C331FC3B169565301594A0F475CD89B74234F5CD1BF00311F5A64E6F
SHA-512:	88857937CA9B514A5522568E6BC01F42D813339D2176851F6C1B0B24FE2E3C4F56542CE950C15C51E7009A6A0C8B2BB5C18C2ACB2EBB7082D67AABADAC0E1B10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....C............" .....L...................................................d............`...@......@............... .......................................U...............b..........T...............................................................H............text....K.......L.................. ..`.data........N.......N..............@....reloc.......b.......b..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...d.&...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...E.v.e.n.t.B.a.s.e.d.A.s.y.n.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...t.&...F.i.l.e.D.e.s.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.188651023984389
Encrypted:	false
SSDEEP:	1536:fTvCf+lhNuFkCoGevD2olstiqoUb8tkJgC:fTCf+lkoGKD2omtHDXJgC
MD5:	E1CA8F73C0DC66BE8D0BB2BD4FF2A04F
SHA1:	278F42D06F2990FFA9FC6D1DB33C7B6FBC7B525A
SHA-256:	96F00A3CD0052A8146C92E51A1731980A56FA51CD15B779FD6195A53BA2489DF
SHA-512:	947E0CC13FE8CE0D9FA41748F9C4F28344BAC862CFAD1BA63913DD528E78149898B0004471330DDC01C1BC75713F342D837B4DD0B8806F913FFA6423FA3C59C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....c............" .........0............................................................`...@......@............... ..........................................X.......................T...............................................................H............text............................... ..`.data...$,..........................@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...P.r.i.m.i.t.i.v.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.TypeConverter.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	737280
Entropy (8bit):	6.712404369969049
Encrypted:	false
SSDEEP:	12288:MuPJQL2WxCe7Uc7YWEFBiX5SoWBKlHrzlRGAAMy7S02:ri1D7UMEFBinWBCrzlZMS
MD5:	84E995E2038038F292280932C6DD5F47
SHA1:	4B11EE39E77067B82E7DA0B0FF5A087760BCA3F0
SHA-256:	6F68158F541148F32B92838E2884F277B69B1F239174FA16FB6687E359ADD312
SHA-512:	B88AE569017DDFD62F31CD0837639B78EA28B13059AAFAA55D8526F7E5B57C66D80283795AB8200BCAE8BD950B57926BBCFDC32D126761214D80975978B975C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....W5..........." .........................................................@............`...@......@............... ...........................................X...........0..........T...............................................................H............text.............................. ..`.data....n.......p..................@....reloc.......0.......0..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...`.$...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...T.y.p.e.C.o.n.v.e.r.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...p.$...F.i.l.e.D.e.s.c.r.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.504348417026314
Encrypted:	false
SSDEEP:	96:EyFQIW4I1WlShwWSBOUJwT1PVP1+AnxvVqcDmDsDzrh:TfW4I1WchYBOke+Anx0eh
MD5:	1B66E01FA0840B13A708924523960C2E
SHA1:	A2F7AB412CF192EA8C9FB4034769215DCC861294
SHA-256:	4FC0FDF4BAE6E0299EEA9F92DC9C8C1159EDE276CD2639C9FF0D9831D77086E9
SHA-512:	CE0AC75D3086F4FF3E1F9B755F5DD1A75F5B9DD821507C47AA20BD10E55FDF88852A04273D698E52CC4022A779A35C16775A3F80B23BC22219B2EF5B565C0455
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" ......................................................................`...@......@............... ..........................................0...................x...T...............................................................H............text............................... ..`.data...Y...........................@....reloc..............................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Configuration.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.336317914240981
Encrypted:	false
SSDEEP:	192:IOLYlskf/wMXTSv/fUNBDkCGuxeIgYPAKDik3zyP/weXUxA3ycyWvANW:jMXTSv/fUNRvGZYdf3zyP/weS+ycyWvh
MD5:	AC43D0D0FF66733B7C608BB5AB9A4DC9
SHA1:	BBDFD888D88B2F79C87329CCA4E5C4EBCE2D4686
SHA-256:	B91406F7D95E67690CD3DE15B79B0EC49B48565870D71B8D5D81E85BA081B9B9
SHA-512:	5A0898F65EF4ECCDA6D2AC5C43CD5DB8134BF74B3D31D8574A84C8C44CF657D4134C658A9DF3299554B047D8A42E29F4EDA558179226A67D81F817D8CA6615C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W............." ..0.............r8... ...@....... ....................................`..................................8..O....@.......................`......87..T............................................ ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................Q8......H.......P ..h....................6......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID...........#Blob......................3................................h.................2...%.2.........R.......b.....U.....U.....,.....U.....U.....U.....U...3.U.....U.....U.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Console.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189440
Entropy (8bit):	6.633859856892473
Encrypted:	false
SSDEEP:	3072:04EYm1jX/slFOhbV83fewcqI2yO9qfEukxDvaBACFxOnN3:e1jXgOCfMUIsukJSROn
MD5:	87543A04A2BBCE41608B2561D73E7A41
SHA1:	259E718F8C910A7F97E97D29498921EA33B22D4A
SHA-256:	DBAFE7DE28AFED984A2E2CFCFAEDC4D774DDD05A4954E1FF82C9BC4A48122EE9
SHA-512:	8E3C249FC34F6A021249F9001AD5ED7F08E5B5754D8D72D53955777E580FB0E2A17210FD49CCA9197E6F0F41A3852EFECCB4FFCDB9C154F106ED4D96EE38AB9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...T.O..........." .....L................................................................`...@......@............... ..................................T....}..................t...@...T...........................................................X...H............text....K.......L.................. ..`.data...N....N.......N..............@....reloc..t...........................@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...6.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.n.s.o.l.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...F.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...C.o.n.s.o.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Core.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.5659766364943355
Encrypted:	false
SSDEEP:	384:pS9H4Ay0l9Jr3OzFPhoact/iKMePLexkrW1rU1ZXtlWTjknWXJ2W:s9H4Ay0l9Jr34FPhoact/iKMePLAxim/
MD5:	29B1C06A62213453C183F0C1DF2E79BE
SHA1:	B83A72F321867331790B56F4B2BE9FA43BA6E28D
SHA-256:	7069AAC23EF6187FBA5ABC600921FA1A5A09A95A495A31C679FD37359ED1886D
SHA-512:	2A9EAA144F1A3546A4005169DE442C71F53D4567ADD4031487A9D57DB4E1E19EFD8E90519FB410AB34504B8129EB57339637A77D54EBB8010F04C22A226B5CA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k............" ..0.............H... ...`....... ....................................`.................................sH..O....`..8............................G..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...8....`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...&.................. G......................................BSJB............v4.0.30319......l...<...#~..........#Strings.....$......#US..$......#GUID....$......#Blob......................3......................................................i.......G...........................:.n...J.t.....t...P.................C.....`...............................................).....1.....9.....A.....Q... .Y.....a.....i.....q.....y.....................I.....R.....q...#.z...+.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.Common.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2888192
Entropy (8bit):	6.830914579418171
Encrypted:	false
SSDEEP:	49152:6qlwbhVw+KH9yu1/8WROdkp40MukREyiNEXQ6ZvIq3V/mW9SuXsk5hBWmXo4x3XN:owhO0TaA6ZvIq3V/mW9SuXsYrXD
MD5:	E5626F090592930CAA68DEE33B4A9465
SHA1:	E183C1BD014B2D9813022B6F1547741D82AA27A3
SHA-256:	1B281F6891DAD1B4A14A120C47AB50472096201626BCB72A9DE7704B5BB81795
SHA-512:	6C0A4A28FA97E87388241D6A8A193A13228FF6DD730D7EAD1177E2345BE4649620E2142D03FCFF22ECD08196F48C43B5F07A75AEDEF01D2B1E13D158455A3325
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....h..........." .....T#...................................................1...........`...@......@............... ..................................t....](...............0.P-..`...T...........................................................x...H............text....S#......T#................. ..`.data.......V&......V#.............@....reloc..P-....0.......+.............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.a.t.a...C.o.m.m.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...D.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.DataSetExtensions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.635443199113749
Encrypted:	false
SSDEEP:	96:eQClUdyx7KmhlB//UjDmDsDWbUzWaS7W:OmoHF/MwbCWaS7W
MD5:	4B63EDF2F984EE1290618C3AC102114A
SHA1:	66DC8126AD53ED41B2E9340EE705914156E8EEC5
SHA-256:	A3C65D0EC4932A89110BDC9AEC5BAB6B15BEC0F62E37ACB8F71F64392F04C47E
SHA-512:	D6486064EFCB3E7663B9FC5A71CE0035A0DDAFA7BE92A6C2F4BD72E47A1D7A4F9177516E202D6B6C3E795E5AA603FB213DFAF92FC689B7DBCEC81FACA4DE7B63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../a..........." ..0..............*... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................8(......................................BSJB............v4.0.30319......l...0...#~......@...#Strings............#US.........#GUID...........#Blob......................3................................................E.............\|...............i.)...'.).....".....)...~.).....).....).....)...e.).....).....E...........v.....v.....v...).v...1.v...9.v...A.v...I.v...Q.v...Y.v...a.v...i.v...q.v...y.v.......:.....C.....b...#.k...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.684638619386625
Encrypted:	false
SSDEEP:	192:rM5ZvWYY6NaFRT4TFEmEI4az2nSMVhvMqiSbgEQJ6UhYEWioFW:rWAAaFiTCmM82SuxDJQMEWioFW
MD5:	06A449C1D8AB9842BD1E606A994C5537
SHA1:	C785BD85C30D4BAACBB985DD3A406B3DC20906BE
SHA-256:	17393CE3A49FA4ADDC3426C8E57620622A16A18549B987C251352E69A320B004
SHA-512:	9F6229804BE6699AA19B050E28699A4DE34643D459EF8EF7EC451D359A0D19EFAEBF74A1736ED3C11CDDB7F6314F33F6B115AEF3A90C7D0C72A40A1A99D4F30E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$............" ..0..0...........O... ...`....... ....................................`..................................O..O....`..8............................N..T............................................ ............... ..H............text..../... ...0.................. ..`.rsrc...8....`.......2..............@..@.reloc...............8..............@..B.................O......H.......P ...-..................LN......................................BSJB............v4.0.30319......l...T...#~...... ...#Strings.....+......#US..+......#GUID....+......#Blob......................3................................<.....H.........~.......................).r.........;.................Y.......................B....._...................#...........................).....1.....9.....A.....Q... .Y.....a.....i.....q.....y.....................R.....[.....z...#.....+.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Contracts.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.9818754785378783
Encrypted:	false
SSDEEP:	96:N1amI4CKZiT/eexvOLDmDsDRTGcWwxr1BwW:LamI4NZ1exaW6Z2W
MD5:	0C2C2F9CF67193F465D7B4341C7A1BCA
SHA1:	0FB7DAD0BA2BAFF9A5A98C4E9A8C6D98A4110DE2
SHA-256:	89B747EDD70CC6384EC7D87FCF99A663C48863B0833B82AE047E91FAE1D8FD99
SHA-512:	87593A16589B609A68D7AB8FF056EAAA5E07875E6C2EC846E28F967EFA089AC50EA71F0C35C982089ABB9BD422157498AC4E61D5994933330856100509891475
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x..........."!..0..............,... ........@.. ....................................`..................................+..V....@.......................`.......*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~......H...#Strings....4.......#GUID...D.......#Blob......................3......................................Z.........9.........................,...5.............{.........F.............................#.....p.........................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Debug.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.969878680619615
Encrypted:	false
SSDEEP:	48:6zk4gojleytwPVWaZF4ZhBG+Iv+KXkVP6zDmDiZDwBYZYKZWHWKpi25WmQK:Sjleytwx4kxvjU8DmDsDSqvW2aimW
MD5:	34E23CF2C57575283D7E680137CA015E
SHA1:	F24D7FD817F95EEE61F145AAD3C6F98EAE637F74
SHA-256:	645A929D44B5BC83019F6228E7D04ED858F5067890646F603FFB4208C647ABAE
SHA-512:	59915ECC8E68946E0DA10EE733C805F7F77C3F54D7D21A02BD9EA9BB3665F1E058E3556E07D1571D466776D8F36CDC0FF5191643220869D698735D7A09265EB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0................. ...@....... ....................................`....................................O....@.......................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ......................$)......................................BSJB............v4.0.30319......l...H...#~..........#Strings....<.......#US.@.......#GUID...P.......#Blob......................3..................................................W...R.W...g.D...w...........0.....w.......................>...........................................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>...y.>.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.DiagnosticSource.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	399872
Entropy (8bit):	6.734877554436723
Encrypted:	false
SSDEEP:	6144:lvh3GPOImJzDjGu/tvjEdBfexGFv9g3ffV:r7jGcjI7veF
MD5:	6C1077E84CB2D63D8796D09B517ADC41
SHA1:	F685A065D7B209EFC88A0914FEB0E5A5E113DDE9
SHA-256:	D8F204E8092CB86122DE315FE9E8101D5AEF7479D9D1B15CCB71BDD7540BD219
SHA-512:	C652C2FF5B7390ACD411C088B2A8660835BB935E91C5100F6205ABD9510C0EA6E62ADFF3A1C86234B0BE11A4F08912EE811E7440A647D3AAB9CA537F5743101B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...5\|............" .........l............................................................`...@......@............... ......................................<....)......................T...............................................................H............text............................... ..`.data....`.......b..................@....reloc..............................@..B............................................0...........................P.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .C.l.a.s.s.e.s. .t.h.a.t. .a.l.l.o.w. .y.o.u. .t.o. .d.e.c.o.u.p.l.e. .c.o.d.e. .l.o.g.g.i.n.g. .r.i.c.h. .(.u.n.s.e.r.i.a.l.i.z.a.b.l.e.). .d.i.a.g.n.o.s.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.FileVersionInfo.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.119026642523614
Encrypted:	false
SSDEEP:	384:oWdwV9WO9kI2u8FMXyGr/9oapxEkkI233yl7oQxPkl3rWP8O1Obk9lwfDpj5pA:8b9KDMXjnxfM3i55klbcjObk9uto
MD5:	372B15296B9F256F30393D37DB8C3B6C
SHA1:	387F3529E6A802762D9B9DEF19235B843DEA27B8
SHA-256:	E38469EEC541208F5D6F4A0A366A033875C27CCB9160ECABB80568E9055B8427
SHA-512:	CF34D10815C8A8897A5CAE28DB6040773D98B8004E4B1F0E8FDCA7E751293F651EE81099B7BEA5ABF47254859F91E7BB280E1172803DFD7D6C942985CCD6F3E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....I..........." .....`...................................................~............`...@......@............... .......................................n..L............\|..........T...............................................................H............text...(_.......`.................. ..`.data...K....b.......b..............@....reloc.......\|.......\|..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...^.#...C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...F.i.l.e.V.e.r.s.i.o.n.I.n.f.o.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...n.#...F.i.l.e.D.e.s.c.r.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Process.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	230912
Entropy (8bit):	6.635549958601621
Encrypted:	false
SSDEEP:	6144:6Q06XR1zrhVq9Q9FxFV9b3q3xKPafd4VbnMCNI4lK:vpXLhQ9Q9FxFQvMnnI+K
MD5:	AAD5D8EF1666ED99AD08FE1748F3A22F
SHA1:	0A0AF6C403578EB8F49780CC010232B168773A22
SHA-256:	F47CF2F00C2A8B09591C0F46A091FD8DA4CEFDBB095F6C6BF366FA9D302C698F
SHA-512:	E82A8B22A94072FF78E690130F7E9680FDDACD2FBAE23E651493C6D8846D34E297869D62F904C7DF42B6D62D102418B388A2DEFAC8EE1817B7E9DE538D776548
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....!..........." ......................................................................`...@......@............... ......................................X...................D.......T...............................................................H............text.............................. ..`.data...............................@....reloc..D...........................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...P.r.o.c.e.s.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.StackTrace.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.608926317135169
Encrypted:	false
SSDEEP:	384:nWnPgWDiJZ+DUnDwmeM8vk6fwC/FmPF/NMDn:cZwZ+DUns/M8vk6Y4mPFiT
MD5:	EDFD80E4260CCDE9DD2D649A6DACD0ED
SHA1:	7FF675FB6775E18A3E9F033281FE850B32BDDC3C
SHA-256:	15B00547F262E1751712E2015DE6232BB376CF6DC90EF5FB1A183C5E0B236272
SHA-512:	1CF4230F38CB6C8040770B394258BDD1D8D4482D9A56CA339047AA2597663DFACA6EB7564DBB625C7390F8DB0965203248DCFD7A52E6EFC4084CEC52DE5A7EE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....kg..........." .....B...................................................N............`...@......@............... .......................................F...............L.. .......T...............................................................H............text....A.......B.................. ..`.data........D.......D..............@....reloc.. ....L.......L..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...S.t.a.c.k.T.r.a.c.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	6.394538143640945
Encrypted:	false
SSDEEP:	768:uPspQcw/YyvLi8bdF31M7Y4NL2OSkkuc6T6EvWq:uPs+cwpvmAt9FK75vWq
MD5:	53262E031E6DDD02A2F58B299C617E77
SHA1:	50A3A27395122047BAA02F2C08751051E3EB6208
SHA-256:	F1D2F84F07F870E91B4C81A08DC8212B9F806A74F543AF6AADD9A2B8295D117D
SHA-512:	71908906B0F51C62E7C5461DA0263030353EF6D60BF9BDD4219E72ABA9190C59CF5F39BF7569A3D224278541DB23C2C2334D67550C241BCE339C414B42BC634F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....J............" .........*............................................................`...@......@............... ..................................4.......................0...P...T...........................................................8...H............text............................... ..`.data...Z'.......(..................@....reloc..0...........................@..B............................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...n.+...C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.e.x.t.W.r.i.t.e.r.T.r.a.c.e.L.i.s.t.e.n.e.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...~.+...F.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Tools.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.986504902614852
Encrypted:	false
SSDEEP:	96:INoRAlvWAytYSxvxvjUkDmDsDandWQaMUWn:JAmvxAvdWQzUW
MD5:	DC65E2D0B9FEB32E51830D9B997CD27B
SHA1:	655D8F89AB97AC8613EB6F4A5F8D4F5C5CA14469
SHA-256:	CD245C7AEDE106A754D6A3A0108DCC5EFB326F7D1DED63E1654E254F0881DDCD
SHA-512:	BF8AB05133D08C83D310967594D142A2FCCAC75AE924FD6D2BEAA8953920A89AEF30A849B3D3C0B0CC1A5A22A0EE9C8DA1014B08DFDDC5CFE3C712753B89D729
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0..............)... ...@....... ....................................`.................................M)..O....@.......................`......`(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..(.......#Strings............#US.........#GUID...........#Blob......................3................................................F.h.....h.....U.................%...(.%...........%.....%.....%.....%.....%...f.%.....%.................O.....O.....O...).O...1.O...9.O...A.O...I.O...Q.O...Y.O...a.O...i.O...q.O...y.O.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.TraceSource.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.515835111308888
Encrypted:	false
SSDEEP:	3072:Il0sZcKL72Rh60dpwQn60x7cftbgsjseIVwB0r:+0sZcTQ6aQn60x7cftbggzrB
MD5:	3B83A6BAB8EA9E995FC5618C4D78FFA2
SHA1:	4E789C0758013B735CA16D31F689708CBFC578C2
SHA-256:	1F39C1179187AFE037F687CCDA55D87B2D1EF3AF300934E29EABF056C17411E3
SHA-512:	294B8CFBED7366924272F6864D1CA9F1EBDB051B3D32E1A8AD60F57FE0FD394F635C82E2005E21DC257E4C1F684530CB71BB2A76FC3E1EA52B205B69C3AF9462
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...4.W..........." .....\|...h............................................................`...@......@............... ..................................................................T...............................................................H............text....z.......\|.................. ..`.data...?c...~...d...~..............@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.r.a.c.e.S.o.u.r.c.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Tracing.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.183092540282057
Encrypted:	false
SSDEEP:	48:6uDQOSANAL8iRnBgocPjtYuqj+M3M+IvOX0gvNPCDmDiZDS/EfIddZAo8ZZWxtKz:0b8itSoI+j+M3MxvO0DmDsDs8WbKDW
MD5:	DB2C6FC287075F1CFCE4AE3C7D7A1005
SHA1:	84D008779B2FD1CC6ADD11711EBD70DE4F33A8D8
SHA-256:	4E70E4CD3A6F38E708D602E16ED2F5076E71367323E6DCB78346DB2F19D87CD8
SHA-512:	7ECA0D72BB91BEE690CD35FB2A1752B341D57604C766C10D34AEBF890C7B63F17197E3CCDC7DDBCC933918F1D8827AE9A92271C269DDB565AF358249E7F96D63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(i............"!..0.............n-... ........@.. ....................................`..................................-..N....@.......................`.......,..T............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P-......H........ ..L...................P ......................................................................................................................................................................BSJB............v4.0.30319......`...x...#~..........#Strings............#GUID...........#Blob......................3................................ .....................O.......................c....._...........}...........6...........B...........................................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Drawing.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	6.365190723270025
Encrypted:	false
SSDEEP:	3072:xTwpM2ajTP0piuSnfQ/0INSTBXhQvgpIekmaHa:ypUTPUSc8yr
MD5:	ADFB81E3B7D4EB72B9F1B999E614B096
SHA1:	685264EA8885A3B603C9289C942449E58C67C9E6
SHA-256:	3C2E3E115A1A8C6205F700C93559E86AA9D74532DA8D07D1DF8034B87CBFB90F
SHA-512:	E9E2D82A0EEC8BCA7388BBE336422CDDDA152705BAD21F0DA1388AF908F46C158E8D3D8D5102F5A5BDCF87131D156CDD115B4C364AF1FB4EDEB6D0E8E1090140
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...S.'..........." .....b...Z............................................................`...@......@............... .........................................................D.......T...............................................................H............text....a.......b.................. ..`.data...jW...d...X...d..............@....reloc..D...........................@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.r.a.w.i.n.g...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Drawing.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.3925554507914555
Encrypted:	false
SSDEEP:	192:Ng0XI9Kt1QRP7uC8MxaIsCetAxAW9+OWxAtW:K8iP7uC8MYITeteB9+OWxAtW
MD5:	CB32CF3CEDBF9B4CA9A3523EA1BEA304
SHA1:	BAC76F94CC67ADD6CB98211C30EE76DC6731BC12
SHA-256:	75F47927F10F8AE39E3E902D3428CAC0C53F669ACBD98ED50BF98D4546331344
SHA-512:	0F8224F1BFA95256265E3B74950AB402AF2AC49672DAEE4B2DBA6CF3A678C5819013E80412E81D813B750607A5B25E03DC032F97CDA8D7CC92B01952E7663EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".c..........." ..0.............^=... ...@....... ....................................`..................................=..O....@..X....................`......0<..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc...X....@....... ..............@..@.reloc.......`.......&..............@..B................==......H.......P ..`....................;......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3................................................s.#...C.#...~.....C...........d.`...U.`.........*.`.....`...!.`.....`.....`.....`.....`.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Dynamic.Runtime.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.993872437781376
Encrypted:	false
SSDEEP:	96:3ejl9uyvJGX0UxvjUd8DmDsDcFGLBwMWs1CW:3A7YX5xAdTFGLSMWs1CW
MD5:	275380B4A1F991A0DF80F1D1E46CF970
SHA1:	5755C188E4B7C6AF42E6D9DB3B6EE8BB28AABCC7
SHA-256:	5A20968677CEE4D2D5831A231102C7BFF1EA8357EC51070508160F36AC533F43
SHA-512:	E0F0A9D62865354141A495CCA4B44D79A2C01F8EA7A04C77BBB18973E889377E1BB10BE760A3D023DF19B9D84873ADA6639161F47938C20D44F0B63F0EAD1EE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#7..........." ..0..............,... ...@....... ....................................`.................................a,..O....@.......................`......x+..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~......h...#Strings............#US.........#GUID...$.......#Blob......................3......................................&.........W.............................j.Z...9.Z.....A.....Z.....Z.....Z.....Z.....Z...w.Z.....Z.....#...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Formats.Asn1.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	219648
Entropy (8bit):	6.652178071284189
Encrypted:	false
SSDEEP:	6144:M48Hzk7z60t6/m18cp+QifTLMvWtz1ZSgSwq:M7H+zDPBwIWhj
MD5:	C1B9F45D9099ABECFCD1B5E21D73DBC1
SHA1:	DD57C5E9138F6888E1E5FB347DBB750C8A66DB34
SHA-256:	B5125809589FF1921774AD1A382C1B1530ED3C46E427289D861F903ACA8DAC7D
SHA-512:	7BB6CA87125A9279025376787FB50FD6C782011B6E805FA90912907DBCAC31C08179E12CC8CEA6BB282177A1C09991B43969310808092B23F12C1364754D91CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...8Vj..........." .........................................................Z............`...@......@............... ......................................d................V..........T...............................................................H............text...d........................... ..`.data...*...........................@....reloc.......V.......V..............@..B............................................0...........................@.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...\|.....0.0.0.0.0.4.b.0...b.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .t.h.a.t. .c.a.n. .r.e.a.d. .a.n.d. .w.r.i.t.e. .t.h.e. .A.S.N...1. .B.E.R.,. .C.E.R.,. .a.n.d. .D.E.R. .d.a.t.a. .f.o.r.m.a.t.s.......C.o.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Formats.Tar.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	266752
Entropy (8bit):	6.670766409249489
Encrypted:	false
SSDEEP:	3072:XhNCH4N0ycdmRMeMiwUcXTiEsJ/3ezh7XLH5qHhYu1RavhbLrh4gAHObB73+llax:xc4CyMeMcqnUHhl1RaHFAHOZuzR
MD5:	0B0BE43C758699440A70037773112523
SHA1:	6EB5DE6571CA0E84150D899890CA6F68B7E27994
SHA-256:	FAD85EF14042E8307072FB26C8D18A2B5B04F2B0F14EE18447276E50F88BCD78
SHA-512:	F3344A175448F3020E694B8AD986A52B6ABB8DD12DB9383F0CBCA176664DF000C500CDE2456C20F2E27C5AF8B4ED54AD31169EAB137DFB0BB508947536DDF651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....6................................................................`...@......@............... ..................................t...D...................x...h...T...........................................................x...H............text....4.......6.................. ..`.data........8.......8..............@....reloc..x...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...F.o.r.m.a.t.s...T.a.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...F.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.Calendars.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.042163733773019
Encrypted:	false
SSDEEP:	96:KH4lojr3OYyslhKRsdE/xvjUvDmDsDT5RqXWDRq4oRqm0Rq7W:ZtDxAvRqXWDRq4oRqm0Rq7W
MD5:	C1E84128271B48D0E5BCB934B2FDAFD5
SHA1:	C2C481D513B986D592B835DBD5F925195E926A59
SHA-256:	596214E6E84830E612479C417FD20A07A4535BD22E0A6C18873A33C492E45262
SHA-512:	5A1008D934DB7B621F48B4E5E0F14CDDF427E316C22E5C1FF1585DC78590DE1A4C6FD4F7EB7FF428A531E2B7A982B80C6B38CDA5C1A5180E301830A0176E34BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L.~..........." ..0.............:+... ...@....... ....................................`..................................*..O....@.......................`.......)..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ......................l)......................................BSJB............v4.0.30319......l...p...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................;...x.;...3.(...[.....^.................I....._.................w.................G..................."....."....."...)."...1."...9."...A."...I."...Q."...Y."...a."...i."...q."...y.".......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.Extensions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.055591437266271
Encrypted:	false
SSDEEP:	96:dJ/QnSl4UIzyVcNxvjUSDmDsDP+RPWYRg7Rp0RjW:7+xA7RPWYRg7Rp0RjW
MD5:	B0FBC2B37AE214A5C3854971B77AABF8
SHA1:	1EA8B70849E9B2A76BAAF145689EBD8BA5D3AC71
SHA-256:	C7CEDCB40EB6D844ECDCF5672D7B38AA51E979B0AECC9A30FB58FDC011BD0D5D
SHA-512:	1AD184F5BC56C606C7393E968DE64955457D81D32B55D593AC37015E11BA574F9FF7AD9D0BA5B8414151756554FDE3135F56AFAD2C0EF2B0B354C93A5F57588A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f!..........." ..0..............)... ...@....... ....................................`.................................k)..O....@.......................`......p(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..4.......#Strings............#US.........#GUID...........#Blob......................3..................................................8...x.8...3.%...X.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.83374697396166
Encrypted:	false
SSDEEP:	96:1sx6l6e7y27lgvfQlxvjUQDmDsDyKQwRLWdRMCRA0RHW:rpR6vfQlxAnSRLWdRMCRA0RHW
MD5:	D198499EE0EBDE0FFFFEE9437E7AD964
SHA1:	8CA8FE7379FF7887D94075EFB15A2DF8806443E1
SHA-256:	F3135041BE8E197D15E2F946CFE898025FADE23FDB44041C4EBE71D2F9061DB6
SHA-512:	946047AC2432C7389E0F146594D345B4411E93218810220729BE10AC1287BAC7FCF1A6FB0DB3B63A20BBCDA1494AF340FFF663D91E904DBE2E6D8A040289C13F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=..........." ..0.............r... ...@....... ....................................`....................................O....@.......................`......8)..T............................................ ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................Q......H.......P ..h....................(......................................BSJB............v4.0.30319......l...T...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................D...........o................Z.....p.....?.......................&.....X...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.Brotli.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.352983311433773
Encrypted:	false
SSDEEP:	1536:dDQvRxjsKHdFHxrma0ACL3j0elrK9wbwqkRpgH:dmp+Ai6ebwLRO
MD5:	18F25340B261803DDCB31EE681F6549C
SHA1:	651BEB21C56AE4380BBCE6927C614782B6457EF4
SHA-256:	4C88B95F85BAF4A4440F84B4F99FB8AC10AC61ED53D86561D956703972F73945
SHA-512:	65095EB63DC6743E593FAF8F921141C097393D1366BD1B02D755E46B818C5993301AFF0CC49F476DB9BDE26117CA46C67631CA4FD0F423BBBD130B0884C01FAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....{..........." .........2............................................................`...@......@............... ......................................\|...L.......................T...............................................................H............text.............................. ..`.data...W/.......0..................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...C.o.m.p.r.e.s.s.i.o.n...B.r.o.t.l.i.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.FileSystem.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.7304308492974076
Encrypted:	false
SSDEEP:	48:6R+lplmwWyljfZmENgadCJyKXkhP6zDmDiZDJGPZw4ObW8EZWf8W8FKmW8FTW8Yp:LewWyljfLqldUQDmDsDgBwaWuJmW
MD5:	09BC5B5671F009676F9AA6843D6FB820
SHA1:	2E76A88616A839E1BAE54A50CD91D4891B188640
SHA-256:	DB2D133135E7C2E634C61E3AF0E694FE4F48FF299E2806B8D8ECFEB794DBEB15
SHA-512:	EEE9389D5F2E873A7C2A5969A927A59482B16A016D78603FC024106CEB3629448AFCDED507411BA61F700374BC8AC2918909AA1E445CC5E7D2D4E8188C33BE24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;f............" ..0..............(... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3..................................................U.....U...Q.B...u.....\|.....7.........g.....}....L...................3....e.*.................<.....<.....<...).<...1.<...9.<...A.<...I.<...Q.<...Y.<...a.<...i.<...q.<...y.<.......C.....L.....k...#.t...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.ZipFile.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	6.163172275996026
Encrypted:	false
SSDEEP:	768:gqTIdfJkx8ICA6UhCk5Xy557m/SW+3JyH:gqTEAf6Uhd5Xy556fkyH
MD5:	547258C6C068A1EE461DC137F1E470FA
SHA1:	117EAA6505341442D215F180B84C3111C29046B2
SHA-256:	E4DC3EA77C46173A03A8A6583E08AF168CAEB24A78761A2F7E561AEBD25D062E
SHA-512:	AD57198A04425B166AB826C44383EDC95E9E1A673C85D12AD882DBC23B3C857E4325F3942525774487072CE046DD537262AC4A0D67B158D877BDEB3EB3EBCFEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....h..........." ........."............................................................`...@......@............... ..........................................0...............8.......T...............................................................H............text............................... ..`.data...c........ ..................@....reloc..8...........................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...C.o.m.p.r.e.s.s.i.o.n...Z.i.p.F.i.l.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	248832
Entropy (8bit):	6.66378504872572
Encrypted:	false
SSDEEP:	6144:67ZYTsBhyEtUEab9CscoWMLh5amOK4oHOxg53+:AZvbZS0oJxuI
MD5:	80E17D8845429FD01DA10E0FB82FC4CA
SHA1:	3B548C752D5A4B9DCCD915AB860ACE259019A669
SHA-256:	CBA3E958809E8DF121D609EDD54DCE9109AAB4DB76635D8E44AD40F451837ED4
SHA-512:	D6448CD5481580E88D5C683EEA93DC82941AFA876734555D44E603FCA39774EB2AB7589252D871FB2C16B04898CF615612C9044B0F4BD711068F675D7F86A561
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...m............." ......................................................................`...@......@............... .......................................4..........................T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...C.o.m.p.r.e.s.s.i.o.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.AccessControl.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.238174732123006
Encrypted:	false
SSDEEP:	384:GW7WVbWAeaul2Yd5zqNfdcdOgpC7bdOBHjM3eeUma/:+cfedcdOKC7bdOhjMueg
MD5:	7F6B5D5ED8E2901960C5FE073EB45910
SHA1:	75EE2022DEDF5A72270E671349B1D8336814D60F
SHA-256:	44F050435173FC777A9FB9BD20E3EF0A2D61732C3C9BC807A0D675A01125AA0A
SHA-512:	78E11B6B195DC13EFD566AEFFF96DCB68A7737514D1CEFBD326C9292859176DFD9814FD0D5B07D395E7530796F83A1D889F9B96FBEBA3226F5D3512D0BCC6B87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....L...................................................T............`...@......@............... .......................................O...............R..........T...............................................................H............text...<J.......L.................. ..`.data...Y....N.......N..............@....reloc.......R.......R..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...^.#...C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...F.i.l.e.S.y.s.t.e.m...A.c.c.e.s.s.C.o.n.t.r.o.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...n.#...F.i.l.e.D.e.s.c.r.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.DriveInfo.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.301666968715502
Encrypted:	false
SSDEEP:	1536:aL7lzTp1MJLNFCoIiBiUXrpSPBtAF8c2B:afxzMLFCoIikQAPbe8c2
MD5:	9BE40EFDCF1DAC47DC26E00955C0B59D
SHA1:	93825440C6387E639F23F6F061DD8038B532F8CE
SHA-256:	4352F5F88CFFC54572FFB7DA6732138D18D52FFCB578437657E271543D037035
SHA-512:	692193585DC3D9DCF18CB61626320F155705B08339B4DCD171B4F9C65B1C87C8A58737C93E8E3DBFC5B147D76582DA7542081C8965499BD17B397AF8D90BAEFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .........4............................................................`...@......@............... ...................................... ...........................T...............................................................H............text...,........................... ..`.data....1.......2..................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...F.i.l.e.S.y.s.t.e.m...D.r.i.v.e.I.n.f.o.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.029497188617668
Encrypted:	false
SSDEEP:	96:FtIltKAMySlU7YDxvjUqDmDsD+AW/dqW:gz1/YDxAcW/dqW
MD5:	51A573705BF25937E261BACDD735F34D
SHA1:	E5F65B4B4D7D9DE4B926458574B1D188A17CFE9C
SHA-256:	4B8100F5348AACC6672803799C11AFC9231BD3E59729619E4AA9FE287577411A
SHA-512:	CE02F23E981F60E56B83AB6813158A0FB6B0637E20C53E9AE76753351959D6534C8846ADF652B522C1DA8BDFF7951C16997465E2A4C049926B316E783E9E7344
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Aw..........." ..0..............)... ...@....... ....................................`.................................g)..O....@.......................`......l(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID...........#Blob......................3................................................!.2.....2..._.....R...........E...........u...........Z.......................A.....s...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.Watcher.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	6.495998070567815
Encrypted:	false
SSDEEP:	1536:YJRTsxLvYYDLFZONLOvLmPDsWzHNmps5mmfm+t1/+IigGttvYJFRN2VuP:YvoxwrJ4LmPD1p3igGttvYJFn
MD5:	A19F8059FAD3C8E0C7146F44BEFB68EF
SHA1:	E08C93E4E5655BB1C88763485E86069A268AD9D8
SHA-256:	6F7149705AEFAE651CF8DADAFEB28866E282BC1ABDB32750B89B3BB70A8EC58D
SHA-512:	D6C54549F45527AD8000A0C466C610569B206F5BD24BAA5A9D467ED131539576E1915CBE22A04F29E9AC54BE52E2DE63F2BF3111EF97639E60CBA7DF759C3160
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....B............" .....(...L...............................................v............`...@......@............... .......................................E..L............r..d.......T...............................................................H............text...h&.......(.................. ..`.data...MG......H.................@....reloc..d....r.......r..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...F.i.l.e.S.y.s.t.e.m...W.a.t.c.h.e.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.925605077896596
Encrypted:	false
SSDEEP:	96:2bl4LypRHujXib+GxvjUUDmDsDUQEKQWWyp2W:QW4RH8cxAb5AWyp2W
MD5:	3E51F5EC1B01467B42A2DB3952317407
SHA1:	CB5D55B03C4C1C4163B7750EF0791D73606E21FB
SHA-256:	524901CDB2CE334B32521F9020CBAFB279843E2F3D19677591E600A43A18AA6B
SHA-512:	5A13DC1D5C737A182D6530633E20120D55DC20CD6B0372B2AFB46CB84A88505194D8DC59F4CDEB4A2723D65B3F5D3D3BDFA6777E5C3418A2F1243DFA958C9C42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............+... ...@....... ....................................`....................................O....@.......................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................L)......................................BSJB............v4.0.30319......l.......#~......p...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3....................................../.........h...................................J.......a...............-.............................../...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.IsolatedStorage.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	6.337399571381829
Encrypted:	false
SSDEEP:	1536:qCHObnhHl6o55i3SjZwRdAdKTC+htx63fH/f:q02nhHwo55i3SjZwS+htxAf/
MD5:	A382C72012E61167FF66A0085A593DD0
SHA1:	017990C72DD44C8E46D27B2869DC65215A9D6F23
SHA-256:	1C6DE85FCB77EB8F0B8BED7B338CD55CC6861741140511F3F9F9621A22D8D341
SHA-512:	E9B230C18F5402883A4C1ADB90CF74B385DBA86E1BB939C5CB7A632C1E7ABF3BBC6882870EB5F225347A5083E23C0AA9625C1F4DE5CB55C30633FB5842DC2B7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...K............." .........6............................................................`...@......@............... ..................................................................T...............................................................H............text............................... ..`.data....3.......4..................@....reloc..............................@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...I.s.o.l.a.t.e.d.S.t.o.r.a.g.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.MemoryMappedFiles.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.354606236684571
Encrypted:	false
SSDEEP:	1536:lF8zNSyz+yPxGP650+R1i9Ef9bj13jfIWeX9RH:lmZP4Wxf9FjAJX9R
MD5:	5C2D20BEF62F735A06471189A2A89300
SHA1:	1E1F2A5FB0BFFAEF8AE3649DB194F0452A689F37
SHA-256:	8042D8407B9049D6690A8975B69BE78DEBA6EBE7D92D933B84D31CDCD7C7D1C5
SHA-512:	1D669EB25E8F20E285CA5FF2756B2D9825946B72E1DE0E2CAACE7D483200B5FE31E11A597E4702523B5A47C452AE8179D7E4E46B53CAC7A83C8F867371684E37
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .........6............................................................`...@......@............... ..................................................................T...............................................................H............text............................... ..`.data....3.......4..................@....reloc..............................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...M.e.m.o.r.y.M.a.p.p.e.d.F.i.l.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Pipes.AccessControl.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.109400928563531
Encrypted:	false
SSDEEP:	192:yW+WPWUdtJvNhHTiQpDLXnnjAP9eTiSPzhDJgb0WxZf9ppR:yW+WPWUdjviQFnnjAFeTiW5Zc/R
MD5:	2C1FA28993208788E8AB2D167CE59B3D
SHA1:	320C011FD4A4590FD08B9A09860C6820274C4826
SHA-256:	17E1AB5E0B7C0E9415C402336FBAB39C7DA96F7FD0A3BF2BD7266841DE3FFB28
SHA-512:	0FC57D40A46C4D995049A24568ABBF865B3C3230E650B42701A34E95D577855C21874FD5646C2A28F76733E650D1D89D8492C2F2744D38A23BC4DB157CD8E263
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....,...................................................4............`...@......@............... ......................................./...............2..........T...............................................................H............text...`*.......,.................. ..`.data...!...........................@....reloc.......2.......2..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...P.i.p.e.s...A.c.c.e.s.s.C.o.n.t.r.o.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.Pipes.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	116224
Entropy (8bit):	6.462170106534152
Encrypted:	false
SSDEEP:	1536:9FCQZqOc3R7JqnS4fyov+1tktorWJbID+W75S7F7WpYdi7fjidEI3qx6zsv:9kQ/cdJqnZDrVJbID187WPfjiPo
MD5:	4CDA3CE70F0EE3D9FC78FEA3E63B9B4A
SHA1:	351C75FEDE4DE1BE66E193AD4FFB1B5565B3EA31
SHA-256:	ECDFCAF2D05D3D2765C02E95E7E12CC5274C6EB0302B8619B90B9FEFC52F973D
SHA-512:	94208801B3CB490A91ABE1FBFE10AC10A80C8864FA4A4486946D3187946DA4B8E3A677B3DA1472264E72F280EF2351AE127DC59AC53CD6E5FCCBA9B7C2866033
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....Cg..........." .....b...b............................................................`...@......@............... ..................................T...........................@...T...........................................................X...H............text... a.......b.................. ..`.data....]...d...^...d..............@....reloc..............................@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...P.i.p.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...I.O...P.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.UnmanagedMemoryStream.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.078778583968658
Encrypted:	false
SSDEEP:	96:oiS1xelYoQdi9w4xvjUpDmDsDkpmlWke17wJW:3Wvew4xAQKWjB+W
MD5:	C0C89BF1138D93505EF063CBB2416A24
SHA1:	1A554B6BF477591BDA7A2D5F7CCF9E4D8D10E343
SHA-256:	AF4BE78C35EFC667127694950F84D71E6685645720DEAE1CE904CB415D46FA9F
SHA-512:	BCA16A5D0B6E7836FBE42E66A9B9568787B492D02778CA8633194B070DD30A17B33F24417A055B7AE4C3F9BB90BC9C5644A4CDD0AD00839A0C2A65CB2A77E703
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I(;..........." ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID...(.......#Blob......................3................................................$...........=.n.........h.....#.>.....>...x.7.................>...].>.....>.....>.....>...D.>...Q.>.................h.....h.....h...).h...1.h...9.h...A.h...Q.h. .Y.h...a.h...i.h...q.h...y.h.....h.....h.......................#.....+.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.IO.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.778892854167228
Encrypted:	false
SSDEEP:	96:MfclFmLyj2Qlw83ixvjU3DmDsDtfWveybW:MUz283ixALW2ybW
MD5:	36C92E1D92DC8A048378D56FAA0B03AA
SHA1:	06FAF701AAB76223A10A4477BBC16843F7B02263
SHA-256:	49D604665B026696469C846FD25177AC1C9240A514488C40DA6508A52513592B
SHA-512:	028BE11EF87B944AF3A492F7D5CCABB4FE552E418507D6786BEFA0FE9BCB11CFD2CF2AD8F748C50C0134DE1481FEEDE0D6F4BC5BDBB759A33C66A12C9D7302AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ...@....... ....................................`.................................3..O....@..(....................`......d)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B................g*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~...... ...#Strings............#US.........#GUID... ...t...#Blob......................3............................................................=...........h.....#...........S.....i.....8.............................Q...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Expressions.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3756032
Entropy (8bit):	6.7122233898641674
Encrypted:	false
SSDEEP:	49152:H1uax3JKqd27zmqU38Bn11Z39S95RsOB4L3E:Ozjnx8viOB4L0
MD5:	82F8A7A5601867BDCE5964D53F263B4F
SHA1:	49A31CE73CDFD23D33D44141B3454E21677B920D
SHA-256:	BECABE077C14ADF39DCF4AB5393FB56F4211038A6D6C17D2A9A4D262DDB0726E
SHA-512:	D4CCAFB57ED29672DF52D893E319D687C0D89AA73B17F1C29FBA53E2348D41F6F5C8F174453316EE280165AF892B1C257DD9D98737B322437A5977A01250F50D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....T..........." ......(..................................................P>...........`...@......@............... ......................................l./.`.............=.Xf......T...............................................................H............text.....(.......(................. ..`.data....5....+..6....(.............@....reloc..Xf....=..h....8.............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...E.x.p.r.e.s.s.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Parallel.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	787456
Entropy (8bit):	6.825896543349318
Encrypted:	false
SSDEEP:	24576:8uMorFecA474YDlVUlpdT079+Q/J9ps1wG2:8uMorFet474YDlVQz4syb
MD5:	9C7E101FE0BBC42CAC52B140F5F25859
SHA1:	83C53589F93FC623B094B8CC991E866A6019FF70
SHA-256:	11B921B161FE58C2557A359CFCCB0CD4D45DA865F0EE3A3A37B737D8F849F7F7
SHA-512:	5AF8D050C060B23700E6885DD451FF9E5E09E2CAC0526C043C36DF177B889D5150949E390C5BBD1B65F4D43BAA1F6E28C5FD9627B283C22F86567F2CAFF84544
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...f.n..........." .........b............................................................`...@......@............... ......................................X[..db..............4...x...T...............................................................H............text............................... ..`.data....H.......J..................@....reloc..4...........................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...P.a.r.a.l.l.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Queryable.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	6.462883654591577
Encrypted:	false
SSDEEP:	3072:LHmMA/OjafRHgAuWZmIiq1WCidNh7M2ljO/ww59JKetLUoAez:rmMG1Hbi9Dq/ww59rA
MD5:	27030F72081873D128FD464F3336589D
SHA1:	9CCBB2E9291DD2B86C583372CE75F0F64AEACD12
SHA-256:	5E66DAE99C63C6CA38DD7D924A64A584F4157EF6B952A6B4215FB03FE7FFA5D7
SHA-512:	79E4DE215EF8D9DC03EB1C1813B7E4C774857D8ECEF5EF530ACA7E9E6BC37C83537BCCD865CA12ED4E66FC6BCD5C889DE4C05A807732C7465B155C7B287FF578
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........................................................f............`...@......@............... ......................................\................^......x...T...............................................................H............text............................... ..`.data...L...........................@....reloc.......^.......^..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...Q.u.e.r.y.a.b.l.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Linq.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	519168
Entropy (8bit):	6.808950205715354
Encrypted:	false
SSDEEP:	6144:Obt46R7E2bufbFHJMo8QWH/Yz7Naze+kudjobMELq5F:Qm6R42bEv7oEN+qugI
MD5:	AD12C2655027237B6FCF87E6381CEA35
SHA1:	9AFD2025A0C38499C1238D870375C205D8F8F59A
SHA-256:	AA61DBF88E8984401E68E3ABB5CA2DA9D4D0ECD8FD5120FE00C1A3A7C2E9D1D7
SHA-512:	84F9BBCEB2011CFA7E0C0BA66021C6A588B2A0658CFFF30D510323B2842F63933C06D8C8CC96E287F318E10D8D77B87896E89FA505832AAA7691AE8E6972B638
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........d............................................................`...@......@............... ..................................4........H......................T...........................................................8...H............text...<........................... ..`.data....R.......T..................@....reloc..............................@..B............................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...0.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...@.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...L.i.n.q...>.....F.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Memory.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	136704
Entropy (8bit):	6.72496992016467
Encrypted:	false
SSDEEP:	3072:V0XfKRabktMjDkmzpZUdLdj5vwZuIBo7MWU66oYdsCBuqmw6bq0o7/m:6X2Yky0LVIBo7HrGsCBufbVoT
MD5:	B583CCD58819ED4B81805E408AAB1CEF
SHA1:	BCDF0FD20BA619640646CEA9AD877B90570DC3F1
SHA-256:	0B9858DB34990698A1BCAA800EC02F882D3B684C6063511687DD53FC3D72368C
SHA-512:	4DFFEBD48E41D8EC0D569503056F6B2F29F190F5C48B6FB333B7D528F83E100FBC15C267E741CE655A8107D03BC9D9CE206B7B3A2108068C50A24AF8D1D8A219
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....pu..........." ......................................................................`...@......@............... ..................................D...l.......................(...T...........................................................H...H............text...L........................... ..`.data...Q\|.......~..................@....reloc..............................@..B............................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0...4.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...M.e.m.o.r.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...D.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...M.e.m.o.r.y...

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Http.Json.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	6.5087516155737495
Encrypted:	false
SSDEEP:	3072:luOb5d4gWmeOcbTRRY4bety7/VhpMkMA:wOVdpWnOcbN3/VYdA
MD5:	C7CC2392DB6B99BC3B6A1341572F1A85
SHA1:	66A9271367EC21CEF366C9526106826790E20976
SHA-256:	7341DF48ABFBD5F294F1BACAE369BFC0872E40FE6FC1703FC25CEA4AA787F547
SHA-512:	8AF9D756A6E1C4B3B30A257FC040CB8B866BA1BC9B9BE0CF48F6A418AA356246FB762146333F30A5F0164A69F73E1AD3A89891B71D5DF6F1620BC5729EBBED81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....e..........." .....<...l............................................................`...@......@............... .......................................e..<...............p.......T...............................................................H............text....;.......<.................. ..`.data....f...>...h...>..............@....reloc..p...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....?...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .e.x.t.e.n.s.i.o.n. .m.e.t.h.o.d.s. .f.o.r. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.l.i.e.n.t. .a.n.d. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.o.n.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Http.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1731072
Entropy (8bit):	6.738860186622108
Encrypted:	false
SSDEEP:	12288:c+aZI8XsooaqbrQ37gBYdDqxKv4cBAV5n9v6m8yleb6BmEzvR1deL3y460/Fnhzv:c2AOapcBYdDq59gbuJ1bm6dAZ
MD5:	7FEE3FB9BFDEDB206FC89046E19AD114
SHA1:	ADD7E7AB17196826441882613F0CA8E735F4BF10
SHA-256:	B90D7B69010A834986B9D13A25FEF9E5C3AAD0845C8C1DE077BC6065AE445AB8
SHA-512:	5A81D21912963EFAF366AC6E4360D8E879A31CB718E4F9652753CD3FF156A7775623BC7BDBCC89E98E73683AB932F074553803F1D071F6402688FC6978D911FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...f5............" .........................................................j............`...@......@............... ..................................T....f..x............J.. ...@...T...........................................................X...H............text...l........................... ..`.data..............................@....reloc.. ....J... ...J..............@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...H.t.t.p...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...H.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.HttpListener.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	285696
Entropy (8bit):	6.58944813686511
Encrypted:	false
SSDEEP:	3072:3BBPeC7rtVrVNd8wUVP51gTuB58NyHJuvd0Ge+K6+uZ1eV+e6nRuCD9wElCb4Frf:bWODifVJul1Zu+e6nRuCDe+xK5Zk6
MD5:	57BF9720405C08E59CF908624725172E
SHA1:	2B135C8F1150700EF03D3D7DDB38447321A9671A
SHA-256:	78BC9D4229A1C1467D08E40649A1A4B48A9B8C2158FF925F263D817BF3C55CE9
SHA-512:	F5721D506AF5997DD1695F083225B635FCACADCEC9889B7D38E26C2441087726FF72878A4AF3825B9738B0D8A77026C980251C8D046559CFC5DE7BBCFF4576B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....V[..........." .....h...................................................\............`...@......@............... .......................................................T..........T...............................................................H............text... g.......h.................. ..`.data........j.......j..............@....reloc.......T.......T..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...H.t.t.p.L.i.s.t.e.n.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Mail.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413184
Entropy (8bit):	6.67778940792755
Encrypted:	false
SSDEEP:	6144:N3AGnQkwXRQEh9M2J7ESRL9BFM/+MZvD8AK3XyZLmqXS9EJ8kk2eFqrCRtFFwpaF:NkXOEQ2J7je+M1A3aS9h3Fy3
MD5:	7562AA41769F68332100FA66CE908451
SHA1:	21612F7CD2D28908B591B09BC9C77FC7F5CF86A9
SHA-256:	62D2652708B313FB6B9FFA648F9B3DE6356E373BF65E8F9731382AC615A17B23
SHA-512:	77F3457655CAD57CA11000D40DD544D8AE9E1E025C4CC3D62CA95C6D1F3C439B785B161765627A1509636BBCA1AF1408E68A66463894E89B3BF94875AF95B38C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....&............" .........Z...............................................N............`...@......@............... ..................................T....b...)...........D......@...T...........................................................X...H............text............................... ..`.data...mO.......P..................@....reloc.......D.......D..............@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...M.a.i.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...M.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.NameResolution.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.447404887210108
Encrypted:	false
SSDEEP:	1536:h5sRcDC+NELuF+bObC4D3LAf74i3yLrnJgeDz:h+9+OaF+bObC4nAjh3yrnJz
MD5:	7B30617FC3575568A89B6064C57AC15B
SHA1:	15E67607486D91DEB8F067857DC163A3EB8D078E
SHA-256:	DE58689B2B2CB62EA2D5423FE6EF73E24EF8797C99490CC6349F858230DE261B
SHA-512:	6C156600201FCB0F4A74A0C2A8D57C03BD2B247394EA3C4CBA01E779651BFB590711C4BB514386764907EAB9B71C3FE3464388679AEDC87AC9FF63FA65FDAFAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...>............." .........@............................................... ............`...@......@............... ..........................................\|.......................T...............................................................H............text............................... ..`.data....;.......<..................@....reloc..............................@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...N.a.m.e.R.e.s.o.l.u.t.i.o.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.NetworkInformation.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.5031321359606125
Encrypted:	false
SSDEEP:	3072:0xf/6FYw8QvvhZsO4camxvUtl0/e/pdEwwm13G1QD5gEF:IfE10m/gEBkG1QtgE
MD5:	67C65D1EE1B00ED51A9AF548BD850F04
SHA1:	DE03EE26D6FA98718D4ACE8ACBF8F0DD5022570D
SHA-256:	3EB4389CF19B4C871FF7524D604CAF94408A875B35E74CB7A105D9B54FC65597
SHA-512:	AD1E411C9053E663669CADFD01770D6295DFEB701EE2546CC2F4995815ED50A34C8FE7909299A1CCCF1313A8941BF629E313914B6A7889B86429D464A93DE476
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....nd..........." .........`............................................................`...@......@............... ......................................H...P.......................T...............................................................H............text.............................. ..`.data...c[.......\..................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...N.e.t.w.o.r.k.I.n.f.o.r.m.a.t.i.o.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Ping.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	6.477366379379019
Encrypted:	false
SSDEEP:	1536:kMo69SAzJbsJRttKVsRQYERW0rtC3XO9OWM2KaB:kA9ZhgTOYEM0hKXO9OWM2KU
MD5:	6D8465EE5E39926BE7539C0824E6BAFC
SHA1:	D8CE1D6B2FE38A44EF546D914BD17F5AD304ACB0
SHA-256:	E461896412ECDD8751A73F4F785916FCC4BC74AE36C852093E592FDE4046E14C
SHA-512:	B50FAF48791BE0DBDCBDD9CDDC55CC6EE4B487517292E1BE67084B2CF82070F4897B5A4D022C99A90608AF3B18798591E40C075F0F7D709F200AA790728D38FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....Q8..........." .........B...............................................$............`...@......@............... ..................................T.......x............"......@...T...........................................................X...H............text............................... ..`.data....>.......@..................@....reloc......."......."..............@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...P.i.n.g...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...P.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	6.681953117634609
Encrypted:	false
SSDEEP:	3072:CJYwvrbBpyEHU4LPGsoIHzUu5OuVtTspo4X1i97uZHoHfGt1uvDFXCTetdE9R9zU:kBsEN+G7TspZX1iA5SZlt29R9Q
MD5:	D41FE29408DA171D54510321FADF3BD6
SHA1:	C8A3773FA7B8BEB17A8B0825665709BA2E5F3713
SHA-256:	E077D50205635FF243C8446610BBD8752A1A58FC91546DFA969C9E05C45E269D
SHA-512:	8EE4DDAF68D89DFC95E3F9F2BFF8BEB2785C5E82ACA8012E42804C754F9BAF07C59966FF5651EE4424DD76D856026AFE427C04A0A568D1864A3CA9625E2CE67E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...&.p..........." .........................................................V............`...@......@............... ..........................................(............P..........T...............................................................H............text...p........................... ..`.data...n...........................@....reloc.......P.......P..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Quic.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	270848
Entropy (8bit):	6.634439248669945
Encrypted:	false
SSDEEP:	6144:kSvcMvPRRJAIc2KIox5XzixMlPMXVo978yi:tvcyFKIHMaod8d
MD5:	839194D5A1AECF934C3AB376BB057E81
SHA1:	E7CF945A4F461819CE1D337884BEBA71024E8CE8
SHA-256:	BF92C70FC9B7D4F48376C2AF27701ADF6A5AA353845569C50656D9F45CAA3FCD
SHA-512:	4E5682A22CA12DF86B0AB7CEF4B360D8200112A7303A5A8ED4C982DD7BA37FCB3FA30FC0FE3F6B2CCED6AA0090FC379EF7632B469A76575ED48E19B45A82A675
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .....J..................................................."............`...@......@............... ..................................T...8................... ...@...T...........................................................X...H............text... I.......J.................. ..`.data..._....L.......L..............@....reloc.. ...........................@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...Q.u.i.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...Q.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Requests.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	330240
Entropy (8bit):	6.595588049905341
Encrypted:	false
SSDEEP:	6144:1FVetdUAYWCztve78jDYWXpAB5h1/H2CrS:1mtdUAYWCteUsn/H+
MD5:	88CC6BBFB105ACDF283516F19D39FC95
SHA1:	EE772BABDBB808C6624E5C809001161E07938CD9
SHA-256:	2695D2CC506957970B0EEFCE7713CA2212D2F8BE8412EE1DFDBE35317C698F0C
SHA-512:	3B3C7AEE79D696F9ACC27E963C3EB9ED102B22EE4D2AA83AE0BA65BE5921EDF068D76F07FB0AE335FD6029F3D2A6CF57537BC5A34D849C8B66A7E95956BF0E2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...@............." ......................................................................`...@......@............... ..................................t....T...#..............P...h...T...........................................................x...H............text...@........................... ..`.data...............................@....reloc..P...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...R.e.q.u.e.s.t.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Security.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	700416
Entropy (8bit):	6.807624791653739
Encrypted:	false
SSDEEP:	12288:I/lkTLxk5ROlI0UWcFOTy7Z0goBmAq+cjtMIyhClzINsnd9P0+K:EYK5QlI0UWcwW0goBmAq+u4IINsnd9
MD5:	66B877D792AAB5C0580D45390117CDA4
SHA1:	E83ADC597B056C51073272DF1F069EF21431A759
SHA-256:	CB0F6708BF9884BBC98CFCA4841F9FC30FF6DBED2D7C175D445B64D66DE60D19
SHA-512:	0C2A0D477626A294CB8182FD941C5EF2450FFDFA860CF659DEF176024AEB6E93F8FE76FBA50632701CF41785A88D9571919DC4EE30C21EE1DE818142191E60A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....EP..........." .....p...>............................................................`...@......@............... ..................................t...h....<..............t...h...T...........................................................x...H............text...tn.......p.................. ..`.data....1...r...2...r..............@....reloc..t...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.e.c.u.r.i.t.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.ServicePoint.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.955142049619675
Encrypted:	false
SSDEEP:	384:CW+4FW/euufjXrLWa7hfKzpzY7y/enGRqCo9dbe3a23wLdRWwaJwQ/WMv:Z+eucTWoKzpzY7y/CkroiIon/WM
MD5:	8E1145CA6EE8FD4303FCDDBEC1E01DBD
SHA1:	B8C957BCF2A3421739EF3A8E1C40830EC33F9771
SHA-256:	321F28751E273612B781B7ABAD4D00FA83E455DA3E12E20498AF608CEAEA3495
SHA-512:	8D0A4E7198EBB9DFBD1A907AE1016748A922FFD1A24F1C055F93C57656F6689B2FCA4F15DEA341AA67D8EF86EB04D4DA78500B991AF99FB8F28ED34D92C264FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...v............." .....J...................................................`............`...@......@............... .......................................S...............^..........T...............................................................H............text...,I.......J.................. ..`.data...y....L.......L..............@....reloc.......^.......^..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.e.r.v.i.c.e.P.o.i.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.Sockets.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	583168
Entropy (8bit):	6.753702657095805
Encrypted:	false
SSDEEP:	12288:LI9J9FcfCIewyCuDxe8ez/rJn/Im1BHXS:k9JQNyY/Im1
MD5:	9E16A6517C5E37F8BA13E456BBB3D4C2
SHA1:	7DD1A0ADD4C0CE578360F1F12603C3CD3567FFDF
SHA-256:	7E124B4787435B3F67DA85EC746CCBC10F9B116D93E44595CC37ED673092A54D
SHA-512:	A3CCC44B361A14E44F6667E817285D0C8F4093F1F67DCB8B81DFD4208E13540151EA81EA40E35694175CBFCA9AC677E417A8655FE0FA8C9FBF2F7214313222A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" ......................................................................`...@......@............... ..................................t...tv..x<..................h...T...........................................................x...H............text............................... ..`.data...............................@....reloc..............................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.o.c.k.e.t.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebClient.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	152576
Entropy (8bit):	6.60158641558836
Encrypted:	false
SSDEEP:	3072:+IBDOnYBHMp1Bnn+PIJ55jk5q2pJY3ykJ9riDO0/l5RZ:+aOnesp1UIJkXpzNZ
MD5:	CB116CDB128636FBA0851446BC67D86E
SHA1:	94B7F16A87FDF0BDEDFB4F96B696BC6DA0670E7F
SHA-256:	EA06CA15628B49E4E52D4F6C289FF752374BFC1EA4D0F6D8B57B8AA77616D5FF
SHA-512:	2DA5FEDEE46EA04BFC0E18F38D03A6EDD5382194201868BB95BDBAAC06ACC9B0AE6B43E0C94ADD641E08A3419207C69DBF43B4691571C0AB7E355F725A2A3448
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....-............" .........................................................T............`...@......@............... .......................................................N......x...T...............................................................H............text...t........................... ..`.data...............................@....reloc.......N.......N..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebHeaderCollection.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.268264929396533
Encrypted:	false
SSDEEP:	768:m71xWYfg4YhiiodSy0Yx82s88krahmqOwA83qJKAFE6WHKV6q6G22N74GK6RH4w3:m71xi4YhiiI0Yx82s88krahmqOwA83qA
MD5:	06D2D3661EE4170E846469102C3D1A41
SHA1:	2ED6F98F4F87275BCA0A93C4B8A99575EE2B7ECC
SHA-256:	B22FC648E777E6F5A0D45F0D4615F0499A96089DBBB7D79B9E1C685800CD236D
SHA-512:	8E651E4F953485B74188972FCE8482102EFD7EC6C5ED0DAF756063452CEF7BDE34689F556BDBD26F55CE33D2158D6C78C7BEBACF78554BDEC5CDCB54F510B68C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...y............" ........."............................................................`...@......@............... ......................................x...........................T...............................................................H............text...H........................... ..`.data............ ..................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.H.e.a.d.e.r.C.o.l.l.e.c.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebProxy.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.028768141793083
Encrypted:	false
SSDEEP:	384:6w3WpvwWUWKmBOdzbOGKBEbCLv+CT1LfyORE/MRASYEpN:6weallKBEtO8Sr
MD5:	C95740CE54C465189B5FCED0D469F515
SHA1:	7E2E27910E477ED5079B8A1E43A8E54D9BAFA79A
SHA-256:	DC8DCE4766AE7D744D012DBCB73682727A8062B1A674A7DA73DF53690597F1F1
SHA-512:	A4498202D486B4DD83C1C22F01CD74608456DD5A42403B6671E7F8D6256C6980FAF140C857C6E86EE05E4917D66E0D81F6E6555FEF29E1127F85ED47BD8D5255
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...R............." .....B...................................................X............`...@......@............... ..................................t...dK...............V......`...T...........................................................x...H............text....A.......B.................. ..`.data........D.......D..............@....reloc.......V.......V..............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebSockets.Client.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.358159728836867
Encrypted:	false
SSDEEP:	1536:X4Wh9IUej4NrcM+vfH+Eu7U7b3aZVO4arC:XhcdpM+vv+Pw7b3aZVO4+C
MD5:	F9A1ABFAF030006B1C3F1AD7C1A49ECB
SHA1:	1AE4CD43AD74513DD9DB528795241F8997A10546
SHA-256:	42D9167874898B74B97D43517F216FD621813D8CDC1E5E0B0A7F2660A5171B33
SHA-512:	B5EC032E6794A9B93B2AC958C02EB0BDD48350C1E6E0EDED67EFD27CA191264D51E014E4766ECD8B1C5FE2A82063701A8D11B6ED5E46FD61ECFAE02C99B3BFD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...h.Y..........." .........D...............................................6............`...@......@............... ..........................................<............2..x.......T...............................................................H............text...\........................... ..`.data....>.......@..................@....reloc..x....2.......2..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.S.o.c.k.e.t.s...C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebSockets.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	169984
Entropy (8bit):	6.603390109773082
Encrypted:	false
SSDEEP:	3072:gG5tl652ar4DfgIUQeu0IeW+5YLbRbmvhIhkH9mUQ/JYf2:z5t85yDNQzIeW+ymvhKRUQxZ
MD5:	1A451267834F26ABF719D432DF3C27D9
SHA1:	40EF040D9B296F5A02A0AEC1864DC90E89D3F12C
SHA-256:	CEC8C973C26921E6B4E3E88697104DC8B2D163608E050A04516EDC26C1A75253
SHA-512:	C5DE8F1174FB1225E49090FB8C284CCA93E8851712C55F576C14C71835261C451D0CF998B58A946AC853BDE5EB5F1A3AB0B430E21BFD9A5D1A3E9F93463E889A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....#..........." ......................................................................`...@......@............... .......................................;..................p.......T...............................................................H............text............................... ..`.data...............................@....reloc..p...........................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.S.o.c.k.e.t.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Net.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.185627921923958
Encrypted:	false
SSDEEP:	96:Ne+lzHfhBterf8pKZyS3MgxvjUsTDmDsDKydwW+lWovVaW:DhHbcrkpKZyS3MgxAsMQZ6WovVaW
MD5:	48401E6ABAD9E7DBBDE3EAB46AB0ADFC
SHA1:	BB4BE6C45E17878F37E66337275381E63CEB7673
SHA-256:	A97AFC19B07CDD7A519359AA9D4E28E38A5A13DC86A148D1196BC3A779B8B534
SHA-512:	6113F1CE28C922751E69C02B77C7E26F83D22CE0DCDE6C081C820C32491A083A86D48BE84F77E5F277FECCCC6CA10BEAB41DCD71C357784A64D26203E1E797DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$............." ..0..............1... ...@....... ....................................`..................................0..O....@..8....................`......./..T............................................ ............... ..H............text... .... ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B.................0......H.......P ..$...................t/......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings............#US.........#GUID...........#Blob......................3................................6.....x.........................../.......L.................................p...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Numerics.Vectors.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.885246657974751
Encrypted:	false
SSDEEP:	48:6eqigv7dfJnMn4zdiRkrYme+IvOX0uNPCDmDiZDF0bdZxjZWsXK1f5WmQK:UiAhPdi9XxvO0DmDsDgDWa0BW
MD5:	2D3729FB75CDC5FE81C7B6EDB7561FC4
SHA1:	8623F2D9F247645EC844658936CE747369F33A41
SHA-256:	3E374A3D49607095CE7FBFEA1C0AD37C1861C2E07A9EC5C4E5AFC26473C4DFF5
SHA-512:	74A475F3F7CA48E5BD2567B39F106578CD78EE594FB56D09543BDD726FED1A53B83CA7E6C170FE7E23CAD500FC07020BB80942D24017B067EEC9A897CCE57319
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PN............"!..0.............~... ........@.. ....................................`.................................'..T....@.......................`......,)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H........ ..\...................P ......................................................................................................................................................................BSJB............v4.0.30319......`...8...#~..........#Strings............#GUID...........#Blob......................3......................................D.........]...........v.................\.r.....r.....`...8.....0.......r.....r.....r.....r.....r...}.r.....r...........6.....

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Numerics.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.6582940221857405
Encrypted:	false
SSDEEP:	48:6p+lClUrDluSTfxWVBAZadCcCEmKXkQP6zDmDiZDaOqsjZ9wknZWUzKRL5WmQKu:/tPluS7xWVclsUvDmDsDdtegWeQNW
MD5:	F9104B5AA0D19B51972DECE833FF2ACD
SHA1:	182189AE955469297908008517F3DEA915D37452
SHA-256:	3E6047EF208F2070ECE524D4F0B0E97C29D4D035F6ED8CB9DB5A48DDD25663E6
SHA-512:	093D7F83028F2843260BB664A608E9CB99966FCA809BB45E32300A41C948211CC1BFA2B501CAC98AA4C6574E3199C5F79FAD53B2EE1BEF9A0762B71A1AD41E7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^............." ..0.............Z)... ...@....... ....................................`..................................)..O....@..X....................`......,(..T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B................;)......H.......P ..\....................'......................................BSJB............v4.0.30319......l...8...#~..........#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................'.f.....f...e.S...............K...........{...........`.......................G.....y.......-...........%.....%.....%...).%...1.%...9.%...A.%...I.%...Q.%...Y.%...a.%...i.%...q.%...y.%.......:.....C.....b...#.k...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ObjectModel.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.310650250920982
Encrypted:	false
SSDEEP:	1536:80QqYyjTukJbxyfN3QSsMWrHG43RNGQa:80YyjTxMN3yHG4
MD5:	E7940924FA3CA0A19527F29417F85545
SHA1:	11FF10C9A0D1C1354E1A0CCE36525CA3040305A3
SHA-256:	427E9424B2E1988D02F03BF84094A90A29E258A2E6E99E42DA5086F68D530FF4
SHA-512:	0321716C4A04B1CB42D90337C4C9811ABE9234FBBF667067BD38C3DF3FF6BBB0D96D0E2A52617A1423DA51338EF3CCBA460C727CEE3618F04498DFFE2452B905
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........4............................................................`...@......@............... ..................................t.......................X...`...T...........................................................x...H............text...d........................... ..`.data...'0.......2..................@....reloc..X...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...O.b.j.e.c.t.M.o.d.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...O.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.CoreLib.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12754944
Entropy (8bit):	6.874266685134611
Encrypted:	false
SSDEEP:	98304:SLAbobdTDh4dZflcEH5KP/f+xYKDCsultSwLiYopPp44VBML:aBbdfhSLoP/f+xYKm0MnoppJML
MD5:	5C07B5A5E0BCB2522BBE43FAD90B7CA9
SHA1:	FEDBD5291CA140DF5AE02166C41858EDEE2A1ADE
SHA-256:	A5733C3167302DA127CD1651475BB129C7BAD5247F0946F4D3D55803E5FDDCA1
SHA-512:	64698F9B97B71EF2CFDE1B65B525BF7DFEE062FEA157ED77FD3D776C21969A4AFD6A1C71FCC202196144B419D0837A245B7A16703806B3EECF8FEACA3E0AF424
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ..............." .....................................................................`...@......@............... ......................................H..........................T...............................................................H............text............................. ..`.data....&......(.................@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...C.o.r.e.L.i.b.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.DataContractSerialization.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2087424
Entropy (8bit):	6.763868149103118
Encrypted:	false
SSDEEP:	49152:JflNEAaMRtZAXOESAjVzeT2mOofLF12aLLvVrNI5b:JYAdRISx/vnu
MD5:	085BBBA5659ED8A044C43A1B2943F2A0
SHA1:	35E1D4E81419A3135117CE30464BEC9B13AC200B
SHA-256:	CDFF2FD69BD5EAD311BA4F914CFDDABF3C8755865E46540018DC57625242AF91
SHA-512:	D394F631AEAC3FEE5254C9D4E36554E66B4302FFA77F8008252D17AD6F14555E4A90C19B7F35500597A68EA09E6BF7571A4BF9A2AFAFE96A8C7BADC832199471
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....S..........." .........8................................................$...........`...@......@............... ..................................$....K................$..'..(...T...........................................................(...H............text............................... ..`.data...............................@....reloc...'....$..(..................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........,.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...j.)...C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...D.a.t.a.C.o.n.t.r.a.c.t.S.e.r.i.a.l.i.z.a.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...z.)...F.i.l.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.Uri.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	238592
Entropy (8bit):	6.779628935369436
Encrypted:	false
SSDEEP:	6144:Hg7DtXzvjktD2wEXcMG3rxqoeVmtGOlvzHJKn:cDitDSXcMG3t7amtGOl9
MD5:	529ABB4E2A2A4F1BC26C682B7C468CBB
SHA1:	C3D3927E9FC77F9EB3BD9D7F04BF4C2DB881E1DE
SHA-256:	6B1BCA224DE35D0C3DFC3505D138F1ADE12FAF9722BD8AEFC5B8A43C276CA5D7
SHA-512:	C8AC42569B34D19B113FAAA81C20FA4D48CD71EA7BB4121F63380AEFECB14206C75D42ABC89BC69DA96BAB358C55D816E0BEE10BE1FA698ED53294BC1FE80315
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" ......................................................................`...@......@............... ..................................t...X...`...............P...`...T...........................................................x...H............text............................... ..`.data...............................@....reloc..P...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...U.r.i.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...P.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.Xml.Linq.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.718948645274057
Encrypted:	false
SSDEEP:	6144:lMtYE36NyeOI+iiRxpXQgxCkjCOYQQrLvsHpaEtNq+:lMtYE36uI+tRv/xNjCZQQHvuaEHq+
MD5:	0EFB3C94B728253233A3D24FEF5B563B
SHA1:	0EE2C0FB55794B1C7BC42E561D005E3BBDA45673
SHA-256:	6D450E0BD5717B79DAEB24A2ACC4AD36E995CDBE2841FD4583EB8D616F0CBBB7
SHA-512:	893182DE5A8AD0B94EA9803118A8F2AFDB68C278F21276135D840559D935FC1C604CF6390FEE23C651165BE3F65438A7406B5F34C5EC7DC61024A4ADA3174B16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...^............." .........`............................................................`...@......@............... ...........................................-......................T...............................................................H............text............................... ..`.data....V.......X..................@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...X.m.l...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Private.Xml.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8122880
Entropy (8bit):	6.83210086307047
Encrypted:	false
SSDEEP:	49152:aM8bq/XF+A2NKYiPk6Jf4aOfCFqbVXIoGb5qWeLFfMBrGpHobw27sYE585QeB2SY:aM8bq//f5cIa+QSJM0f+t50
MD5:	A4427BEC8E57CAFECAE1B6FB7FB5E522
SHA1:	27859BCAA240C558B39F6502C2B38D3650217148
SHA-256:	1C3AC8E9F530E3C461FFCB5921E8FEA5CF1E9CF0325A675E3C7DA8CC504DE65A
SHA-512:	58FF8E453BA93C0ADB60D9EB4A6D0BBB14537783EA24725D96C410A1A4D9C26E2F17DD649230455C96238B944CE900723768B93590A793CF8974808261E47EC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....(..........." ......d..*...........................................................`...@......@............... ..................................t....Dm..................i..`...T...........................................................x...H............text.....d.......d................. ..`.data........g.......d.............@....reloc...i.......j....{.............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...X.m.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...P.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.DispatchProxy.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	6.447064997049979
Encrypted:	false
SSDEEP:	1536:GebuMsy3dNvbzTMuSxRVHJeeyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyu:GiuMsy3dNvbMxRV0eyyyyyyyyyyyyyya
MD5:	85F6312BB40AEB55A1D3BF9B6EA39D22
SHA1:	1B000C43655649698AC51C1BBA5338B581F7661B
SHA-256:	CBEA32864BA177BF1DA31DCE8506F83FF052B2C1E50BE9169E5D990A0B975819
SHA-512:	613F156570A548B610AC3CC1E33C0DF7EAD2D300FF1C34DC43DC6AEF437F60C328FBFA11E5D4E6BEEBE4F7AFEDF63FCF104272F01A8E0D4A6D2BCA99F75CF055
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....n..........." .........0............................................................`...@......@............... ..........................................\|...............\.......T...............................................................H............text............................... ..`.data....+.......,..................@....reloc..\...........................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...D.i.s.p.a.t.c.h.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.ILGeneration.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.00426516671027
Encrypted:	false
SSDEEP:	48:6EKXHZz8diRkMHBc+IvOX07NPCDmDiZDXoxTcZ9nEZWIoFKtAPo5WmQK:XdiR+xvOnDmDsDXRyWVTUW
MD5:	744A32047E063611B16D58E53623BA43
SHA1:	0448FAA29CE21B2EFCFA25F320DE885A681093F5
SHA-256:	4B013E49AC9410461DF0B061528DE0407AFCA7DDA01D48B86DA42D38176B4C1B
SHA-512:	1EB45217CB47325B44C8F0B66447CB6584E03E532B3FFD58CC58C7DAD4DDFB99663CE8DE04790D71AFF5F4D8B205033DE6CEF879BDAF4F714A00FE46BBEBEE51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...E............."!..0................. ........@.. ....................................`.................................G..T....@.......................`......4)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ..d...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..l...D...#Strings............#GUID...........#Blob......................3................................................"...........;...........f.....!.b.....b.....7.................b...[.b.....b.....b.....b...B.b...O.b...v.............

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.Lightweight.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9011345011572405
Encrypted:	false
SSDEEP:	48:6AEcUeBpB2F0sdiRkf0S+IvOX0INPCDmDiZDIwf3ztZynbZWJomKk0VPP5WmQK:/UpOsdigxvOUDmDsDI0LOWxEVJW
MD5:	802D50B3497EB3D872821C424FBF31A6
SHA1:	5605880A7D2B7AF43D2CEB39B19E96665E527921
SHA-256:	F7FDCC8635D66B707B6556E395F9A73449A886EBAF0E6463E5EF27459829DBCE
SHA-512:	BD8745361C5D16F51826EB8C75712FD8BFF63B908B621D0FD436B076BEEEB48BC4D54DFD790AA2306A6540300D525161E67FFCE795CBFDDF31229351D813D34B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0................. ........@.. ....................................`..................................)..Z....@.......................`.......(..T............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..4.......#Strings....<.......#GUID...L.......#Blob......................3................................................0...........I.k.........t...../.E.....E.....>.....~.....~.....E...i.E.....E.....E.....E...P.E...].E.................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.423128033613358
Encrypted:	false
SSDEEP:	3072:MN53gnriRYbKatxLnzBsVkrcn0uZQ1KEy:EWWSrn9suJuZQ1KEy
MD5:	290137A4FA63839C9ADF550F0E898B1D
SHA1:	6CB81EB8175C99B9BB578DEFDB4344F18D169E1D
SHA-256:	B6396812EF195622E0977BA1531D037287E33B74A1231CC5D3E3C19F9CA10C29
SHA-512:	368B9B8FCB9AF07973938D336370978B51CB5309377467DC6393557CD639068DAA84EA4E83E3624EBACCCD930535E230A07C749D3DA9EA41373B1C6B80BBB52A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...=.V..........." .....\...J............................................................`...@......@............... .......................................x..l.......................T...............................................................H............text....Z.......\.................. ..`.data....G...^...H...^..............@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...E.m.i.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Extensions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.9530092592196775
Encrypted:	false
SSDEEP:	96:9sWkvlvSX8y1gafxvjUeDmDsDupzWKZWW:Qv8XzTxABWKZWW
MD5:	419E86D791240CA2B77045BFABE140A5
SHA1:	B2A3F2AEA81903F5CB43242B00593EAF18DF3527
SHA-256:	099734B7101A9ACD83CD10B71B6D5CC944C1377ACC2C6E2D3A1B97480C593657
SHA-512:	A8581D1C50273E23D86F6F3D17895D90335C7B720A8CBF5BC1A42DFE57BF6BC3F8563F643719C670162720B2A38DC72992C6EA8E430F93B31C8EDB9CEF2660C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............v)... ...@....... ....................................`.................................!)..O....@.......................`......,(..T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................U)......H.......P ..\....................'......................................BSJB............v4.0.30319......l.......#~..(.......#Strings............#US.........#GUID...........#Blob......................3......................................................x.....3.....4.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Metadata.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1087488
Entropy (8bit):	6.6821621981636605
Encrypted:	false
SSDEEP:	12288:cN0z7qnesy63AeclWDlLeO9om5Eoa/m3WlUlfeGW4brW0NUUBXEqTip8iP1EJ:cN0nqne0AecicOWmi/NKmGW4b1mXpWJ
MD5:	7347750BAEAC1804C6A6D577A43B649B
SHA1:	4BF5D316278E91365E1F1FD2C30EC0F4CFA7958C
SHA-256:	B862986B70795F170D01AB3DFD5ADD3EF6BE631283600AAF9068CC7DEFC098DC
SHA-512:	9A1EF3260B550FB9A23145092B4D9F4E635F933263C1D5CDCBBE5911D9BB168B52B339B428297B05074CDFD3268AAE3A94E915BDFF3F0EFF4CBF36D1B6DF996B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........~............................................................`...@......@............... ......................................0...D.......................T...............................................................H............text...8........................... ..`.data...1j.......l..................@....reloc..............................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e. .p.r.o.v.i.d.e.s. .a. .l.o.w.-.l.e.v.e.l. ...N.E.T. .(.E.C.M.A.-.3.3.5.). .m.e.t.a.d.a.t.a. .r.e.a.d.e.r. .a.n.d. .w.r.i.t.e.r... .I.t.'.s. .g.e.a.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.124756911527386
Encrypted:	false
SSDEEP:	96:wvBAI4j2a2disHHxvOtDmDsDjlaLWSx+W:2SI4jCBHxQlwWSx+W
MD5:	64CFDD31499E1E7589CE4A2C841EA62A
SHA1:	D3962760F2283B6835F32BA65DCB608A31A4604A
SHA-256:	401242400FC427D87EF3F141DFD63789846F88371CE67E3A2351B4C44F2354B2
SHA-512:	E534B6F56866C42F7459CF9414536BCBE95EEF1F210CD073A9F0E954473DE5852DD9533CBA29FCAB5E02287B4751E8CF29A907B8DFFB6D3509C794D39E62809A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6..........."!..0..............+... ........@.. ....................................`.................................=+..N....@.......................`......8*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p+......H........ ..h...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................3.........@...........Y.................?.g.....g.....`.................g...y.g.....g.....g.....g...`.g...m.g.................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.TypeExtensions.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.751924391577986
Encrypted:	false
SSDEEP:	384:4NCWmBeWGrYaw3YyEkM0KCfMTzk7TZ5P00a+SKYDlLZmrXr:GIG8aDcTZa+jYRZ
MD5:	BB1EC59C07742849C9351180CCED150F
SHA1:	EF2873BF0CFE6470F29FE34F3CF532C19DC54C37
SHA-256:	F864A8DD2A304E9FAD4E2CA49F07F4CF26DED3D5E866630CAFF7D5B4DF678E5F
SHA-512:	A9EF7121797F5EF0B2AD20D585605C7CCB64C8375B245AAC8D868375483C85325831E666803E5C5CC9EE6094A50FE34E1A580FC181BCC19300764B935D3A419D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...b............" .....B...................................................T............`...@......@............... ......................................tJ...............R..........T...............................................................H............text....@.......B.................. ..`.data...=....D.......D..............@....reloc.......R.......R..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...T.y.p.e.E.x.t.e.n.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.9954754259958176
Encrypted:	false
SSDEEP:	96:WQcl4kmyPZ6yluHNobjbhxvjUoDmDsD186wjWhFCW:GCkNQKBxAY89jWhFCW
MD5:	C2972BA581575836BAA619F144637BFB
SHA1:	560D5C943BD7BD00364A75BE7F2EA16019A85BA4
SHA-256:	9E1990AF78D989C411847AD079476CD5AE8AB2661B786D8E19A4363674880B49
SHA-512:	02FEA56D48722FA2290D5DFA2E5DC62E3983C6BA54128EC1181B72F944596EBEBB0C6271A7CBE5870C337274F83EADB1CD7A7B549AF046D22C43D635725129CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-..........." ..0..............,... ...@....... ....................................`..................................,..O....@..h....................`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................,......H.......P ......................4+......................................BSJB............v4.0.30319......l...l...#~......\|...#Strings....T.......#US.X.......#GUID...h...\|...#Blob......................3................................"...............M.............................q.6.../.6...........6.....6.....6.....6.....6...m.6.....6.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Resources.Reader.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.8531136005295945
Encrypted:	false
SSDEEP:	48:6r+lCft3Ml33Xye6adCX+Iv+KXkyP6zDmDiZDGRZxFZWsxKzp5WmQK:lO3Ml3Hye6lXxvjUtDmDsDgFW4+3W
MD5:	143546DC2CC649168B662333CD9522EC
SHA1:	F1E3DAD0775F5DD35F8FC59B89668867B3A9F630
SHA-256:	9D8F02EA65DAA27C085CE46D62E59EB8D4C0294C1F147D501E99FBD72ABDE919
SHA-512:	7C87B9F32924D7281F4B1E9D47AF8FFB059C8ED693BB6CF4C40842628D557E248C3D3492FAA4CBBA49338D3141AC5A7374BD11A17C5BD44563C42C013B0B01E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R]&..........." ..0..............)... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ......................\'......................................BSJB............v4.0.30319......l.......#~......h...#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................%...x.%...3.....V.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Resources.ResourceManager.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.8706473038970213
Encrypted:	false
SSDEEP:	96:mA6ljbly3i4S9CjxvjUbDmDsDBewe+WZbwbuyW:n6tbojxARvWV6zW
MD5:	AF7C0203E35AFC4587F4FF3911E755A3
SHA1:	422B9827826A8FC68BB2B37659427C6139241334
SHA-256:	4E81383AEA69834E308B66C8FFE4D34227F4EA62B25F17FF2C0A565B24861F91
SHA-512:	3CC35A376C98CDFFEE2FDCD2C57B0A2B7654E5BA2B869B3140CAB746009A3E158CBD63B32CE5D66ADFB416A4ADA1DA61F9F95FA39F2578A64771870FC42AEA4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............j... ...@....... ....................................`....................................O....@.......................`.......)..T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................I*......H.......P ..H....................(......................................BSJB............v4.0.30319......l.......#~..\|...,...#Strings............#US.........#GUID...........#Blob......................3................................................9...........U...................A.....A...........A...r.A.....A.....A.....A...Y.A...i.A.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Resources.Writer.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.164964673406475
Encrypted:	false
SSDEEP:	768:yP6Fcl/uk2CfmMCfxssm3R2/j0dHYyFM4Ig4P8B:yP6Fcl2/CfmMCoB2Q3KGB
MD5:	8E32ABF8ACF37700F098AA0CD0DCCDA0
SHA1:	9E131125A3A1880BAD083DEFA0540FD03EA40C93
SHA-256:	3CC6DB4E10701EC919252E1BDC58E3975B36C6D8DFAB76AE90C57DFC122207E7
SHA-512:	42BAF072712A0071234B61B74944CDBAF326ED00AA46F0FF6D03ECE7D38E4010C1D3CAC135190B6FD9B2468541D21DA5BDA2EDE40DABFBB03A8C437908008318
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....~..........." .....^...................................................~............`...@......@............... ......................................Xl...............\|..........T...............................................................H............text....^.......^.................. ..`.data........`.......`..............@....reloc.......\|.......\|..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.s.o.u.r.c.e.s...W.r.i.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.9669537810084807
Encrypted:	false
SSDEEP:	48:6U+lualOhW0lzSqnLyFladCsY+Iv+KXk9N1P6zDmDiZD9Ahf8Z3Z4Q8nlZW1JnU+:Kl50l2cLyflbxvjUUDmDsD+kTQWgJ2W
MD5:	8968503FE76B3C8A88AE2C1D9254801E
SHA1:	BBF673478DD67547B4CF5964C13DD394BDE9E0C6
SHA-256:	C02BBA32B2B9E10428601EC2F0BAD0EF40389A03C2FFCC5A2FC284905F7BF231
SHA-512:	7EAC2083E4DC412DEFDAFD5168A9CA190C45BBC6A519160B1B049744E4F428E7814F8DABA8725A2280B3079FD0106FE543FAE8BBB8FBE833DB09A08DCC2247EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U..........." ..0.............F)... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text...L.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................%)......H.......P ......................h'......................................BSJB............v4.0.30319......l.......#~......d...#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................4.....4...Z.!...T...........@...........p...........U.......................<.....n...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.767551768095952
Encrypted:	false
SSDEEP:	96:vEWsCLWPYqaGmvPFV/xLMlUFufVCX6xvP1lzWVrundDmDsD1xHYT:8WsCLWPkGa3ZLMlUFzqxH1lzWVitxH8
MD5:	6E1E3F2B3ADF5D19EC463B35AB43FE5E
SHA1:	F66FBC20A6CD592CE32ACFE3069A7A0D17ACC3C4
SHA-256:	717B3D9E6FC3582154DA6CD728D54EDA324000E493FDBFC768401245AA31E0A9
SHA-512:	D314D07F20BD7AA45BB448DB92DCF73B9DF642F911170253437BA65FC85AC97FCDEEBFBCD64C9B8B4E69551E4D99D9E709000A6AE330289604906C95B836163B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....n..........." ........................................................."............`...@......@............... ......................................,................ ......(...T...............................................................H............text............................... ..`.data...v...........................@....reloc....... ....... ..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...V.i.s.u.a.l.C...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Extensions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.152786926618699
Encrypted:	false
SSDEEP:	96:O1lqyQGQSj5onbC/6VSZ7r1x21ZlxvjUPDmDsDYukRDJW8gNW:qG/Sj5r0SZ7r1x+fxA+FRlW8gNW
MD5:	0E123166AD38872666B9222D56C35461
SHA1:	6F6B48FEE6311D57EE8F275A322E5B96B15DC945
SHA-256:	3A79B35E2FE0A669B224EF0E035BF61BC90DA599D2FFD17EFD5BFB9CDD14D74E
SHA-512:	B6D00E1A7DA93219EBD751784AFC58C939C626E3080220148D2CE8936C82344FAA26179EBECEE79817704214AB9B02D76BE122529DE3CDC800ED0057CDC53CF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@............" ..0..............2... ...@....... ....................................`..................................1..O....@.......................`.......0..T............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H.......P ......................l0......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................I.....3...................................................i.v.........N...........%.....B.....5.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Handles.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.0221133857729745
Encrypted:	false
SSDEEP:	96:1wWXKl5GLh+yOUa+oW4xvjUdLKDmDsDr6cqJwIWAZmW:u1lfxxAdwqqIWAZmW
MD5:	8EA31614D4235B7A6A2AB619C20B9CB9
SHA1:	3180EB385EA274AF209D14AD5B9EA9BE415ABD66
SHA-256:	AB1B67C7F73999497EF4BC2F1A4A300351790A478ED1BC0F0E5382A267DE3F12
SHA-512:	489E00E34EAC731BD639C4D5D34DB35241E90ED4EE77153A43C7C1D0986F94D80D0C94EBF11025E9B4A3475DDE3E0FB89C8E9CC25C996A44DE2BE4AD13B1042E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..D.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3................................................(.`.....`...f.................L...........\|...........a.......................H.....z...................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(...y.(.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.InteropServices.JavaScript.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.287378031486416
Encrypted:	false
SSDEEP:	768:yogxGMiFMwIOFV7ptGomAMcnbDSO+MH1Q+k71Gb52:yhwMiFMwIOFV73XjMcnbDSOzVzkEb
MD5:	4B87639D9902F0C0E54189A11FB2D234
SHA1:	39D4A5FA4BAD1662257A7003D00FFE2BBE270730
SHA-256:	478B5156FDADBBD657BE978445D44102E5864F292178B3DEBD3268050FC5A7ED
SHA-512:	5E0F2FFE0CF11FE8DC1A0E64CBC362EEAAAEA2F7BF0E4156BBD8C2401C696A78F9F99E38AA4E6EA7D9662FAA6DBA196D928BBF7E6B880ADFDBC334EA80747E35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....d...................................................n............`...@......@............... ..................................$...Dh...............l......(...T...........................................................(...H............text...,c.......d.................. ..`.data........f.......f..............@....reloc.......l.......l..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........,.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...l....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...I.n.t.e.r.o.p.S.e.r.v.i.c.e.s...J.a.v.a.S.c.r.i.p.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\|....F.i.l.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.129839485128649
Encrypted:	false
SSDEEP:	96:qeOF07lvU1eCyllFxvjUIDmDsDHKFIWHDUW:f7e1eNxAEHWHDUW
MD5:	EEDB5CD1D91B1A751CEE180D34D06E35
SHA1:	92E76F81EE0E02546008B05136478FC47388498F
SHA-256:	65577B40972F856ACF3C0DC136B4BD6BBC171FD73E0FCF483D17922BE524F8A3
SHA-512:	7289E814C32F3D494C6427B7FA563FCE7A325C8C240D5A7B1DFDFF48C6AFB0DDE232A16E2228DC57B82F697C9B471E947EE5060E253A25C0138FD0408AA73ABD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.`..........." ..0..............)... ...@....... ....................................`.................................w)..O....@..h....................`......X(..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..(.......#Strings............#US.........#GUID...........#Blob......................3............................................................@.O.........k.....&.7.....7...V.....l.7...;.7.....7.....7.....7...".7...T.7.................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I...y.I.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.InteropServices.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	6.347499630257155
Encrypted:	false
SSDEEP:	1536:foGf8t1CUTle2Ctw3a6+67NspnSPM+l5+JkmVe6Yo:f3EYUT82Ctu+dSPM+rekmM6Y
MD5:	473BD8E2218E463D8FB1AE641C8076A8
SHA1:	982DFB88F129084D388B5645190684E149835C37
SHA-256:	98E2975023E3B569DEBA935599A28B57DF53EA7288913B9EA966A2518DEEA39A
SHA-512:	A3C0B484089BDAC279984F6664AD933CF3743A8382D4A243641F127209025B5195F46E0154E7649DF7ADD5432570DC2CE71D9C16011941968A9FF0ECD1FED504
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........6...............................................(............`...@......@............... ..........................................\............&..........T...............................................................H............text............................... ..`.data....3.......4..................@....reloc.......&.......&..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...I.n.t.e.r.o.p.S.e.r.v.i.c.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Intrinsics.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	3.984541697794905
Encrypted:	false
SSDEEP:	48:6+k2Xvg6/zparXE3hmIFdiRkpaHMfrX02NPCDmDiZDAlB1Z3xZW6lK3d5WmQK:NX4wzYXgZFdieeQsDmDsDArPWmyLW
MD5:	CD5E62400F461CF3DE55FB881468F178
SHA1:	C7DA148C8EE1F00AA466F187CA78E2968C0D927B
SHA-256:	215778977250AB6C63A569FB2C973158E525F6640A0DA3332C148771C1104661
SHA-512:	187DA1DE019E1F49E9FACC0F484D93085CBBB888FA82CAAD88F4DCBFC18A3F4CFBAF46128D97A6D437F7F76CA6A1312D41300C2EA15EB2231BE061D99507F1ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0.............~/... ........@.. ....................................`.................................+/..P....@.......................`......,...T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`/......H........ ..\...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..P...d...#Strings............#GUID...........#Blob......................3................................M.....I.........B.$.....$...[.....D...........A.............k........."...........{.......................b.....o.......$...........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Loader.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.021323958603903
Encrypted:	false
SSDEEP:	48:6kpgCvwBI3/f584h53HBnfpxhiRk8xm+IvOX0lTNPCDmDiZDIH2dOZQY5qZWOmKD:u4B/HBnfpHiLgxvO5DmDsDsQrW5ZGW
MD5:	8F4B6A00C10EF6EAF9E9E8B6105EB3E9
SHA1:	D952E5E01A19A3744ED017E023D37ACD23FDF60A
SHA-256:	DFB49CE727FD17B446BC90335A5E13513AD7B3A49577D4F1A9A08712D7ECEB14
SHA-512:	8D11E7CCB753CA8F5AE37529BE97D5B581304BF2DDD5E8836446A443BA8C6FFCCFF77FD7EF601933DD96C203B86243F90C9787469098C73C6B1E94B0FFE0F8D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t............."!..0................. ........@.. ....................................`....................................P....@.......................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`...(...#~..........#Strings....0.......#GUID...@.......#Blob......................3..................................................P...X.P...p.....p.......v...V.....z.....).......1.....1...?...........>...............................P...........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Numerics.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	6.854502206787544
Encrypted:	false
SSDEEP:	6144:HEQz+8miKy66Yto76Pu6J/FGQV5IfAzt9dp+Y0eYJqZp:HEQzQiKl6Y4oxV5e+t9dxzYJYp
MD5:	140E63B4F56608BDCC0EE29357EA6F09
SHA1:	713578FE2FB348CC9076F2C2AAAD97B8CF58C023
SHA-256:	849E11451108D22C882BCEDE76A5FC454318169F877EBC63715CF9C93C4A0E48
SHA-512:	AEBC3920EDA4D7CD58B89E603B2C35EF89EAD2A782EEAD03C9734714DEF4EF13DD54B846775CA76A283CC3EE1592342DA7971EC869BB556B216643918378CEE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." ......................................................................`...@......@............... .......................................................~..p.......T...............................................................H............text............................... ..`.data...............................@....reloc..p....~.......~..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...N.u.m.e.r.i.c.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Formatters.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.6686870646135015
Encrypted:	false
SSDEEP:	6144:1Vjp21d2b6tSfPSWXoG3W9cnJvgBMhrMaT8ScXzvZWHsud:1lp6d7tSfPeG3KcnFgBMhq5zRhk
MD5:	B4142D0F7B1172BC3484DDB39D3711D5
SHA1:	5DE7702E54D9E5A614D3EBF244634080E75CDFEB
SHA-256:	696457A5D9B80B2FDE3CF913461EF9761BFBB50BF5FF7384C00D30DCA6A12F4F
SHA-512:	0990439381D17C5666EA0296FD78E8DFDEA5FDF743D8A4BA252120688626587EEA13C61700F611D08263F5768E63320DB54969AB0F1BAC82C91003AB9B58632B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...`............." ......................................................................`...@......@............... ......................................4...`............x......(...T...............................................................H............text............................... ..`.data...............................@....reloc.......x.......x..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...F.o.r.m.a.t.t.e.r.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Json.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9832445590744032
Encrypted:	false
SSDEEP:	96:z8tZMvzkyaxvDEDmDsDiEPwyVWbuodB5W:z8wg/x2IyVWbuodB5W
MD5:	2A316A14B5EE047ECD7D82236533B5D9
SHA1:	A82E79884C3D25B02B1F0DF138D70729502CEABE
SHA-256:	4106BC9A5C81BEC0785ABFC8D50752EF7727050EBA2A4F7413B26691BB1557E8
SHA-512:	4616CAB1332A1DDB5CF25789A3D271065F72D7F3E94CD194F7874B8C4484207D3E5E287CC7C2BE521C86157A79822E80382EF208ACA1C1B2D970F9C2D248F253
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6..........."!..0................. ........@.. ....................................`................................._..L....@.......................`......P)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..x...d...#Strings............#GUID...........#Blob......................3............................................................3...........^.......O.....O...a.....w.O.....O.....O...w.O.....O.....O...G.O...I.........................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.611633076346825
Encrypted:	false
SSDEEP:	384:1HWFISJBrW/t1vT0B2E+ac7ntmEOR9pnUkO2akIGt6HHDtax14pYoz9o:1qhJButVpEyY99pnsbV
MD5:	74E5AD6BBF3C918D4CCC3050568EB75A
SHA1:	1C3CAA703C37E2CD1440053F53D990BC59270747
SHA-256:	AA2282D1BF64A33EBD93D33E187963FD5908AADC7D18C39ED2A4C7392CB3BB32
SHA-512:	C6EF669411EA23694D25F288D21BE128A292E5A2BB86E98D16FBD1D8C4E55690566CE5AAD07546883FF87263BB104185C65438468D919F6A1F84877027F9CE2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...I............." .....6...................................................F............`...@......@............... ......................................P<...............D..,...(...T...............................................................H............text....5.......6.................. ..`.data........8.......8..............@....reloc..,....D.......D..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Xml.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.163966299089815
Encrypted:	false
SSDEEP:	96:n3L8B5zQpr20X1Dk8C+KxvD3FDmDsDtwRMWsBfBBgW:7Wkr20FI8NKxGRMWsBfBBgW
MD5:	268DA63E4CDE55FBD220B175659D8090
SHA1:	4819153DDD227C247043938CD47F0678D73B85D9
SHA-256:	DC41F0F35ADBE3C63D25B2D819BB3FC042B21FB39EA1986351534C1D02B783C9
SHA-512:	308C04D645F94AC1AB85B9A55D711AF3F55053BE3751FB038A29A420E1EB6B0F8B45F9D472CAFF2342EB8D3DEA81E16D96B2DB39DE6CBBBA727115BBAD1B23FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...KA............"!..0.................. ........@.. ....................................`.................................U...V....@.......................`......H-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H........ ..x...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3................................"...........................W.a...............=.............Q.........R.......................9.....k.....m...................A.....

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.17274809466052
Encrypted:	false
SSDEEP:	96:QXItClIufXqa2z6ONIVxjpX1Dn8C+uTUxDmDsDSXX2LWgMr4BHW:qNXP2tNIVxj7j8NuYbLWgMr4BHW
MD5:	13DEA1521C4057658C24E2BC4E9B994A
SHA1:	BEF32159684B108B8A49F31BAC999733A1109EAE
SHA-256:	31A12CF9D4296874C7FFB1C6B1622E170F635949554EFC68E0CD58AFD037E2C8
SHA-512:	9AE6EE5C968B789C46A76C7E57EFCBEE6418B2CBAC78F6642DB2FB58006BB96C9F712F9BFB721B1A2927871E3B00528401744F7ADEE8121E7EE5465A45CE0920
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0............../... ...@....... ....................................`.................................u/..O....@.......................`..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......P ..............................................................BSJB............v4.0.30319......l...d...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................~...<.~.....S...........Z...a.;...{.;.........#.;.....;...0.;.....;.....;.....;.....;.................3.....3.....3...).3...1.3...9.3...A.3...I.3...Q.3...Y.3...a.3...i.3...q.3...y.3.......:.....C.....b...#.k...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	4.89511926322131
Encrypted:	false
SSDEEP:	768:A+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLf:EB/LuYdy50b4b7RSHPJ
MD5:	4E4622AF5BB4B5DDD44DB61C0F493632
SHA1:	E23FC54DF2E3A2BDF56CDD915B7B29CA39ECD069
SHA-256:	8667FFA72FC45C5FE3F46B48C660DE80DBAF3936934EEF8D6A08E8FE49749551
SHA-512:	A8006D1BC57A5EB72836AD2757D9DD4480C1DC5B6BB2A8F3FD1DC56977BC7C7516DB6DFD465285CFD6C01A370F2224425A4069980DA71512780F53F9D1961979
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...GS............"!..0..x.............. ........@.. ....................................`.....................................N.......X...............................T............................................ ............... ..H............text....w... ...x.................. ..`.rsrc...X............z..............@..@.reloc..............................@..B.......................H........ ...u..................P ......................................................................................................................................................................BSJB............v4.0.30319......`....2..#~...2..T@..#Strings....<s......#GUID...Ls......#Blob......................3................................{......#...........6..`..6....m6..(7....4.. .....%.....%....m#.....6...!.6..&..%.....%.....%..s..%.....%.....%.....%.....6..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.AccessControl.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	5.501608465852966
Encrypted:	false
SSDEEP:	768:127AkytJgoLzTABpatoFzaA4tk5IEK+MiLyMngyEH3T:1GWJzYmtIQkVyT
MD5:	BDC99BA981CD8648D14C3597C8002FBB
SHA1:	40CC71AA823311BAAEAFD592CE6E79AEAA480A5E
SHA-256:	92EBCA0709502FB3DA93028EF374387787560310EEE57B162E12F332F08051E9
SHA-512:	E3DA4402AA9C38F1A3BE7CA766B5AE567B853596E95E56AA69921C1E449C7C7A03E4B0CDD448CB4CE59ADE4EE25589B4D2724592317AD5B7FF8BCA5504955DBE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....+..........." ......................................................................`...@......@............... ..................................................................T...............................................................H............text...x........................... ..`.data...............................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...A.c.c.e.s.s.C.o.n.t.r.o.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Claims.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	6.289793765073727
Encrypted:	false
SSDEEP:	1536:tXEYQ0byB4X+bX5SiRPuDQu6O/U/xOQwQ7rzUU3q2bP6YILFqgkWr:t59bP+bJSouP8xKFql
MD5:	CC1F7024CE6F6796EDE6A12BCA0F9AC0
SHA1:	A5780BDF25CD25B936E543BF73E9BC07EFF22005
SHA-256:	A39D8CF548E28D9D7C69114EB07BB685CF6DBCEB5F8EDD53545C6FC2F4F1429B
SHA-512:	31E14A32E18233626051C7EBE6184B1339B61845A93D3CDE316FC2FAB88131FDD30D4BD55127D418798F1B958C1008575A6710E8ED3661815811D4F65786D12F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....C..........." .........8...............................................8............`...@......@............... .......................................................6..8.......T...............................................................H............text............................... ..`.data....5.......6..................@....reloc..8....6.......6..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.l.a.i.m.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Algorithms.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.157132583311948
Encrypted:	false
SSDEEP:	96:ZWslkKyQrdjv4rT5fqJxvjUlDmDsDBBOWqkBW:564EqJxAyWqkBW
MD5:	48FE71E7E4BF4317F8018E52678F0998
SHA1:	5A479889AD285050E73C999B5D66CDE08DB80B4B
SHA-256:	AF2821AC0055093EABA5979314DC31D6B250F244821FCAE8291CA8B226B446A5
SHA-512:	5F202814B2B6082162ED3B2FB7DAB08EB2794715163AC38265B5AFE8259B5E68ECFEC5CCAA25A20DF879123F3846C3FAE6717D9F99797F4F376C3063690CD9EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%............" ..0.............R0... ...@....... ....................................`................................../..O....@.......................`..........T............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................30......H.......P ..$...................t.......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....\|.......#US.........#GUID...........#Blob......................3................................>...........................?.....6.....j.....%.d.....d...U.M...k.d...:.d.....d.....d.....d...!.d...S.d.....H...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Cng.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.116092071785417
Encrypted:	false
SSDEEP:	96:ukleMuuyRTElyhxDYoFaeUW+xvjUFDmDsDTaewjWx2fW:/VnAxNaHhxAsjWx2fW
MD5:	FEEE1083B5D5A97284C2C53B42E32057
SHA1:	004926C1A0F11A32B33BC0107D207879BE08517A
SHA-256:	C948CA7119C94B02EF74DDDC3B171952C6F9E746092A6DC82E78877BF0317BDD
SHA-512:	72D5FD9C7CFBA927BCC10CEFE25000A3B31B33337E1AA4A40145312E0EAF1F2702C1F59D999C42C209A71D39008A2E662FD66EA6C652AEACD2CF8C0E6AFBEEB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..............,... ...@....... ....................................`..................................,..O....@.......................`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ...................... +......................................BSJB............v4.0.30319......l...<...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................d.........J.!.....!.........A.......J...n.....,.........................................j.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Csp.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.185740473691228
Encrypted:	false
SSDEEP:	96:/JlJeuuySbvl2Cj0j5jzjgjDj8jKj3jgjJjYZxxvjUhDmDsDxPbwRWLgtW:xSbUikV/AvcaTAFCxxA1ERWLgtW
MD5:	6438B5A61406C82BF991242AA3FFD792
SHA1:	8ABF46E6517B898269DB31E0972E137789F1B1EC
SHA-256:	3CFADF70558B8E057D466BF230B05BF584D5A521BF3CF98C7CE93FF4ADCA68B3
SHA-512:	18AED8A80ADEA7B7E3CB51588CCE999D80F82D0C64E6364828EFDCD5E252B918F353CC1D7BB930C01F4DA9F54BE5FD83F0D9D92F52D839F8A7890663D95A4A11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H.:..........." ..0..............+... ...@....... ....................................`.................................y+..O....@.......................`......\|*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .......................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID... .......#Blob......................3......................................................x.....3.n.........^.................I....._.................w.................G...................h.....h.....h...).h...1.h...9.h...A.h...I.h...Q.h...Y.h...a.h...i.h...q.h...y.h.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Encoding.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9924607807621277
Encrypted:	false
SSDEEP:	96:hy+khlomUyLWtANoYV1zo+IkBxvjU4DmDsDFP7W5ZWW:shZo8V1zoYBxAwW5ZWW
MD5:	30B299397896FA09888463F2CC28BBDC
SHA1:	0A507AA298141BAF37E6B8EE3A212C0D26204CA6
SHA-256:	61B99E6CA4D9A78BC3C4909F6CEA5132CE91FE9C555AF8D6EB6C06B4F93E18E9
SHA-512:	EBC9DC8551363F5E478D4FBDE655FB9D8294B055C3B13D4184DAE25BCC0F49B5E4CBC57EB7A26AA857FDB1DA6D0C63D077816DF308AF4670A9B1F544D6B74E2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ....................................`.................................o..O....@.......................`......h)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...L...#~......<...#Strings............#US.........#GUID...........#Blob......................3................................................ ...........^.................D.d.....d...t.7.....d...Y.d.....d.....d.....d...@.d...r.d.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.OpenSsl.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.1040392606002625
Encrypted:	false
SSDEEP:	96:vcvePR8lIyoCl2xvjUdDmDsD9D/9WAmdbijRW:ULgzxAFz9WAm5ijRW
MD5:	7923463890F684759EE5BDD6EED7795B
SHA1:	683EBF7263A49C295D3BAF9733FC3E635D2F0FBB
SHA-256:	D800E1CF68F8008BE98DB84CBF55F7AD32058797E77922FB18DCDB5F86B34181
SHA-512:	D6DD8A09716D93E418AC0E75A000DB932BF4B228AC24F31E18BA9F7784726A07AB59AB521031C4383D6C858B4DED0ABDDDE908ADBAE4BCF0CB30660A00900D23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..X.......#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................\|.....\|...E.i.........p.....+.Q.....Q...[.J...q.Q...@.Q.....Q.....Q.....Q...'.Q...Y.Q.................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c...y.c.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Primitives.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.124906515582101
Encrypted:	false
SSDEEP:	96:yPl8NyxqlWFuPxvjUJDmDsDHpjoWI+3W:Y6y3FuPxAGWI+3W
MD5:	DCAFEF98300FCF0207D6CE867A51BEE3
SHA1:	131367048A5ADDE455220264D09146BDE077634A
SHA-256:	9D6664511063754CDF7CC18A23453EFCDD49248293CF7DBD9E683FA1AA4EC2AE
SHA-512:	2ED5A61AAA509E73FA7DC75CFFDA5ACD5172F94B84E4CFBDA4E80C08EB143DDBDC55FFA82B5747DCC318AE35FAA00230CD98D99FE045DC7BDDAB79EAD94476F1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M............." ..0.............v+... ...@....... ....................................`.................................#+..O....@.......................`.......*..T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................W+......H.......P ..H....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................4...........r.................X.............(.........m.......................T.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.X509Certificates.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.401225353293449
Encrypted:	false
SSDEEP:	96:yvla7cVyX7NTyE1siPcXHxvjU59DmDsD7CXWemfW:Qw7H2oc3xAhsWemfW
MD5:	19741B653B74463314E62EEF08503C2C
SHA1:	E81B28B4A1878DEBEC29740A2F1DA48B1CC5E39C
SHA-256:	16A6C462D0E337A950F01E2B7036336F5E99339A6DF3D3BEE6AD4BF905F2897A
SHA-512:	27FF1584686DAB8C56541B9FC1613B2476FF4F1C558EE691154C758E0FDFA83D6F217F68F24191644C8EECE44BE890982A142F7780240E98A3D7101184FEE737
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z............" ..0............../... ...@....... ....................................`.................................o/..O....@..H....................`......X...T............................................ ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......T...#Strings............#US.........#GUID...........#Blob......................3................................-.....r...............'...................X.....k.....k...........k.....k...i.k...&.k...C.k.....k.....k.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2036224
Entropy (8bit):	6.714774918281042
Encrypted:	false
SSDEEP:	49152:QNK3Q5WZbPzjqhfStprkVGsv5wanfzsz8xfn/Nzn+LlJqU:QNIbqNSoWanfzrKJ1
MD5:	860782841457B66AC92529DF84FDD762
SHA1:	CAEF9D05F61C65B7222F090110A97CD78345C469
SHA-256:	D79F9619B5623957A718B0A0A6A0BE35044D09A1FF2FFA97BE6056E08F87CBEA
SHA-512:	33F22DB1F3751271DA57D19FA69F1A05FD6022AC7D7F6CD8CAF8CB84FBF681C691942FAE404FF044BFFA08DBB3324DB2894644FEB2CF408D17FD9E70A0D562CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....I..........." .....&....................................................$...........`...@......@............... ........................................................#.........T...............................................................H............text....$.......&.................. ..`.data........(.......(..............@....reloc........#.. ..................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.r.y.p.t.o.g.r.a.p.h.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Principal.Windows.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.436538490435295
Encrypted:	false
SSDEEP:	384:WcfWFhOWGEMo8LaIaYh88fZQJcWzbM9Z/CUsw67Ky/cYLwNidc+0L4:1ofMo8La+h8KEcWc9BCxqb+u
MD5:	9C62F94C2B526953BF49721880CC78AC
SHA1:	261EF047A1347C07A82D8E25914FE2B8AE2A478C
SHA-256:	93AB29A9C27461775348BF449DCA0001B40BF122FC6A254E64853780689E029F
SHA-512:	04B234CE230F887F9BD38C9C9828319AF97F9CD1AE6C8E84FC8390D09C2DA20223DF48273F46861DCFE9A79D1B506657554F0CB403F839A99DB5CECB911D5702
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .....b...................................................j............`...@......@............... .......................................f..$............h..........T...............................................................H............text...D`.......b.................. ..`.data........d.......d..............@....reloc.......h.......h..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...\."...C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...P.r.i.n.c.i.p.a.l...W.i.n.d.o.w.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...l."...F.i.l.e.D.e.s.c.r.i.p.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.Principal.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.934454702067044
Encrypted:	false
SSDEEP:	96:ldgdl4600AyQelfxvjUxDmDsDGIRvjWVUmfW:sB0LCxAtjWVUmfW
MD5:	FA8C8CD277E45031D9F8D7235C4B5F01
SHA1:	5C214B2A3083C8A90655E54CB5B959290DD28ADA
SHA-256:	273B8730DE1547A2BCEEC3858505458A553D16BCD8FFCC44D539910B91B38AE9
SHA-512:	BD52A5743CEC71AB424C72A622E94AC8C29AB9BBBDACAB8B54DF60626BDC4312A84F41A7F404A0D16AA2C2A52E2A879DD953AADC92B9721C985AF67872C2463D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1a............" ..0.............f)... ...@....... ....................................`..................................)..O....@.......................`......$(..T............................................ ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................G)......H.......P ..T....................'......................................BSJB............v4.0.30319......l.......#~..4.......#Strings............#US.........#GUID...........#Blob......................3..................................................=...x.=...3.*...].....^.................I....._.................w.................G...................$.....$.....$...).$...1.$...9.$...A.$...I.$...Q.$...Y.$...a.$...i.$...q.$...y.$.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.SecureString.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.045816927658356
Encrypted:	false
SSDEEP:	96:NMWOlAvBPxadiuTxvjUQDmDsD86NwpyW1O3W:KxMBPxotxAswMW1O3W
MD5:	11C7B6796C208F874ED87E45E1FA28F6
SHA1:	97EC89F7B125E0263BF6A1FEAED9DB64E023506B
SHA-256:	E86924FD17BF39E47298AE00C6E1C82F3632C7C8C523D0073CD2AF34113E2750
SHA-512:	5EC85DFCF49FFBAFF979826777EDA92AF509C8C3FB48D783A2111A856AD574CE3D23B7F8B1CA7B7397FF9222C8E3DB77A0860BF43CD01393D0C44E9A8ED26DFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v............" ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID...$.......#Blob......................3............................................................3.Z.........^.......B.....B...n.;.....m.....m.....B...S.B.....B...w.B.....B...:.B...G.B.................T.....T.....T...).T...1.T...9.T...A.T...Q.T. .Y.T...a.T...i.T...q.T...y.T.....T.....T.......................#.....+.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Security.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.210416107184997
Encrypted:	false
SSDEEP:	96:q48FltEEZdo87XHkp8p3jDv1spZFi6k1AkMJJkxvjURDmDsDUMfeM3WsKDW:qvx7XHkE3jDvupZFiVyJSxAZR3WsKDW
MD5:	E6275CA3A50ECA49BA0ADC66E5844389
SHA1:	279E0E77CCB26DCD7BF9F840BCF18E5D0B386CA1
SHA-256:	D7DD61D7D1B51AC436F8F60462B6657FEB011D9A2725ACD3EB48BA4E094306C4
SHA-512:	2CDBD3DB0B12E03F8AAB2408C80607A1B8CD655CA49F7EA5050F3796601A15C819494B4945FB68ED5FEB323DD4785351EAE89BD07496FB8C313D881E1CC1F93C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]............" ..0..............3... ...@....... ....................................`..................................3..O....@..X....................`.......2..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................3......H.......P ......................P2......................................BSJB............v4.0.30319......l...H...#~..........#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3................................O.....................0...........3.......x..... ..... ........... ..... ...r. ..... ...*. ..... ..... .................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ServiceModel.Web.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.08910048710099
Encrypted:	false
SSDEEP:	96:6eVUlugsxDWojzWTpFUrDmDsDMrWGlM5W:6nspzAWGlM5W
MD5:	9E46CA359CAD6D3B968C64A8C5CC1C22
SHA1:	7EF38280B5492A24BE818FF835AB62E5C8E78FDE
SHA-256:	A06446DF2839B141D50D5B3AA9BF2BC7A346B85E1F6FB1F3F6105E4CDB19AF59
SHA-512:	C7F8A1B0A8009F2184B067F5F8DDE76B8F2C02D059EF714AFDAC0403F3D451E7D6B85869D5187F176C85FA6BA7273BE39B687FBB2C26DD57D3A684EB1E9F521B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s............." ..0.................. ...@....... ....................................`.................................3...O....@.......................`......H-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................g.......H.......P ..x....................,......................................BSJB............v4.0.30319......l.......#~..8.......#Strings............#US.........#GUID...........#Blob......................3................................&.....................?.................%.].....................&.................>.....[...................{...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ServiceProcess.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.047376730948328
Encrypted:	false
SSDEEP:	96:aMlumYpJ3ArYxvjULDmDsD4Q4pWnielpFW:7NucYxAGpWnielpFW
MD5:	E165EA3EB9ADDFBD018030291AEBBFE7
SHA1:	9F77B4F5A600C0166CDA384380CB9130FA714CD8
SHA-256:	31CD908605B66188DC39E51BF324846D842DD0BCA82ECC6089C35CEE549B21D7
SHA-512:	5B3DF93FF131DD4741E847BC2D7CAFC1E9331CF4CA8F6D6471CACA462279E7B54B465C7C6CFD2FC95CDCD55BCDBFCFFA24530FE53E4212CEB5960884F1813948
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z..........." ..0..............+... ...@....... ....................................`.................................;+..O....@.......................`......T*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................o+......H.......P .......................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................!.........f...........\.....:...........B.^...H.^.....;.....^.....^...+.^.....^.....^.....^...p.^.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encoding.CodePages.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	841728
Entropy (8bit):	7.512532271719518
Encrypted:	false
SSDEEP:	12288:bf7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rlMpVEZk+uV:bD9km6k/IwRYbiBeKGChn8Z
MD5:	21D9F4FB8C03118B3EA1225AE13717AB
SHA1:	C9C65A740ADEF5D531D7C376DC50A630C8FB94DC
SHA-256:	FCD4B2C79B6B776949CD9739F86076A5E9B6B65671899140CCFD483028C8567F
SHA-512:	E1925A46B64966E143825E3754C2A5F58F89F9B30465088C9B83B0CD62C09CCA2FC0B1FDC213A9C63C1663D77ABAD08BFC5858600F69A9305F46DA99BB626A9F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....V0..........." .....0................................................................`...@......@............... .......................................R..................4.......T...............................................................H............text..../.......0.................. ..`.data........2.......2..............@....reloc..4...........................@..B............................................0...........................t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .s.u.p.p.o.r.t. .f.o.r. .c.o.d.e.-.p.a.g.e. .b.a.s.e.d. .e.n.c.o.d.i.n.g.s.,. .i.n.c.l.u.d.i.n.g. .W.i.n.d.o.w.s.-.1.2.5.2.,. .S.h.i.f.t.-.J.I.S.,. .a.n.d.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encoding.Extensions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.940454029788917
Encrypted:	false
SSDEEP:	96:nmjzXRpR4WdinK/xvOQDmDsDVaTW6sJW:nmXhp/tx34W6sJW
MD5:	F873624E031E6C992D4F7BCF341B9221
SHA1:	55AAD0A9D8A3252AB16AAD382AB28CC3ABFA1779
SHA-256:	755C803EB954949870B5DEEAE410159D40DE8207A183ECF370148BD2E85A82FF
SHA-512:	916598641D89ED2A621D701E40BD0A85F7AD683858369D7B922EBD6438CEE27404FA2E1DCA11EDF27E83FA9A82C5082069CF4F9FE3B39E849B063B944D8EED88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F}............"!..0.............^... ........@.. ....................................`....................................P....@.......................`.......)..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@*......H........ ..0...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..`... ...#Strings............#GUID...........#Blob......................3......................................O........."...........;...........f.!...!.z.....z.....s.........;.......z...[.z.....z.....z.....z...B.z...O.z...v.............

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encoding.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9136537063800705
Encrypted:	false
SSDEEP:	48:67Y1g/0lFrXOy3ndBadYJo/ktyP+Iv+KXkWP6zDmDiZDRAZQYyXZWnTjKwK735W0:mclFrXOynNZ0PxvjUJDmDsDIQtWfgNW
MD5:	7F7CF24B6050F36CA19028C00CBB0F9D
SHA1:	9E595E4C5A3D5EDD5BB29D8C9778FCEE2454196B
SHA-256:	CB3609C961D8C8150423B472C68BCFFF3ADEC709008E4255ADD94CCC1BA80D8B
SHA-512:	31B459B1AD242A5D2BE1FC915EF32BEBE64E7B7CF71CCEE98A703283037D7B64D9398B3502A769A66C95F190DE10AA4091CB710EC93A90FA8A1DC44D8DBDEB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W.J..........." ..0................. ...@....... ....................................`.................................]..O....@.......................`......x)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...T...#~......T...#Strings............#US.........#GUID...(.......#Blob......................3......................................M...............x.....3.....7.....^.......m.....m...I.f..._.m.....m.....m...w.m.....m.....m...G.m.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encodings.Web.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110080
Entropy (8bit):	6.368079525859768
Encrypted:	false
SSDEEP:	1536:7i7mMLZ8QZ9Njc/JDD3lhjdPTp8K76+1PuLM0dyxNXzaTZqWUPFOZse:7fA8f9Z5N77Ze0NDaTZ1UPFase
MD5:	B810B9986AE25E70F716BCBFE1ADD3A6
SHA1:	F12ABF3A6C99ABA106EBF9C6242EF633E09A13D5
SHA-256:	7DE6FFCAC03A9FB29877A7A8FB467C889AF2F8560A3C605E3F11C2C2B5C2E9DE
SHA-512:	5CADBC9CBE9929CF77DDFAD58E60BC36D63EB331528D5AF489E9A967A366D9BF7D08A4ED9C299722E61A0E865CDD5B8FF2B77F2E4975587C7E42933D278FF2D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....f...F............................................................`...@......@............... .......................................w..X.......................T...............................................................H............text....d.......f.................. ..`.data....C...h...D...h..............@....reloc..............................@..B............................................0...........................P.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .e.n.c.o.d.i.n.g. .a.n.d. .e.s.c.a.p.i.n.g. .s.t.r.i.n.g.s. .f.o.r. .u.s.e. .i.n. .J.a.v.a.S.c.r.i.p.t.,. .H.y.p.e.r.T.e.x.t. .M.a.r.k.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Text.Json.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1466368
Entropy (8bit):	6.77912402281333
Encrypted:	false
SSDEEP:	24576:LYbOt2HlSx8ImtdfgxlIuR5K91h2Ql3zOvq8PyFb:cbXjImtdfgxld5o1Kvy
MD5:	0F99AB5E20AD1345BBA80289D4B88730
SHA1:	60D5E308C6EC837580A07C0559263BB46FD174F1
SHA-256:	FBF2C797FC70FEC5ADFBADA98C200E4231B0A99D541523FEE1C7909AF6060B2E
SHA-512:	4ABD9E7B1371044922BB5B470B18246B58DD0D7456C776984D96CFC77562AB1B69272A63F21AF7804AA8331B12D19E140185047E8850961185D6B5FE563AFCE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...)*............" .....~...................................................`............`...@......@............... ......................................................D..........T...............................................................H............text...X}.......~.................. ..`.data...............................@....reloc.......D.......D..............@..B............................................0...........................d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....=...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .h.i.g.h.-.p.e.r.f.o.r.m.a.n.c.e. .a.n.d. .l.o.w.-.a.l.l.o.c.a.t.i.n.g. .t.y.p.e.s. .t.h.a.t. .s.e.r.i.a.l.i.z.e. .o.b.j.e.c.t.s. .t.o. .J.a.v.a.S.c.r.i.p.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Text.RegularExpressions.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1012224
Entropy (8bit):	6.873971317890411
Encrypted:	false
SSDEEP:	24576:6qQpLmil4QQh8inDiv67tA0ehjK2rh3xxu:upDl4QQrivgehjKyC
MD5:	E12C1259F9854F6FF6B79F804A117EE6
SHA1:	64D5D52D19D97237ABAAA698C676BD024C71C96B
SHA-256:	719828B405FFAAF4E2F7A51EB39C4EBC4A89D92D500D443D48C314D5CD075817
SHA-512:	CA26E6C9A9817EBE03F5A2FFA27A34388145902C47071CF01B987CF53E688CCB4978CAF668EB8AC3D791940E4610533CBB76B234AA877D0D93C07A78B0CE3EB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....w..........." .........................................................r............`...@......@............... ......................................8....G...........^..........T...............................................................H............text...X........................... ..`.data..._...........................@....reloc.......^.......^..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.e.x.t...R.e.g.u.l.a.r.E.x.p.r.e.s.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Channels.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111104
Entropy (8bit):	6.6457617624583145
Encrypted:	false
SSDEEP:	1536:kZogiLn2vlVNgwk6qja1leLQeWoioIu1sdzG0:kjiLn2vlVNRVqW1leMeri
MD5:	5654ADF341D7831498CDECD6D35A97C1
SHA1:	6534F0999AB684E8840C644515CFF0EFBA89D686
SHA-256:	E3A712EA9909DAA742E60A4317EB9CEF86BAE6D7E719F54D41F1C4DF4E7E6BB2
SHA-512:	4170D4B5F6D3885F28EEF5C70F17BFE54E150C339709E8F71DD943B0E913C39E8F8B4FCA919C14CC02E2ED9463448AEDA02C2AD6E5CBA868CEDCA830B30CF5FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....J..........." .....F...j............................................................`...@......@............... ......................................d`..........................T...............................................................H............text....D.......F.................. ..`.data....e...H...f...H..............@....reloc..............................@..B............................................0.......................x...0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...l.....0.0.0.0.0.4.b.0...0.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .p.a.s.s.i.n.g. .d.a.t.a. .b.e.t.w.e.e.n. .p.r.o.d.u.c.e.r.s. .a.n.d. .c.o.n.s.u.m.e.r.s.......C.o.m.m.o.n.l.y. .U.s.e.d. .T.y.p.e.s.:.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Overlapped.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.993705306267922
Encrypted:	false
SSDEEP:	96:bI/HpdKiI+bHsxvOPHfDmDsDLHdH85WcuHW:byHCdCHsxcHdHdHgWcuHW
MD5:	73AC121DC988B240A9534156EBABC513
SHA1:	923D96DC68A30CCEA5D5F895526B611AB96FC7CD
SHA-256:	894A7ABAF3D20F1354046FB67CD03E93B946895D23F1A4B18F3660B99D800959
SHA-512:	73A604E3173C4A59CEFCCC2001FB17CDD43B9D6A1AFC88DCDBD79844A3EB904B250F02BFE115A6698392226304FDF43CE679504FEF1FB613BE6CB9416E3559B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............."!..0................. ........@.. ....................................`.................................C..X....@.......................`......@)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ..p...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..p...H...#Strings............#GUID...........#Blob......................3......................................................4...........7.......c...{.....V.............c...t.....}.................9.....................................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.Dataflow.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	478720
Entropy (8bit):	6.783772480086556
Encrypted:	false
SSDEEP:	12288:viRE5DklxqnJbeAFRsJTuiKwIrD6FB5v3SxD6DZWX9gLb9PRnT:vvelx0wQw5vixD4oX9gL
MD5:	9BE7A074F8237E03AB6AD66B31A0499B
SHA1:	326BC7A5D19861CAE044DDBC3E7291D441B03111
SHA-256:	022CDA2AC16C4024888B874D06BDA1BDD7956CACFB402A0AB9714F49172F1FEC
SHA-512:	AA40B737445461238B49C9608DD83D8CB3FD86FFA87DE08E753B5A4C4B93422509FF1BA213FB879D0B4652A3265EDC740FBEDEFB98A203A283CD52F60CC749C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....h............" .........................................................N............`...@......@............... ..................................P... ...,1...........@......P...T...........................................................P...H............text............................... ..`.data...............................@....reloc.......@.......@..............@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.P.L. .D.a.t.a.f.l.o.w. .p.r.o.m.o.t.e.s. .a.c.t.o.r./.a.g.e.n.t.-.o.r.i.e.n.t.e.d. .d.e.s.i.g.n.s. .t.h.r.o.u.g.h. .p.r.i.m.i.t.i.v.e.s. .f.o.r. .i.n.-.p.r.o.c.e.s.s. .m.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.Extensions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.298034520422525
Encrypted:	false
SSDEEP:	96:1yxnlGql+6yXkXOfde05Ue0lPwencmrRU4cDmDsDP8uOKwGWSOXW:MxnghfhVe05Ue09wencmO4oOtGWSOXW
MD5:	519C2363F28EDE7146572B519A7E3E88
SHA1:	A9E1C48D70DC417B8F0CCE232135362A2CCCE20B
SHA-256:	C5E42FB4EBA989C52324284019ABF7DAF880202F1FC23CFBE95D231596BC6BD1
SHA-512:	AE038B7BC05F7876EE188E472E16D50920AAB93771AC02004842A26025043B16EB37742DCE77FD5935691F9F27721D9DEECC02B58C01B9FEEA68ADFC7C5B7B94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]............" ..0.............R+... ...@....... ....................................`....................................O....@.......................`.........T............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................3+......H.......P ..0....................)......................................BSJB............v4.0.30319......l...d...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................s...............1...........A.......O.................................W...........1...................p...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.Parallel.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113664
Entropy (8bit):	6.601867653242959
Encrypted:	false
SSDEEP:	3072:mqxdaJZ+dG1VBBzqdrhYnS+51Vmkg9GEU9kkkaP+lz+b:xdKtSVhmVMwKo+l
MD5:	4CA4FDD71CC22CE19E25F019AC345D84
SHA1:	488DF0BFA5786CEAD4E20A2704C77ED0969A031A
SHA-256:	DBCDA5E8216FA33DA48FF30F9F6AB5C90A93517875DC6F2B553D3A0667691696
SHA-512:	4B2B5C7D5E139696F184253831F69980545F0B78DFA5A761F59094BC2FD480CFFA6E30D56F624669C382B6C5BE9E8F626A3F77684829A8154319C2BE8584C064
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...bK............" .....X...b............................................................`...@......@............... ......................................Du..........................T...............................................................H............text....W.......X.................. ..`.data....\...Z...^...Z..............@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...T.a.s.k.s...P.a.r.a.l.l.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.004184534930114
Encrypted:	false
SSDEEP:	192:CB2bcWiW1Wfk3kP9BfxAdqnPQz9WHazW:Eaf4fk3CBpoqPQz9WHazW
MD5:	402602F9BDECF542F8CA733238D28395
SHA1:	B808555FB213D021B2783377F2525E8FD392570F
SHA-256:	C0C980EA9B5A886A792591489D702F763079127CD65D6D3FAB4712E8928FEF5C
SHA-512:	134FE6702D88BD4E503CA47341F2A34B07624AE55C07B8565184A18767F4112FB87D062197C08EFE145B72B56F50C4045BB1B95406DC17B0F1A8BBD1657A1155
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............" ..0..............-... ...@....... ....................................`..................................-..O....@.......................`.......,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ......................@,......................................BSJB............v4.0.30319......l.......#~......H...#Strings....X.......#US.\.......#GUID...l.......#Blob......................3................................&.................o...w.o...2.\.........].................H.....^.....-...........v.................F...................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V...y.V.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Thread.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.096637441759316
Encrypted:	false
SSDEEP:	96:5a0fjszKdiI+bprsxvOvMDmDsDxkd7TpWcC7W:5a0fAz4dEpox0gkd71WcC7W
MD5:	897C023B35985306905D8434F39C7CF0
SHA1:	7B5535B197B75DF9C2EB0F7C4345044CEEC709AF
SHA-256:	07FFFC1729661045BF2A9F8415BD193792DFB9A8E210B9CCE46B6B07D373ABEA
SHA-512:	4C99BCD9EAC9E10F981E0F2588C87EBDA8AF3C973F250BF619569A54B69CBB08FF9F0AF1DE1836246B6DC52A24A92224B50FEA5C124C6142360C05E8B7681D98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ks............"!..0.............n+... ........@.. ....................................`..................................+..X....@.......................`.......*..T............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P+......H........ ..H...................P ......................................................................................................................................................................BSJB............v4.0.30319......`...\|...#~..........#Strings............#GUID...........#Blob......................3......................................].........U.@.....@...n.....`...........T.............y...0.!...9.!.................................u.............@...........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.ThreadPool.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.911149772615472
Encrypted:	false
SSDEEP:	96:36gWBmT0diI+QT2GxvOPGDmDsDP77RWEmvW:KtmTqd92Gxco7lWEmvW
MD5:	C5E55840826B31657FB5BB5A188FEB12
SHA1:	B1C983BDEC2033B603AC2A45D47115D808F41D7E
SHA-256:	4451810E6462B51469127FD322B3096DDE46DC513A56FC0B549D2D0288EB0624
SHA-512:	CB762C914E6B8E935EFA5257CE3AF71A5CEEB4CC9B7660438B434CB09E49F405D768B0BD7206221F86B1531CF2FFC8D3DEAF4738926F4D29190252E7C3771270
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0.............N... ........@.. ....................................`..................................)..L....@.......................`.......(..T............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0......H........ ..,...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..`... ...#Strings............#GUID...........#Blob......................3......................................P.........7...........P...........{.....6...................................p.......................W.....d...................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Timer.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.855693160510187
Encrypted:	false
SSDEEP:	96:8iMAlJfyka+26NNxvjUdqrDmDsD7viWwMWs1CW:XsF6zxAdqJv4MWs1CW
MD5:	A6AB56374CDDA5D1BD76F7483D9C216F
SHA1:	7766A8AA1CCE2E889B450E3CBE0337FE41B894F8
SHA-256:	677971EC7D604F1518AFFB411EB57FED885427DE9D7700134F5BB719E2F1FA0F
SHA-512:	0DB05E68ADE7BC43BC51C4FE3D22B19D1CC58A18D9AA64669B5805DD1234A771C314425668576BDE49DC6F05B9B354B060BCB5DEAE11A463804E908CF9CB5D65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6............" ..0.............")... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................d'......................................BSJB............v4.0.30319......l.......#~......d...#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................3...x.3...3. ...S.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Threading.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.358544929350117
Encrypted:	false
SSDEEP:	1536:/Ou9dxr5fvwCJdrdZ8j0MjwdV3ShPeGgaMoW9z:/v9Dr5fvDdZ8j0MjwdVihPeGgaMoWt
MD5:	0DF1B925E07DEFC57B8D72AB3804CE0F
SHA1:	98AC434436A6F6F83AFC73E1CAFC395994475D99
SHA-256:	6906708C5B40EB8E86D35698BD778D66B347F0E5DC326614A1B291AFDDE08125
SHA-512:	85BB6E3E6457088DB20AF44EB38E59BAF496322F1CD7866DD3571C3587CE3243FE236998572B23678648EDBA66CC05382567404E2F046F85A331775858D8BC4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....Q..........." .........2............................................................`...@......@............... ..................................d.......................T...P...T...........................................................h...H............text...\........................... ..`.data..../.......0..................@....reloc..T...........................@..B............................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...T.h.r.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Transactions.Local.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354304
Entropy (8bit):	6.6013931036352815
Encrypted:	false
SSDEEP:	6144:EmI2kEE3tXeFy3CGaBSnFvg5PFQ5PEhsEhk7i77OkFGqyOXXvzW+/OMV6/OOPGC+:EX2a3tXeFy3CGaBSna5PFQ5PEhsEhk7B
MD5:	71204CF324D0B76252936AD774063E58
SHA1:	759FEE733FBCBF5A66523F2023291D30D28EDB90
SHA-256:	A5DD46C94E8A92E2542143494360AB198DF8446E62642613FBD62A9DC7F8C835
SHA-512:	709C3F2FC1990EC9EE1A5B5EF43B2EB6EB4CA1DA0CB2E17EE4405AEEE2B94D4412F114F7A8D3657A7E2F0648673BD87BC861595483CA3409D66EF699CB3F4A9A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...K.W..........." .....`...................................................h............`...@......@............... .........................................L,...........`..........T...............................................................H............text....^.......`.................. ..`.data........b.......b..............@....reloc.......`.......`..............@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.r.a.n.s.a.c.t.i.o.n.s...L.o.c.a.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Transactions.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.073845929514683
Encrypted:	false
SSDEEP:	96:G/vCluv6lUABcDhlNHl+3RaUgDmDsD50UWzliW:GS/UABcDhlNH43RP61WzliW
MD5:	F4B0D7BFF530B30BC753A119573C4DC8
SHA1:	E3B7E0EB2ABE329654DEEE21F14D6F6DCAAAE40C
SHA-256:	272687A9EB1170E0604B01278CED2C786A0897D85A85BC823A63AC1FB5905636
SHA-512:	768A4E2A13250FAA0F9E5A92DCC8BF65693373624DD4C7FB00CD1839F6089BF91B6F3BE6348BC10D6D9C32175C76497D98F647347743CE192174E320836DAD02
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9............." ..0..............-... ...@....... ....................................`..................................-..O....@..x....................`.......,..T............................................ ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................-......H.......P ......................@,......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................$.....3.........0...........D...........o.....*.1.....1.....K.....1...i.1.....1.....1.....1...P.1...X.1.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........C.....L.....k...#.t...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ValueTuple.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.219839558375717
Encrypted:	false
SSDEEP:	96:Zcjls3Wy+UfgrRUoDmDsD+Dw3Wt7VWhW:06yhObk3Wt7VWhW
MD5:	0A3ED751E3517CA7671C59549F3FFC35
SHA1:	4998C769869EFC7566FCCEDBA95231CB5571C37D
SHA-256:	944E374F2AB5DF41AAC853448D48089ADEE20C8F1F2AC4AF74DF76599895E179
SHA-512:	9E92E22E4D11F39B74117237CD4E070E01EFC44B808929B2D6E9829CA9875A21FFB32CB4BE85D541CBF17951965073DAFD4A53FCE80259D7E0C9407E91969939
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....QX..........." ..0..............)... ...@....... ...................................`..................................)..O....@..h....................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................D(......................................BSJB............v4.0.30319......l...,...#~..........#Strings....d.......#US.h.......#GUID...x...\|...#Blob......................3......................................E.......................z...........+.....b...Q.b.....[.....b.....b...4.b.....b.....b.....b.....b.....i...........t.....t.....t...).t...1.t...9.t...A.t...I.t...Q.t...Y.t...a.t...i.t...q.t...y.t.......................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Web.HttpUtility.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.478057561088385
Encrypted:	false
SSDEEP:	768:qDuC//xJPDt2GN/nK92QWMrbbuBM7BWs3GXfXSXEmDZ4rWI6i:qDuYvBfVNKbbGm0WGvCdWa
MD5:	F446FF3DD000C4C274CD284C5C20C99B
SHA1:	BA20750970D77353E09B6AD277E057D794442E08
SHA-256:	9E1D3BD379B8A23E3D0B9168B2E732EDBE872CA33B82192A4BB357CA05E9BCEC
SHA-512:	15A46F9B698F50213578C7AA3CC0D6E86074E0E31D4136B8509538E313D168A4CD349BE85D6152A42AAEB6D89F2FB327D0DDAD8FD473F4E0BFFBBA08D0597BF0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...Gf..........." .....r...$............................................................`...@......@............... ......................................t~..........................T...............................................................H............text....q.......r.................. ..`.data....!...t..."...t..............@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.e.b...H.t.t.p.U.t.i.l.i.t.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Web.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.73122352605951
Encrypted:	false
SSDEEP:	48:6GB+lZ5uO0lzMeMyadCcxL+Iv+KXks9P6zDmDiZDcswS7zEZABHZWhTKaob5WmQK:yy3lNlixvjUskDmDsDTv7z+CWVvo9W
MD5:	2EFF15E08F2261AE7754F989A69AD999
SHA1:	FDF653A91FB1EB85E0262F069D61DAF12B8F9F49
SHA-256:	FCF64B46C66B804FC1C2561553B70FD3EF7ACF6A6C8E9F67EF0E03A0FB157113
SHA-512:	5F1A4046A97743DD86010B91E6D276FA927417789B8CE4186A4CA35E94950239304A918A9CFCE5DD5E79FB5E478FE988472A65AFD05D5CC3A1915D354056C2C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6..........." ..0..............(... ...@....... ....................................`..................................(..O....@..8....................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B.................(......H.......P ......................H'......................................BSJB............v4.0.30319......l.......#~.. ...D...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3............................................................>...........i.....$...........T.....j.....9....................... .....R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Windows.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.884953040905424
Encrypted:	false
SSDEEP:	96:DIlG6LyMahlogigEIxvjUUDmDsDweHBWElSW:UUEaHtjxAjmWElSW
MD5:	847B00DDA2C28116D46A8F999717EBF2
SHA1:	28380AD5CDACEDDC3EACA1E7E1AF067C95BB9495
SHA-256:	4830C1FAE23A384BFD43E445260655B6FD6863A87BA930A726FB7330E0BA3E64
SHA-512:	5D0A0556B3027F5B36465FCF237B2D2ACA47C491FF6A01B8555895BD1A1D2F5FF1C6A57078F29DACA1E8913FDD954F7C3ABB9D8B26E7F34E4E7FF435BA8CA520
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ....................................`.................................M..O....@..X....................`......t)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...(...\|...#Blob......................3......................................X.........U.............................y.....7.......k.................................u............. ...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.Linq.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.7762859354743266
Encrypted:	false
SSDEEP:	48:6hLbQ5IKlupbxWUMadCBI4KXkjP6zDmDiZDV8pZ9wkgZWUUKSk5WmQK:JIKlup1WPlSNUWDmDsD+velW1H4W
MD5:	415AF166D5E3D9ADFA7DDE1AB026BA1E
SHA1:	E5F67288F867EB591C5DFD4F32A67CA19A6DCC95
SHA-256:	13947D5628E32378CF22715EE7AC100FA4FA0CE3C7F69105BD524DAF83AFCB61
SHA-512:	D5014ABF669A36D84ADF6B6B9E1E71488197C3AFC9D199B10FA5DE654D3E93CC41332153DC7685D5C475B8748AE0605CFCB872138D7DF41FF7FC02655E8F5E99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............>+... ...@....... ....................................`....................................O....@..X....................`.........T............................................ ............... ..H............text...D.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................+......H.......P ..@....................)......................................BSJB............v4.0.30319......l...$...#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................L.............................p.@.....@.....,.....@.....@.....@.....@.....@...l.@.....@.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........:.....C.....b...#.k...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.ReaderWriter.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.487137055734802
Encrypted:	false
SSDEEP:	192:hWPE1VEB5q9W+4cgPy67e0O4FCofdxpW1/AW:71G5qkxK67ex4FCCpW1/AW
MD5:	DD0DEFFCE8B880BFB6796C27C5ACA34C
SHA1:	5B513DAD745BC1473D11EB512D5B509FA17EFE72
SHA-256:	4F423716C472FBACAC3846069AC37EAF3E82B6C057BBFFEAA5B99A8CC38B2D4D
SHA-512:	BBFE788C432D295A1AEE918A070E9D678BFC6EC40E9336D6A1B3BB8CB58E0C1938A89A934D7F01BD8D0BC3B2642A4EE4BF257DED67BDA85CFE1E912A4BB963EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.O..........."!..0..$...........B... ........@.. ....................................`..................................B..L....`...............................A..T............................................ ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........ ... ..................P ......................................................................................................................................................................BSJB............v4.0.30319......`...\|...#~......8...#Strings............#GUID...$.......#Blob......................3............................................................G..... .......b...-.....f.......i.......................................[...............................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.Serialization.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.784444384389591
Encrypted:	false
SSDEEP:	96:IR8luA9tWsbkUuDmDsD60BLW7MaPEqHW:Y8V6Ch+LW7MIEqHW
MD5:	7086A6C42E41477F26FE4303ECF78B04
SHA1:	A39684AC1F73DBF0C71194C7E230A2A94F615E98
SHA-256:	109921FA078E1B22F6492000EA13AB9DEE3EF9F187103A2E224A79C4DDD969D1
SHA-512:	9FD935F16A117E232E5C275B2F36A93D02E042C62552624C1F6536340368241DEA9A7D80071EA85694C2200347599DC9F11C815316F69AE018FED916737CECCF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2............." ..0.............N,... ...@....... ....................................`..................................+..O....@.......................`.......+..T............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................-,......H.......P ..<..........................................................BSJB............v4.0.30319......l...4...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3......................................".....................X.................._....._...B.?....._...'._...Y._....._...3._....._...l._.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........:.....C.....b...#.k...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XDocument.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.123441933313115
Encrypted:	false
SSDEEP:	48:6aLotzMtR8Fc7UyakCpAsK+IvWX0ONP6zDmDiZDLFYW/jedZQYynZWnTjKh75WmJ:EfyMqpxvWODmDsDLGWibQdW/QdW
MD5:	F75FCBE951CDEBAAFA125492AF4E1146
SHA1:	609FFBBA433911568DCF4BA5F102ADC9E39BFF8D
SHA-256:	2EA5CDB51DC444CB615E60E3EEDBD88D493C4FFDBC2C22D57FE40D75E0491853
SHA-512:	D160EE93B16D36DB01AEAC0A77FB34C655E4512BF2AAE3E4B7FF8DF60CF7D419F5C70A5AED04E643F70251B803AC0DF1958573126B0093787B2455A31E0F2F21
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....N..........."!..0..............+... ........@.. ....................................`.................................y+..R....@.......................`.......*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..d.......#Strings............#GUID...$.......#Blob......................3................................................L.............................p.L.....L.....8.....L.....L.....L.....L.....L...l.L.....L.............................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XPath.XDocument.dll

Download File

Process:	/bin/cp
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.35388622521183
Encrypted:	false
SSDEEP:	96:sehW0heW2q1rqVR3eJ5zYxvmoDmDsDqTz:jW0heW2qUV5eHYx8T
MD5:	EB9B9176263C182765835FD575691519
SHA1:	E50250EE079110BDE8E07E94DD6F35C5A4B0545C
SHA-256:	E1342830C83BD57E0858939B4651781D7F144F59A3F857C9AF738157CB877674
SHA-512:	C92B0BD7B9626723E5EFB7E0ADD2F520B6F2C4609E69D2E02B4AE924DB5C021C6C0D12B13E213B6E3E7E3B13B1FD0FC3353D29937FA375FA20DD6DE9ABD3DD05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...a............." ......................................................................`...@......@............... ..................................................................T...............................................................H............text............................... ..`.data...2...........................@....reloc..............................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...X.m.l...X.P.a.t.h...X.D.o.c.u.m.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XPath.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.966508413450255
Encrypted:	false
SSDEEP:	48:6dc5gK/T8mnv0Gij82akCEeUW+IvWX0EjNP6zDmDiZDdPvZwIWNZWvJKQSx5WmQK:0uHxLij82MZJxvWfQDmDsDDwIMWB2vW
MD5:	52CC539F95DA2B628E8B172708D85AA1
SHA1:	4F30E60D93A1091A7FFCEE6CB02F9F386200A12C
SHA-256:	4C3E7361B2EBF59ABE9362D60C21E10846BB5D1B15AAF49DE642CD1785428474
SHA-512:	8E4A5930C50CCF7D05EC71755D8722A13AFCB4A82B9D7AE09C61839FD3AAEF7F882480C55F19B2893EC4A1278FCAA9B181A9066FA9371296A834B030440A32D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...03..........."!..0................. ........@.. ....................................`....................................R....@..h....................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~......\...#Strings....P.......#GUID...`.......#Blob......................3......................................'.........C.............................g.{...%.{.....d.....{...\|.{.....{.....{.....{...c.{.....{.............................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XmlDocument.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.071246315019028
Encrypted:	false
SSDEEP:	96:30laIyQxHUi6xvjUdgDmDsD1Jw14WA9bnPUW:kYexl6xAdl14WA9bnPUW
MD5:	E3315C821612812F16FB80E1FC1EA21A
SHA1:	C948170C53F8C726E6CF1E5B78945DB9E74F5170
SHA-256:	5B756D7F2FD06ED7EE3F920D0CC3D7BA137AAFC68BB33ABC4A46B4DBBF332485
SHA-512:	80628C2806BF3C3040F0792B392EB0F71898BB9B931E93A67DDAA48C5E5AC2E3DDE4BCB835AC20C383416E54374DFA49F8647884E141243781415E4BA95C2F3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}............" ..0..............+... ...@....... ....................................`.................................A+..O....@.......................`......X*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................u+......H.......P .......................)......................................BSJB............v4.0.30319......l.......#~..8.......#Strings............#US.........#GUID...........#Blob......................3................................................P.................<...........g.~...2.~.....1.....~.....~.....~.....~.....~...p.~.....~.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XmlSerializer.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.32439821897926
Encrypted:	false
SSDEEP:	96:QGmcwjUh464LNNik5IxvW6DmDsD/BfGWpa1vW:Q13ohYBNTWxdeWp2vW
MD5:	9DACE73970B1140DCE89C50BE93157D3
SHA1:	39635DD19793E89DE596904CC263502F23E20B69
SHA-256:	B271DA95A5B7F2873649862DB8A65BFEEC3816F31D261A4A330ADCC64CDD00B6
SHA-512:	1EC012502EF4D75331B51DF5884D55A0B8787AC32388781609FD7CBADC9DED60F0BEE33BE74EB7141FFE8E4B9DED923675991D78D337A5E15A80A1C9E1795A40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q..........."!..0.............^3... ........@.. ....................................`..................................3..Z....@.......................`.......2..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@3......H........ ..4...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~.. ...p...#Strings............#GUID...........#Blob......................3................................J.................................+.....F.....H.....N...............................................................................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Xml.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.461198258075189
Encrypted:	false
SSDEEP:	192:PNl85jxIpwwvB5u9LBpRc//Y8bcLN8yGafRskmMWKvjsW:85FIeq5ufyw8bcB8yGVtMWKvjsW
MD5:	41E20670F6E98A78F865F80A9C48AFCD
SHA1:	3CAF378ABC8787E4995F38D173BDBD9EB0AC08CB
SHA-256:	73355A6686E069ED409517F9D714D8E8C51306B0D727D7D219150651D8BA6B98
SHA-512:	817934972E42228CC1E4A749FCEB6ECF59E1D225A2E639F27D80D4349C99A54E27A485CDF54F297C2B65728C21E6FE21CB0A4D84489C89CB6931764F0AB33740
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...E............." ..0............I... ...`....... ....................................`..................................H..O....`..8............................H..T............................................ ............... ..H............text...0)... ...*.................. ..`.rsrc...8....`.......,..............@..@.reloc...............2..............@..B.................I......H.......P ..4'...................G......................................BSJB............v4.0.30319......l...x...#~......X...#Strings....<%......#US.@%......#GUID...P%......#Blob......................3..................................................................S.....:.y...<.....O...................................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........:.....C.....b...#.k...+.....+.....3.....;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	4.906204991432642
Encrypted:	false
SSDEEP:	384:sTWvvVUai8offaJUz8Ki5DN+tKyFg0kUL1HGGgzG5RxVbKL2u2502zq1TXzrtwRr:KcUxA2Zi5wRNn5LVb0U502zq1Tntuk
MD5:	A1551FAE988E82B29C266873515CE8DC
SHA1:	9C18B93B4CBF4A382D631BED5B41CC41FE1C393F
SHA-256:	C647906EDD2019F829F533415ED1DE19A735049D1EF8C9F0FE11E3886F318453
SHA-512:	4A828503DBA6FE33FF18054174D9CC6F51CBC4AE2DB2772CEC7F55FD5B957966563F5505E581FD1E5ADEDB369FA9DCBAE18A4E01A188A300DA54D7EAAF007E83
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]..........." ..0.................. ........... ....................................`.................................A...O...................................x...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................u.......H.......P ..............................................................BSJB............v4.0.30319......l....:..#~..T;..4R..#Strings............#US.........#GUID...........#Blob......................3............................-.....................\=..\.\=.....<..\|=............; ..2.; ..T.M.....==....==....; ..9.; ....; ....; ....; .. .; ..P.; ................M;....M;....M;..).M;..1.M;..9.M;..A.M;..Q.M; .Y.M;..a.M;..i.M;..q.M;..y.M;....M;....M;......[.....d.........#.....+.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/WindowsBase.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.143646083216824
Encrypted:	false
SSDEEP:	96:t2clLwtmaITQxoogifQlMQyYUDTpFUADmDsDNu+iWVrcW:JytmaITFWQlMXDsKudWVrcW
MD5:	7F38FFEF26995B279F5BF0A25CA1B0C8
SHA1:	F6BE99E69F5AA8513FAFB1B646C09CC2B63ABAAB
SHA-256:	58FFA7DE24D5460BAD8045E8D38EB7B132BCCE99667A1EE1A1681D200E160FBB
SHA-512:	E1F1E49C1FD353DFFB5AC5F0E65894D7B5BE3307ED0AE9FB090FD257172784539AAE212558B490BFF246F7A6F7B9191B93519CA2B09F3EBE8995A77E896C5A07
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..............-... ...@....... ....................................`.................................K-..O....@..8....................`......x,..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l...p...#~......8...#Strings............#US.........#GUID...(.......#Blob......................3................................................................................r.....r...Q.(...g.r...6.r.....r.../.r...L.r.....r.....r..... ...........u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u...y.u.......................#.....+.C...+.Y...3.o...;.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/createdump

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|PIE>
Category:	dropped
Size (bytes):	206016
Entropy (8bit):	4.86475099116289
Encrypted:	false
SSDEEP:	3072:KRhwVyw+Ixh2Dut1SpkveW3e5CuGik6+2:IhwkZnie6e5CuGik6+2
MD5:	547B93ADD2AFBF7BCC5C7EA4E0F17979
SHA1:	53EDC3E0F05F42DC8C44C7DA8714E5E1BCA5D2A7
SHA-256:	E35674ED581AF6EA01904C803AF10CD040746CAF0BB9C421B62D00BC9688964B
SHA-512:	CA3D15D63F853DFD5740DFD5373B0AFB7EDA3C0F7A127BDE950EA1DF4922E27F3FC80CDAE3960FE22E3125585F2BD9F38EED52866FEC5B9B7091ED010D13C919
Malicious:	true
Preview:	..........................!.........H...__PAGEZERO..........................................................(...__TEXT..........................................................__text..........__TEXT...........H...... ........H..............................__stubs.........__TEXT.......... ;.............. ;..............................__gcc_except_tab__TEXT...........<...............<..............................__const.........__TEXT..........pF...... .......pF..............................__cstring.......__TEXT...........X.......".......X..............................__unwind_info...__TEXT..........,{..............,{..................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST........................................M...........__mod_init_func.__DATA_CONST....................................................__const.........__DATA_CONST...........P..............................................__DATA..................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	171840
Entropy (8bit):	4.321040554161497
Encrypted:	false
SSDEEP:	3072:k99TMikE04VIfecZ18GEy82BvhrwF3BHVyECICURjBEOBXlXxv6ImIip/8SEOrVH:Y04VIWfqXrd6/x6We
MD5:	ACC6372FC48D5704A459218038E1E85B
SHA1:	F0610296CE22DDCFEDE3A1A072EF325D4AF840A1
SHA-256:	9022587BB4181302ACDCDD86B185DF620C7C722B8FEA05D2F20A4790A95DE9BB
SHA-512:	BE15AC704F04AD717289503BF28844C797A828B56E2E7F0F54CB2C8BB054CC2E6B0D12C514B1098EA800B3C27C2F4BCC3B14999F2F4CC4E6BFE61BC9CC11CA94
Malicious:	true
Preview:	....................................(...__TEXT...................@...............@......................__text..........__TEXT..........pD..............pD..............................__stubs.........__TEXT..........7$......x.......7$..............................__cstring.......__TEXT...........$......I........$..............................__const.........__TEXT...........:......L........:..............................__objc_methname.__TEXT..........L>..............L>..............................__unwind_info...__TEXT...........>...... ........>..................................8...__DATA_CONST.....@.......@.......@.......@......................__got...........__DATA_CONST.....@...............@..............................__cfstring......__DATA_CONST.....@......@........@..............................__objc_imageinfo__DATA_CONST.....A...............A......................................__DATA...................@...............@......................__objc_selrefs..__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	920624
Entropy (8bit):	5.89450487227591
Encrypted:	false
SSDEEP:	24576:FSilAYmFJsFrFVd9vFxZd9F1t1pFJBA3iAmZfRy:FSilAYmFJJGZy
MD5:	2A02F344281B7465E6F91BF6065EBA11
SHA1:	F267AC61A466B63DC4185C56338B18E1B3AFF503
SHA-256:	E7420FDF633D76309CA9079FC378A4ED2EFB1D4BC33955A686ED43840F130E9F
SHA-512:	D2676DFAEE6BB8F891B70570A80CCA6CF6A4E2A6D46CFFB6671634D7B76F4DB95169713DC7A8D36DF1EAE5D9A01A3D355B45C9FF64E0AFE29224C3848CB9C3E5
Malicious:	true
Preview:	....................`...................__TEXT..........................................................__text..........__TEXT...........%...............%..............................__stubs.........__TEXT..........g.......~.......g...............................__cstring.......__TEXT..........................................................__const.........__TEXT..........................................................__unwind_info...__TEXT..........`...............`.......................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST....................................................__const.........__DATA_CONST............ ...............................................__DATA...................@...............@......................__data..........__DATA..................M...........................................H...__LINKEDIT.......@...............@......0...........................H...................@rpath/libSystem

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	160432
Entropy (8bit):	4.173734697331538
Encrypted:	false
SSDEEP:	1536:gyYgGNEA51hW8gT4RaAc8ASr5inN7IhEEpGHGK:gB6AzhlgT4Re8JrYnN8hEEpGm
MD5:	E7A6F9370172F6E7A74862B69999B7E1
SHA1:	D2D09177A3C9FB94D6F050029A308D47C96E8F42
SHA-256:	073B9B5ACF5C0B13DBBC86AD614316852812831C6355B7EBE982639F96BD2787
SHA-512:	1BBDC3ADA7AEED1A837C5C31A666DE4B8DB8C12CA98B4EBAD223777392B107FD9D14820FDF299BE521B99456CA6777C9A0A1E3FE33353CDC1F0DD22415BB3711
Malicious:	true
Preview:	....................................(...__TEXT..........................................................__text..........__TEXT..........0=......=.......0=..............................__stubs.........__TEXT..........m...............m...............................__cstring.......__TEXT..........{...............{...............................__const.........__TEXT..........................................................__objc_methname.__TEXT..........H...............H...............................__unwind_info...__TEXT..............................................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST....................................................__cfstring......__DATA_CONST............ .......................................__objc_imageinfo__DATA_CONST............................................................__DATA...........@.......@.......@.......@......................__objc_selrefs..__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	86256
Entropy (8bit):	1.8724937879132915
Encrypted:	false
SSDEEP:	384:Tw+Z3Sm+qGhdPjh6r+Q8/rpRr7rkxrNab8erP:Tw+ZimJG3Vg80ab8
MD5:	055CE11DFDCEBD4367C37F16348CD902
SHA1:	8B669B4C38E09AC94EC768483BA1843E9F48291A
SHA-256:	6CD0F92169A52D5B898CDFB425405EB180C8F1526FEED06C83F2BD5020F88719
SHA-512:	2AB485BC9B77A9AF32FB32A35934D87DE4A5B0827AF7215F3908D31B6B7BE67D442FB957250B9B9A39C0CCC92C58DD51DC1619B0E31EA4BDEB4053677B300788
Malicious:	true
Preview:	....................0...................__TEXT...................@...............@......................__text..........__TEXT..........P7......h.......P7..............................__stubs.........__TEXT...........>...............>..............................__const.........__TEXT..........P?..............P?..............................__unwind_info...__TEXT..........`?..............`?......................................__DATA_CONST.....@.......@.......@.......@......................__got...........__DATA_CONST.....@...............@..............................__const.........__DATA_CONST.....@...............@......................................__DATA...................@...............@......................__data..........__DATA..................M...........................................H...__LINKEDIT.........................................................H...................@rpath/libSystem.Net.Security.Native.dylib......"...0...........................................

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	166368
Entropy (8bit):	4.277854247880567
Encrypted:	false
SSDEEP:	3072:JvzZ63/5U5DlCPUcIhCWFRoniP6j+spqTN+P+:JFO/m4scIhCWFRoniP6j+spqTUP+
MD5:	8BB5C2CD0ADE70F16F27F2AAEF767AE7
SHA1:	609AAC4239B16901B5D9048AA123C53554A6F127
SHA-256:	9243D5C30E22AEFB8AD35633A130C91EC98109CB40F341A1859D2DA6069FDE84
SHA-512:	B065812FD1E04A67E6C44FFC2D30C16439B4ABC6CDE66CB2215F0BEEBACF198CE18D2E8A0F7BADDC3487992C15E930C298A79AC904CCE957622C810BBEC6502E
Malicious:	true
Preview:	....................................(...__TEXT..........................................................__text..........__TEXT...........G...............G..............................__stubs.........__TEXT..........................................................__const.........__TEXT..........................................................__cstring.......__TEXT..........@...............@...............................__swift5_typeref__TEXT.................. .......................................__unwind_info...__TEXT..................................................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST....................................................__const.........__DATA_CONST....................................................__cfstring......__DATA_CONST....`...............`...............................__objc_imageinfo__DATA_CONST............................................................__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	266176
Entropy (8bit):	5.226409294451243
Encrypted:	false
SSDEEP:	3072:ig24OtYM4X7oPNkgRH76b5ZYvXF/STwU1QTlzi:t9Ot14kGbg1+Ul2
MD5:	05D5519C5E07D8015376C62EEE7E4F95
SHA1:	875D84B5BF9B54F3A67456A43FFA066EA3D6708A
SHA-256:	F0F896D117F74754F91B378BA809107B05612F6545D60B958A30F43FA06341AF
SHA-512:	0A85038D482462AB0D859CA946ADE202912DF9C87695BD65CE0596BEBDF615AA0BE016093063893CAC5AE3E62C3FE6A1295232C3907D5DC91BF83E897A49C40A
Malicious:	true
Preview:	........................................__TEXT..........................................................__text..........__TEXT..........P&......eQ......P&..............................__stubs.........__TEXT...........w...............w..............................__cstring.......__TEXT...........x......w........x..............................__const.........__TEXT..........................................................__unwind_info...__TEXT..................x...............................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST............(..........................."...............8...__DATA...........@.......@.......@.......@......................__data..........__DATA...........@...............@..............................__common........__DATA...........A..............................................__bss...........__DATA...........P...... ...........................................H...__LINKEDIT..............

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	967072
Entropy (8bit):	6.337552282019723
Encrypted:	false
SSDEEP:	12288:WC1Q2CB+NHfZVpuvfltr2rWv3ReBEPBjMcec07lsuPxMr86J:B1Q21Pq6Z0Bjfe0upMr86J
MD5:	1074967F156355B6BDFF673E2E4D9D07
SHA1:	4C48AF31ACE364CDEE17BC5F0BF928B8CA3198E3
SHA-256:	02AD85E23969788E00DE50F09398691C241F114F1BD4E156B223F7411F2C8AAD
SHA-512:	0147F6D645730423F6954DC66AE9AC8311BBD4700828D282A76B4FDB5A05478C1917CE45961BF788F13F45F7AD06C1D54FA4F867E21E23FAF7F94A4ECD95EE3D
Malicious:	true
Preview:	....................................(...__TEXT..........................................................__text..........__TEXT..........pN.............pN..............................__stubs.........__TEXT..........2...............2...............................__gcc_except_tab__TEXT..........................................................__cstring.......__TEXT..................w.......................................__const.........__TEXT..................x.......................................__unwind_info...__TEXT..................x...........................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST............`...........................H...........__mod_init_func.__DATA_CONST....`...............`...............................__const.........__DATA_CONST....p.......p.......p...................................8...__DATA...........@...............@.......@......................__data..........__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	3153840
Entropy (8bit):	6.510177971581124
Encrypted:	false
SSDEEP:	49152:D1fmNFTfKFdXhCoMDdmXYv3IRGq9by+YUFVGZBeOiVk1HyAFcv:5fmNIFdgoMDMU4RGKyMFQZBYVku
MD5:	0014FA47944FA96B9169C8E7FF80BFC9
SHA1:	D2C55202810C79683DBEF07E1EC26C83CB174449
SHA-256:	3C819BBB12F95FB1CB230BB742E5CBA1B0889C65DA331B59653A65BED80AE9A2
SHA-512:	1A39EFA9BC4FDACEE9B78295DB3BBC160915CB897E18FB73EA696D63910CECECD8B3E123DF93AB01B0BA825C3C62229EAD499CA85C246B69D98117D53AC014B6
Malicious:	true
Preview:	........................................__TEXT....................'...............'.....................__text..........__TEXT..........@\......jx#.....@\..............................__stubs.........__TEXT............#.....H.........#.............................__const.........__TEXT............#...............#.............................__cstring.......__TEXT............$...............$.............................__gcc_except_tab__TEXT...........r&.....h........r&.............................__ustring.......__TEXT.......... .&......7...... .&.............................__unwind_info...__TEXT............&......6........&.............................__eh_frame......__TEXT............&.....H.........&................h................8...__DATA_CONST......'......@........'......@......................__got...........__DATA_CONST......'.....8.........'.............................__mod_init_func.__DATA_CONST....8.'.....`.......8.'.............................__const.........__DATA_C

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	6738240
Entropy (8bit):	6.551235627974232
Encrypted:	false
SSDEEP:	98304:AOzpyF6tM663Jh6dJZz9sxmgBP7BeOR8:K2/WDR
MD5:	CCE888B2661F2DC3668716D7B8BF4E2F
SHA1:	DBD9DCB6D7D87E7E1BA3E81BDE604070757517A3
SHA-256:	43DBDE84CD570C916EE59EA2F685D6CF3FA83E23A7D447279B8445E4CA5786F8
SHA-512:	9252A8765C0AEAEF108F723F61CABF0C3B6154C9BCCD2108568AFA21D91596EDE92171B3720B0E0D00DF4F0C59E5327BA07B6EE7F1B4A2096E01187C52AA7F33
Malicious:	true
Preview:	....................p...................__TEXT....................K...............K.....................__text..........__TEXT...........0.......sC......0..............................__stubs.........__TEXT..........B.C.....>.......B.C.............................__const.........__TEXT............C.....l.........C.............................__cstring.......__TEXT...........D.....4........D.............................__gcc_except_tab__TEXT..........$.F.....\=......$.F.............................__ustring.......__TEXT............I...............I.............................__objc_methname.__TEXT..........p[J.............p[J.............................__unwind_info...__TEXT...........\J..............\J.............................__eh_frame......__TEXT...........mK.....H........mK................h....................__DATA_CONST......K...............K.............................__got...........__DATA_CONST......K.....0.........K.................5...........__mod_init_func.__DATA_C

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	446144
Entropy (8bit):	6.042123254097315
Encrypted:	false
SSDEEP:	12288:LHTECRhfO4aB9SqLF8ZNPjOZndRMPkuEU5:bTEm2VBwqGZNPJkuEY
MD5:	E5E1A75798BAA6AABFF962CE5350AD3C
SHA1:	CECEECBED8F021D5EB4B4C74C688EEDB9FA2FB65
SHA-256:	270510B5C291FD9DB3722BC9405F57D09D1EA5AD70804D03F7A72D4A7BBE9044
SHA-512:	ADFEA573148B129402719596C44FE9C7907E273D082B11CDF647CD2C1E000F6BCA9DF797A4DE60F011186AA787FA135B6E012FC1FAD28E96A859686F1E024221
Malicious:	true
Preview:	....................0...............(...__TEXT..........................................................__text..........__TEXT..........@+......aQ......@+..............................__stubs.........__TEXT...........\|...............\|..............................__gcc_except_tab__TEXT..........(........#......(...............................__cstring.......__TEXT..........$........:......$...............................__const.........__TEXT..........................................................__unwind_info...__TEXT..........P...............P...................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST............(.......................................__mod_init_func.__DATA_CONST....(...............(...............................__const.........__DATA_CONST....0...............0.......................................__DATA...........@.......@.......@.......@......................__data..........__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	2445040
Entropy (8bit):	6.444282705924424
Encrypted:	false
SSDEEP:	24576:wQjmrBDQ7ZSOjBcYdpD6hXJrp/e5ujLg+Dt+uiucuDeh3PzxmuHsE:wQjW5Q7ZSOjBvDWXX/djs+Dt+3bxv
MD5:	4B322C70D6E02F3485D208889AA5EF87
SHA1:	4EB2DDC456F27623DDBBF3D2A2A2FB2881DD172B
SHA-256:	28CB25234D730AFD3E7C33D9CE81900E1E087AA114928E797FEFEA97368E8275
SHA-512:	D700963F8353C9AADB1B32C84C57FBA0C9CF3B3543E16B1B24B98B73CEBA8111E780EC405CCF59A58D0CC7F499CFDEDAF2438AFB2C05833AF13ACC39D490B074
Malicious:	true
Preview:	........................................__TEXT..........................................................__text..........__TEXT...........!......ZG.......!..............................__stubs.........__TEXT..........:i..............:i..............................__const.........__TEXT...........n.......j.......n..............................__cstring.......__TEXT..................\.......................................__gcc_except_tab__TEXT...................C......................................__ustring.......__TEXT...........:......p^.......:..............................__unwind_info...__TEXT..........P.......he......P...............................__eh_frame......__TEXT..................H..........................h................8...__DATA_CONST....................................................__got...........__DATA_CONST....................................................__mod_init_func.__DATA_CONST............P.......................................__const.........__DATA_C

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib

Download File

Process:	/bin/cp
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	1756800
Entropy (8bit):	6.418018969365482
Encrypted:	false
SSDEEP:	24576:K8XxjSngxqQWMyzKGbhh2DwR5rJlRs0gPf/EDq:K8XxjSngVyh2DwvjgHM
MD5:	E391FD0C68230AE9B266E85BA8B39C8D
SHA1:	D72E078C6972AAF87838662377C6703EB9FA74AF
SHA-256:	A20B3ABA95F1D12ADA3FBEA583ED26CA4A8351D5C8195F53277C83979384999E
SHA-512:	209C84DE8E7788ACAB6255EFFE9BFE8E4273FBA1F4FCB702FB7C16BB687FCC924C40551A88E664D8C1F4F73C7154F860417FB7A5424F601D7EDD39CB0A1A676F
Malicious:	true
Preview:	........................................__TEXT..........................................................__text..........__TEXT.......... 2......`....... 2..............................__stubs.........__TEXT...........)......H........)..............................__cstring.......__TEXT...........,.......#.......,..............................__const.........__TEXT...........P.......(.......P..............................__gcc_except_tab__TEXT...........x...............x..............................__ustring.......__TEXT..........p.......`+......p...............................__unwind_info...__TEXT..................O.....................................__eh_frame......__TEXT..................8..........................h....................__DATA_CONST....................................................__got...........__DATA_CONST....................................................__const.........__DATA_CONST............................................................__DATA..........

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/mscorlib.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.929357518798905
Encrypted:	false
SSDEEP:	768:4t51EDMpCUoqFY66Gw17oqZn/TEHmyrchswz6EEZcYf5o4ba2yGlG1QeY48lCi5:4tFcC3ZcYf5o4bZyGc1A4c5
MD5:	B7DF42F8DA8243167A671CD7DB807982
SHA1:	7D56F836EFC3DDBA77CD526F033B95F501D624F0
SHA-256:	FBBB0231DF2CC670D70D9771CC341E4F91FE037534817B8C2BDC52BDBF307923
SHA-512:	28A4A503BD4D1882E95D9D5FF16ABFFB7DFC9A8F1D33A659921E7A8965574DD4358BBEF62D37A7ED3604296940EA56BA68157C08F5880CBC935A4C1097A87367
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................... ............`.................................m...O.......(...............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B........................H.......P ..................... .......................................BSJB............v4.0.30319......l...$O..#~...O..(b..#Strings............#US.........#GUID..........#Blob......................3................................e.....b/........L%.O...).O....RO..EP.......+..:.:4..J$:4...&S0...+.O...%.O...(:4...&:4...":4....:4....:4..U&:4....:4.................N.....N.....N..)..N..1..N..9..N..A..N..Q..N .Y..N..a..N..i..N..q..N..y..N.....N.....N......R.....[.....z...#.....+.

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/netstandard.dll

Download File

Process:	/bin/cp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	5.0932220853268335
Encrypted:	false
SSDEEP:	1536:PYsYXj0p2NYq5V4bgDHsPdIpuSE5L3Ukcz9wF:QMkYe4bgDUAxCF
MD5:	CC5BC921FB6963881BF191137F659C31
SHA1:	35C4826395DAE7DE4FABAC643A649AC69DBA1634
SHA-256:	6B0915EEF0015FD806B8A4EA24E63F45164A8C1AFEC4E6E7AD57BA640D9825D1
SHA-512:	B8A4A9D4450FF82D97BAE6EDAF0EAE212BED1CD82A8A990480D7DE9A5DAF0D59E5A48F076811FD76009F9C9A2EB02F7FFF73BDDD0A3EC18B6C19A895B35091E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K..........." ..0..X...........v... ........... ..............................XF....`.................................;v..O.......8...........................hu..T............................................ ............... ..H............text....V... ...X.................. ..`.rsrc...8............Z..............@..@.reloc...............`..............@..B................ov......H.......P ...T...................t......................................BSJB............v4.0.30319......l...`...#~..... ...#Strings.....Q......#US..Q......#GUID....R......#Blob......................3............................P...,......H.........5....:....'...m......,.@..5#.T..P4.T...7.J...B....i5....u:.T..n7.T..&1.T.....T.../.T..(7.T...(.T.............................)....1....9....A....Q.. .Y....a....i....q....y..........................................

/Library/Receipts/InstallHistory.plist

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	6554
Entropy (8bit):	4.942035555950273
Encrypted:	false
SSDEEP:	96:CyCz9Aj19AdTfMNTMMNTrvMNTRMT6P/oulO7u6luE7O7O+QfWfNfvvfufRMfsGO/:XYypy9/W6D/oykVlVyJr69
MD5:	12FBFCEB319D87C1D9495C16ED23FE05
SHA1:	8D25EAE2AF078B61E32DC835ABB71C3834625515
SHA-256:	B7B52A6FE66804C60851760D124090AA0A111084E48633E42963C13266C210CB
SHA-512:	92C38638DAA3EA5B7CE741FB1C5FAC5DB6457F4F89A71FE1DFF20E1CE3BDCD9CA12CA6FC9713BF36424DF276957ACAAC33B427D94455F4CF2D1F624FDBF92CCF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<array>..<dict>...<key>date</key>...<date>2019-07-01T11:46:14Z</date>...<key>displayName</key>...<string>SU_TITLE</string>...<key>displayVersion</key>...<string></string>...<key>packageIdentifiers</key>...<array>....<string>com.apple.pkg.Core</string>....<string>com.apple.pkg.EmbeddedOSFirmware</string>....<string>com.apple.pkg.SecureBoot</string>...</array>...<key>processName</key>...<string>macOS Installer</string>..</dict>..<dict>...<key>date</key>...<date>2019-07-01T13:09:51Z</date>...<key>displayName</key>...<string>SU_TITLE</string>...<key>displayVersion</key>...<string></string>...<key>packageIdentifiers</key>...<array>....<string>com.apple.pkg.Core</string>....<string>com.apple.pkg.EmbeddedOSFirmware</string>....<string>com.apple.pkg.SecureBoot</string>...</array>...<key>processName</key>...<string>macOS Installer</s

/dev/null

Download File

Process:	/bin/cp
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.409975519897382
Encrypted:	false
SSDEEP:	3:1HAK7NPQQtCt6FZMDwFM5VxTCBJ2reP6FZMDwFM5VxTCBJGEXDc8AGt:1gK7N7O6jMMmLtC/2U6jMMmLtC/TXDci
MD5:	2F511A2BD410610FBB1768F6F411FE22
SHA1:	5C226B16A87AC00894C54802E50F71E061B62244
SHA-256:	2D030B2707EB8080C0F35EE75885A75D4282A446FFD3F2803265B337FA0FD070
SHA-512:	DFA12B0F52FDC52A85C72E952C9B7378BECEB500CF8EC963C7441089612840AF0634BF9B625B7CD95E8E2196901FA194C0C3CEFA1E87BF717CE0F7958AAFCF16
Malicious:	false
Preview:	cp: illegal option -- u.usage: cp [-R [-H \| -L \| -P]] [-fi \| -n] [-apvXc] source_file target_file. cp [-R [-H \| -L \| -P]] [-fi \| -n] [-apvXc] source_file ... target_directory.

/private/tmp/dotnet.DUZHkmnca/LICENSE.txt

Download File

Process:	/usr/bin/tar
File Type:	ASCII text
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	5.081922599985454
Encrypted:	false
SSDEEP:	24:b9rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:b9aJHlxE3dQHOs5exm3ogFh
MD5:	9FC642FF452B28D62AB19B7EEA50DFB9
SHA1:	28D4EA6C2F895F6CE371AEE5A98B6C9C40105B3A
SHA-256:	CFC21F5E8BD655AE997EEC916138B707B1D290B83272C02A95C9F821B8C87310
SHA-512:	27F511FEFEA2390347BB7EA63F7795A26780AD43ECA80D717C92C70A434D28FDF136C4B902750B52813ED9CF0D3C51AF206062323A0496459461D985A34AC5C7
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) .NET Foundation and Contributors..All rights reserved...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

/private/tmp/dotnet.DUZHkmnca/ThirdPartyNotices.txt

Download File

Process:	/usr/bin/tar
File Type:	Unicode text, UTF-8 text, with very long lines (755)
Category:	dropped
Size (bytes):	94355
Entropy (8bit):	5.215380552271277
Encrypted:	false
SSDEEP:	1536:oV1VXrAatwbImlxJBD2XbUntFRavzWCHr9N4rlKS7SIuVZ1d6iA1QGdVbU9erlNc:oV1Jr/8l7BqAFQvaqrIr8ZVArerlCpSh
MD5:	94D8370133696C4CA9F8B09E82CE7B65
SHA1:	BFD81CE77A8F92D80077180658A8DEEBC007F887
SHA-256:	FB47C97D2919D9584F25564058F973DE424DA8B500D51B46E406391C6E9ADCA6
SHA-512:	42267A7F2A361B94D7205E7D8D125928F58C8BF80DF876345FF1A5B8D247B6852E01A373A1E28F0BD146A75136B190089CF46A690A3D89E55BACED3A9CFBE558
Malicious:	true
Preview:	.NET Runtime uses third-party libraries or other resources that may be.distributed under licenses different than the .NET Runtime software...In the event that we accidentally failed to list a required notice, please.bring it to our attention. Post an issue or email us:.. dotnet@microsoft.com..The attached notices are provided for information only...License notice for ASP.NET.-------------------------------..Copyright (c) .NET Foundation. All rights reserved..Licensed under the Apache License, Version 2.0...Available at.https://github.com/dotnet/aspnetcore/blob/main/LICENSE.txt..License notice for Slicing-by-8.-------------------------------..http://sourceforge.net/projects/slicing-by-8/..Copyright (c) 2004-2006 Intel Corporation - All Rights Reserved...This software program is licensed subject to the BSD License, available at.http://www.opensource.org/licenses/bsd-license.html...License notice for Unicode data.-------------------------------..https://www.unicode.org/license.

/private/tmp/dotnet.DUZHkmnca/dotnet

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|PIE\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	140144
Entropy (8bit):	4.155922518509666
Encrypted:	false
SSDEEP:	1536:b5fgs42qLD5hi7R6ctcE9DMeLbjydp2XmpmPpuUTkPfRdjkK:bNH+/LE9Dn2d/pmPBkPfg
MD5:	A7E30CD9255DDF14B75560D385FA21B8
SHA1:	262B0A9CF89B665E55898EAF534917E7E924B527
SHA-256:	E018143AE9D38DAC37B704C8D813D9BE86D09E950DBB36D70424A2D8CD0549F6
SHA-512:	CF830CE8CA8FD331FC40F337EEE8557F771CE884BC95BA6E2DA05C7B6DAC46F3AC1FD8B0247E22148F4B990BF746DEFA2F878596DA481970C3F2BC4AA38CBAB6
Malicious:	false
Preview:	....................................H...__PAGEZERO..........................................................(...__TEXT..........................................................__text..........__TEXT...........+.......u.......+..............................__stubs.........__TEXT..........#...............#...............................__gcc_except_tab__TEXT..........................................................__cstring.......__TEXT..................r.......................................__const.........__TEXT..........0.......p.......0...............................__unwind_info...__TEXT..................`...............................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST........................................S...........__const.........__DATA_CONST............................................................__DATA...................@...............@......................__data..........__DATA..................

/private/tmp/dotnet.DUZHkmnca/host/fxr/8.0.14/libhostfxr.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	403456
Entropy (8bit):	6.054297017429264
Encrypted:	false
SSDEEP:	6144:AD4khGL0OoQDAGnd7VxDO5d7rUReW6o/Iv3dG0weA4cNkB50:AEGtOoAnd7V1U7rUR+v3dGrm5
MD5:	1C28E7D994D5ECC1B72A30E917BA8C47
SHA1:	E14C084FB13D94269ED67D43C22996C256387E26
SHA-256:	A7742CC60E52E2072BDB0CB6AD250DEE7355F22AB00573A899157CAA69D0557C
SHA-512:	90D36ED10AAA8184BC236739EA3CF236E95C49FC33F2DE493ECDDEA1D57F88CC05EAE5E1BB569BE99509F764B92195908ADD149F5A21DA6A48A11C2300254F21
Malicious:	false
Preview:	....................(...............(...__TEXT..........................................................__text..........__TEXT..........`.......!#......`...............................__stubs.........__TEXT...........6...............6..............................__gcc_except_tab__TEXT..........d9......l$......d9..............................__cstring.......__TEXT...........].......B.......]..............................__const.........__TEXT.................m......................................__unwind_info...__TEXT..........`...............`...................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST............P...........................{...........__mod_init_func.__DATA_CONST....P...............P...............................__const.........__DATA_CONST....`...............`.......................................__DATA...................@...............@......................__data..........__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/.version

Download File

Process:	/usr/bin/tar
File Type:	ASCII text
Category:	dropped
Size (bytes):	48
Entropy (8bit):	3.9371795021836387
Encrypted:	false
SSDEEP:	3:JQoGam2U3NdSJ:OaKYJ
MD5:	0321B8DC4DB46BE37ACA15CD74389CE3
SHA1:	B647C035F83F9A4405D2B08689077A54628163EF
SHA-256:	F123C77A26CB846F50C9C8836F2808860A19866C94D926A7ADBAA069F73DDAF8
SHA-512:	5733AE2C7DB77F4EB96D2C69342D18FBE005851D157C9A16AA0CC3471BC4C93203F2A5F90C6BDBD8BC2022D3B0385A28D7D69BFF734BA20B754BD5CB5FFBE885
Malicious:	false
Preview:	1584e493603cfc4e9b36b77d6d4afe97de6363f9.8.0.14.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.CSharp.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	806912
Entropy (8bit):	6.860811981292832
Encrypted:	false
SSDEEP:	24576:R+fGvVDWdtBruWQUtBfH3u9yHeBpRGkQss:R+fGVDWdtBZthH3u9yHerRGkQ
MD5:	485E81D860F1C892817D4E39295A224D
SHA1:	79B270EE5CBF63B418AB6114BEB192C12E0AADBA
SHA-256:	05CD4CFFD2C58DC43878A37408EEEDCB1A0D430AC1E9C062AD64DF5888BBB51F
SHA-512:	5146C0B04C25F0B0122E64EE5C47F99455BAC9213C5FE36269071458C46F3516FFDDE847B3AF0D1FEF4A356944F866002B892421896AF9AB07A0D321CCE65262
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....t...................................................P............`...@......@............... ..................................d...H....B...........@..t...P...T...........................................................h...H............text...\|r.......t.................. ..`.data........v.......v..............@....reloc..t....@.......@..............@..B............................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...C.S.h.a.r.p.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....M.i.c.r.o.s.o.f.t...

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json

Download File

Process:	/usr/bin/tar
File Type:	JSON data
Category:	dropped
Size (bytes):	29252
Entropy (8bit):	4.18849947968303
Encrypted:	false
SSDEEP:	384:2Bvm0M7HqawqACXmT5ba9iCJ2splCefqVrKjqRU/AJ4K:2UP+F
MD5:	BD081E0C99C97038C18EDB0E6348430B
SHA1:	E69184260280F2D590F3A3D85C52E75AA92D28B6
SHA-256:	881C19DF65042A52FFBC3BEEB1B1D95D351BC0028F9F05FE6CFCC04C8F4E2FF7
SHA-512:	7054A1C7A9AACF31C9C18FB864D100E09984F2A8079F53442FE6A1F4A83A7EA2C993CD6CBA0586209EBE057F9F952CBAF283549995627F4ADA48D374D17A132D
Malicious:	false
Preview:	{. "runtimeTarget": {. "name": ".NETCoreApp,Version=v8.0/osx-x64",. "signature": "". },. "compilationOptions": {},. "targets": {. ".NETCoreApp,Version=v8.0": {},. ".NETCoreApp,Version=v8.0/osx-x64": {. "Microsoft.NETCore.App.Runtime.osx-x64/8.0.14": {. "runtime": {. "System.Private.CoreLib.dll": {. "assemblyVersion": "8.0.0.0",. "fileVersion": "8.0.1425.11118". },. "Microsoft.VisualBasic.dll": {. "assemblyVersion": "10.0.0.0",. "fileVersion": "8.0.1425.11118". },. "Microsoft.Win32.Primitives.dll": {. "assemblyVersion": "8.0.0.0",. "fileVersion": "8.0.1425.11118". },. "mscorlib.dll": {. "assemblyVersion": "4.0.0.0",. "fileVersion": "8.0.1425.11118". },. "netstandard.dll": {. "assemblyVersion": "2.1.0.0",. "fileVersion": "8.0.1425.11118". },. "System.AppC

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.runtimeconfig.json

Download File

Process:	/usr/bin/tar
File Type:	JSON data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	3.951772222577167
Encrypted:	false
SSDEEP:	3:Kn/m/FzDI/pAt9FCY:K/W6hAUY
MD5:	6185B156B8A7C4A61D9A801AAA9A10D2
SHA1:	74AD292B4B1863E38E683D5E3FFAFD9EEF2F9E94
SHA-256:	4A798DA45BC138AE224341FEEBF984C9E330A4BEE2EBB7A821505D95D17124FB
SHA-512:	9B0143B8512B4909DCF4DD2F7FB429F866E104D41BB21BE48015E6C502C66EF723EC774D55912AA9D138CDB7C0FDA021068B261146DE84EA45E32C7819A2E038
Malicious:	false
Preview:	{. "runtimeOptions": {. "tfm": "net8.0". }.}

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.Core.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1207808
Entropy (8bit):	6.813494276237294
Encrypted:	false
SSDEEP:	12288:jfzvbVQWelLwt/L0pOQ2VijXpzzORAyK1xASX3DIkvY+uzmW6UFCrqABPJqWsVb/:zzveWowz0X1X7Ln1v6guAkanOF
MD5:	31874264F7DCD413F70662600B359B7B
SHA1:	8AC78D2E645F46A28BCA89BC323B59921BD26BA2
SHA-256:	E2D66800846ABD20A7D74CE296FF46DB43E10EA7C203336F9F45A2D784158119
SHA-512:	3E0585B62FC7A457B3361D0A4DC935548B9E89BCFB9344A7FA02E73C7B863FECAB0DA0B94C631038D5E4425C2C8CA0787979AC4DDDE3B84D0004088096775CA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...f............" .........................................................n............`...@......@............... .......................................^...]...........\..t.......T...............................................................H............text............................... ..`.data...K...........................@....reloc..t....\.......\..............@..B............................................0...........................^.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...V.i.s.u.a.l.B.a.s.i.c...C.o.r.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.1496131215588665
Encrypted:	false
SSDEEP:	96:2MlPBUyk4ulENH5gJombTc0uaxvjUFuDmDsDx7ZUN4xWmH639QdWc:PICHu3csxAcxWmH639QdW
MD5:	94B81502E9454B5A4141B7CFED3696AF
SHA1:	0FAA18A5CBE9A973376B996F5E8EFAD91481FE4E
SHA-256:	35537A7A6120B102C077A15F2D41639789EE4EB80DBAD4DE61486BD010D2C5E9
SHA-512:	646811008D273E99E8C045E0212142D17118E271CBE5FE84FEC09C6FE2D77F68457F07776ADF8ACEE329FB75C31A017DF6C563E573F9ECD9560DB0E18DEB7929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....c..........." ..0.............>1... ...@....... ....................................`..................................0..O....@.......................`.......0..T............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......P ..4..................../......................................BSJB............v4.0.30319......l.......#~..,...t...#Strings............#US.........#GUID...........#Blob......................3................................K.....C.................................J.....~...........b...........G...........c.....................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.1138356843673565
Encrypted:	false
SSDEEP:	96:rOE5YrdiCAcqxvOEPDmDsDHixIGWhPMpW:XiBpqxkWhPMpW
MD5:	719F2C6F0E306C9B0CBB1945CC115567
SHA1:	3BECDFC496FE546302347B8056A43C1848D71C9F
SHA-256:	0C3C5048F3F654C3B9DA64502BD3FB6E633147F378BA07114B70006411E61ADA
SHA-512:	51DB5C42A0AF5745F3B418FFB53E8F6FBA9421B63F40CF33AA9D778D817796CBCA4D40BA52076C86C8E8E83D44B74A88299172D992C6C760EBDCE941CD2F3697
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+^............"!..0..............)... ........@.. ....................................`..................................)..N....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..(.......#Strings............#GUID... .......#Blob......................3................................................"...........;.l.........f.....!.E.....E.....>.................E...[.E.....E.....E.....E...B.E...O.E...v.............

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Registry.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.294828560733334
Encrypted:	false
SSDEEP:	384:wWnW5GWcLRjwr79fllE7bBQjiNXCrKesmkBViacmO3k:mGwrTlkbBQASOe4ViF
MD5:	22861480D78A2A32C48A9EA42FF47D83
SHA1:	35BB937EF65230179230CF4CC4B65550E8A00A9A
SHA-256:	86CD7335E9C429A6C2546FC1A7917557D1D1D745D125929FE7FC1C6BA9D0D645
SHA-512:	FC0C9EC83FA8612B034D25F63F65C619906B0F69DC0BB45486A4438C91C01862D01D2242CD135DD3449383B5F1FC86C8E4D4CD4E133EAD1DECEFA6B0D3678102
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...@C..........." .....P...................................................X............`...@......@............... .......................................S...............V..........T...............................................................H............text...\N.......P.................. ..`.data........R.......R..............@....reloc.......V.......V..............@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...J.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...W.i.n.3.2...R.e.g.i.s.t.r.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...Z.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....M.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.AppContext.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.761227106986154
Encrypted:	false
SSDEEP:	96:u6mYlVdyVl1xvjUBDmDsDOw3KWe3poYWW:oYjgxA9aW+S7W
MD5:	097EB602BD9E1D3F337CB967B4BE0DBD
SHA1:	256718C7F20093C2F1354521F267F5122E554866
SHA-256:	3E33431F95F4B49C3BD88B49516CD1F54B4A9609D72468D263E1B628203C776E
SHA-512:	0CD3E3C8487EBCECB21226942B5F4D6A0E778C037B1929443D30B97C6FE790ECC4D2D79339A1C0F44B3EA6E2866A614F4C0786C4AB4D962B975E20F1E6C1AC2D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........." ..0..............(... ...@....... ....................................`..................................(..O....@..h....................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................(......H.......P ......................('......................................BSJB............v4.0.30319......l.......#~......<...#Strings....H.......#US.L.......#GUID...\...\|...#Blob......................3......................................................x.....3...........^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Buffers.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.967297521758999
Encrypted:	false
SSDEEP:	96:d+Wql/qbDBryWDlpRUODmDsDFG3qFWYZ2W:OlEgCGeWYZ2W
MD5:	447796CD10409401E02BE5B5B6D1080D
SHA1:	ADD4C349CC799BFA6CA9F14BB2A5902D417EC97F
SHA-256:	F7225E08986B34ACC3C246F886021CBE22AC6C63BD89A523F3AF12103D4F31FD
SHA-512:	F5F966C6B7E048B97D4DDB6C024E0216A743247B51559B3DEBFBD00A0E3C122D316FAD078B79BE8CEA267934EFA98B3D5224D89093BD30A93FFA888FC61E328D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.S..........." ..0..............(... ...@....... ..............................b.....`..................................(..O....@..X....................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................(......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~......@...#Strings....L.......#US.P.......#GUID...`...\|...#Blob......................3............................................................?.....!.....j.....%...........U.....k.....:.......................!.....S...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Concurrent.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.84650249408809
Encrypted:	false
SSDEEP:	6144:HbgV4VkHkisGGFeq5PpMba3GGzmT3LBx0hyO2z7yfg2rjt:HO4VFhD2z7qRj
MD5:	73234F77D49E8E32A6E37A96ED47AB7D
SHA1:	A0DA64EA285F6C3DE6F42EA534C1DF3B77B53B6C
SHA-256:	3A3CE35F4C81EEECB2CB7A82B36E8D095EFC1998BFAF406EF6E05B4384478277
SHA-512:	26B58041C8AEFFF9C9D428B0207346041C6D5664EE63B4A34AD6AEF3152A88082FE0334CEA0B40DEBC940A43384184E4C169B7AA364A4670917B7244487DFE86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." ......................................................................`...@......@............... ......................................@...T.......................T...............................................................H............text.............................. ..`.data...4...........................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...C.o.n.c.u.r.r.e.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Immutable.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	6.798707666985778
Encrypted:	false
SSDEEP:	12288:DXNnnD1hULWNtbrm0T9YLVgiy9UWvSWxYAkb9p6:pDrrIZy95J1O
MD5:	B893BF88DDFC50B5D43E895DA0D05975
SHA1:	79EF3681E85DD2DD2DC7F1CA17E8EC13CB1FEAB4
SHA-256:	F9C978A0BE5DC63E80F0D10000480E511D74030E3D98F4913B4B82B33D4E3F1D
SHA-512:	BE25735091BC4AB454167A7F419348A7857E054584FC887972B43486AB40EF1C1B10BA7809B5F58288E2C2FA22789087C818A28F7B2DDFB56B45BD3BA98A25AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...G.1..........." .....@...................................................^............`...@......@............... ......................................@....b...........J..h.......T...............................................................H............text...(?.......@.................. ..`.data........B.......B..............@....reloc..h....J.......J..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...j.....C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e. .p.r.o.v.i.d.e.s. .c.o.l.l.e.c.t.i.o.n.s. .t.h.a.t. .a.r.e. .t.h.r.e.a.d. .s.a.f.e. .a.n.d. .g.u.a.r.a.n.t.e.e.d. .t.o. .n.e.v.e.r. .c.h.a.n.g.e. .

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Collections.NonGeneric.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.322592762217019
Encrypted:	false
SSDEEP:	1536:GcvRofU61nSm1CVrMZ2+AQWWLtgZTl3d:GoR03rgGZGQfeh
MD5:	429B5045C68BECBABC17FCFDC07BD5EB
SHA1:	54B2C129F8CF01634006AB012004654261753900
SHA-256:	5E35321B36D2EB7BB421F05602EE2BFC9E729B2E9C37A31BF2D171CDFF5235A2
SHA-512:	6D919BE79329F942496FC14C8E4200E6769937FA5509D628FB6CFFF9A56ED670166155EEA42D7DF45F1CD1DC221581BB237610346EE1C314784004D8151C8672
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....._..........." .........D...............................................D............`...@......@............... .......................................................B..........T...............................................................H............text............................... ..`.data....@.......B..................@....reloc.......B.......B..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...N.o.n.G.e.n.e.r.i.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Specialized.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.468663706888897
Encrypted:	false
SSDEEP:	1536:oH7g214zQEtHA3kNtH620sCbmgcPAO8xocgu509KERWfn/kq:obFKtA3StaeOcAOSocgua9VRWv/k
MD5:	304C879DF8BB681755F23D9703EBD6F0
SHA1:	ED4ADAF69ABF597EC7E5949A839186DA728CEA53
SHA-256:	E750CFE1AC26F2FF74FA0182B7CF61832994B58515C96B2D45CD21B44CE8BFAF
SHA-512:	5271CB7DBD8DB2DD61268DFF11A4DE6C58A77F5648E591A9500D26D143F3B5C74A005377C838DFACE7F26364FD7A8FA8CAB639AF14F159A250D5922173D5BC51
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...M............." .........F...............................................D............`...@......@............... .......................................................B..........T...............................................................H............text............................... ..`.data....C.......D..................@....reloc.......B.......B..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...S.p.e.c.i.a.l.i.z.e.d.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Collections.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	6.742344820796916
Encrypted:	false
SSDEEP:	3072:nj0b1vowuxUZ3mZZN76mQ0Kryplm1ZPqcgF5K36pKJL0eYIDp5WkI/K:j0hvowuE27kryS18cgy3sKJLj15WkmK
MD5:	1D2882A1F312CF8AF42846E01D4DDB4A
SHA1:	63F201E08031DF01FB6610CFAE2B98B25E4C1010
SHA-256:	26D37481453F3719883CB0F46B93CED68E2F81D472E523350EBF2CE310B79A24
SHA-512:	E35882EE4B7063E8890CBA9A2196765BD1CAE731F20C2B14E081A637B637F625D092038800A99DDD057916F57E6482561AE6D221B80D2BFF00678B93736CB068
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...'............." ......................................................................`...@......@............... ..................................t...........................`...T...........................................................x...H............text...(........................... ..`.data...............................@....reloc..............................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...C.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Annotations.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	6.38907401096189
Encrypted:	false
SSDEEP:	3072:qBOTlBKM218gxrKjjeU1QKhadCLLeXY+z43wmMWQArD5/oE5bF6a+SMse7w:E4SMB9+U3wzWQAra17w
MD5:	0D55A3B3100CE69B55CEAE17AE4023BF
SHA1:	AD69657BCF526A4A71BA147DA2A10CE993753D6D
SHA-256:	C2BFAD3C148FA9020C1A848588F9A7D4C808F8AA496BC2FE22721FF49608F03B
SHA-512:	30A636F6CF75BAE4931A28BB2335D8452816230DE19990FFEB654B936D32D7A5B8576824BBA0B32C929D7A32E8BFE4BB286A46295E084BE04E34A4CFAFCBF961
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....Qo..........." .....0................................................................`...@......@............... ......................................@h..p...............L.......T...............................................................H............text..../.......0.................. ..`.data...'....2.......2..............@....reloc..L...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...\."...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...A.n.n.o.t.a.t.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...l."...F.i.l.e.D.e.s.c.r.i.p.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.DataAnnotations.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.142509089257399
Encrypted:	false
SSDEEP:	96:koC61lUO+yLA4ptors4lKaeIeGXrNeTpFUnfDmDsDyrGjaWu+XW:LXg4pmr/lKaeIeGXx3nMrGmWu+XW
MD5:	222D6743E183CB489064AFAA1B114816
SHA1:	39C054C1FE6BB871DC9439B644B04AA06A6673A2
SHA-256:	E2325D1791CF6C46BDF974AF68A23DE291978DDB209D8191AE6AEF9A76EF3C47
SHA-512:	856E6387CC3DB7819F42F5198AC411E69C4526429D8D2B7E32F6784FB672571F43EB9A152AAF74014B88544980A0A0B9A64FBCBE2CFC6CCD19CCB2793188D0BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../@..........." ..0.................. ...@....... ....................................`.....................................O....@.......................`.......-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H.......P ...................... -......................................BSJB............v4.0.30319......l.......#~..l.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3................................+.....S...........................3.......9...O.............}.........}...........$.....A.....d.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.EventBasedAsync.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.889492942439257
Encrypted:	false
SSDEEP:	384:r3WvPwW4ofWRdWBC2uPFhAGKmY2t2wL9ukF0De5BJXfCvDXxO88+aEZ4jIwVcBvD:r0nWIOG2t2wBADe5C88IVmcnUX7h
MD5:	A3FD8B1DE09DD3170DC901B543BD7A58
SHA1:	0E003FB841636CCC7477AD18FD9DCFDBFD7449DB
SHA-256:	CEE8B106C331FC3B169565301594A0F475CD89B74234F5CD1BF00311F5A64E6F
SHA-512:	88857937CA9B514A5522568E6BC01F42D813339D2176851F6C1B0B24FE2E3C4F56542CE950C15C51E7009A6A0C8B2BB5C18C2ACB2EBB7082D67AABADAC0E1B10
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....C............" .....L...................................................d............`...@......@............... .......................................U...............b..........T...............................................................H............text....K.......L.................. ..`.data........N.......N..............@....reloc.......b.......b..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...d.&...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...E.v.e.n.t.B.a.s.e.d.A.s.y.n.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...t.&...F.i.l.e.D.e.s.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.188651023984389
Encrypted:	false
SSDEEP:	1536:fTvCf+lhNuFkCoGevD2olstiqoUb8tkJgC:fTCf+lkoGKD2omtHDXJgC
MD5:	E1CA8F73C0DC66BE8D0BB2BD4FF2A04F
SHA1:	278F42D06F2990FFA9FC6D1DB33C7B6FBC7B525A
SHA-256:	96F00A3CD0052A8146C92E51A1731980A56FA51CD15B779FD6195A53BA2489DF
SHA-512:	947E0CC13FE8CE0D9FA41748F9C4F28344BAC862CFAD1BA63913DD528E78149898B0004471330DDC01C1BC75713F342D837B4DD0B8806F913FFA6423FA3C59C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....c............" .........0............................................................`...@......@............... ..........................................X.......................T...............................................................H............text............................... ..`.data...$,..........................@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...P.r.i.m.i.t.i.v.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.TypeConverter.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	737280
Entropy (8bit):	6.712404369969049
Encrypted:	false
SSDEEP:	12288:MuPJQL2WxCe7Uc7YWEFBiX5SoWBKlHrzlRGAAMy7S02:ri1D7UMEFBinWBCrzlZMS
MD5:	84E995E2038038F292280932C6DD5F47
SHA1:	4B11EE39E77067B82E7DA0B0FF5A087760BCA3F0
SHA-256:	6F68158F541148F32B92838E2884F277B69B1F239174FA16FB6687E359ADD312
SHA-512:	B88AE569017DDFD62F31CD0837639B78EA28B13059AAFAA55D8526F7E5B57C66D80283795AB8200BCAE8BD950B57926BBCFDC32D126761214D80975978B975C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....W5..........." .........................................................@............`...@......@............... ...........................................X...........0..........T...............................................................H............text.............................. ..`.data....n.......p..................@....reloc.......0.......0..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...`.$...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...T.y.p.e.C.o.n.v.e.r.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...p.$...F.i.l.e.D.e.s.c.r.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.504348417026314
Encrypted:	false
SSDEEP:	96:EyFQIW4I1WlShwWSBOUJwT1PVP1+AnxvVqcDmDsDzrh:TfW4I1WchYBOke+Anx0eh
MD5:	1B66E01FA0840B13A708924523960C2E
SHA1:	A2F7AB412CF192EA8C9FB4034769215DCC861294
SHA-256:	4FC0FDF4BAE6E0299EEA9F92DC9C8C1159EDE276CD2639C9FF0D9831D77086E9
SHA-512:	CE0AC75D3086F4FF3E1F9B755F5DD1A75F5B9DD821507C47AA20BD10E55FDF88852A04273D698E52CC4022A779A35C16775A3F80B23BC22219B2EF5B565C0455
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" ......................................................................`...@......@............... ..........................................0...................x...T...............................................................H............text............................... ..`.data...Y...........................@....reloc..............................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Configuration.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.336317914240981
Encrypted:	false
SSDEEP:	192:IOLYlskf/wMXTSv/fUNBDkCGuxeIgYPAKDik3zyP/weXUxA3ycyWvANW:jMXTSv/fUNRvGZYdf3zyP/weS+ycyWvh
MD5:	AC43D0D0FF66733B7C608BB5AB9A4DC9
SHA1:	BBDFD888D88B2F79C87329CCA4E5C4EBCE2D4686
SHA-256:	B91406F7D95E67690CD3DE15B79B0EC49B48565870D71B8D5D81E85BA081B9B9
SHA-512:	5A0898F65EF4ECCDA6D2AC5C43CD5DB8134BF74B3D31D8574A84C8C44CF657D4134C658A9DF3299554B047D8A42E29F4EDA558179226A67D81F817D8CA6615C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W............." ..0.............r8... ...@....... ....................................`..................................8..O....@.......................`......87..T............................................ ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................Q8......H.......P ..h....................6......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID...........#Blob......................3................................h.................2...%.2.........R.......b.....U.....U.....,.....U.....U.....U.....U...3.U.....U.....U.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Console.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189440
Entropy (8bit):	6.633859856892473
Encrypted:	false
SSDEEP:	3072:04EYm1jX/slFOhbV83fewcqI2yO9qfEukxDvaBACFxOnN3:e1jXgOCfMUIsukJSROn
MD5:	87543A04A2BBCE41608B2561D73E7A41
SHA1:	259E718F8C910A7F97E97D29498921EA33B22D4A
SHA-256:	DBAFE7DE28AFED984A2E2CFCFAEDC4D774DDD05A4954E1FF82C9BC4A48122EE9
SHA-512:	8E3C249FC34F6A021249F9001AD5ED7F08E5B5754D8D72D53955777E580FB0E2A17210FD49CCA9197E6F0F41A3852EFECCB4FFCDB9C154F106ED4D96EE38AB9D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...T.O..........." .....L................................................................`...@......@............... ..................................T....}..................t...@...T...........................................................X...H............text....K.......L.................. ..`.data...N....N.......N..............@....reloc..t...........................@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...6.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.n.s.o.l.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...F.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...C.o.n.s.o.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Core.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.5659766364943355
Encrypted:	false
SSDEEP:	384:pS9H4Ay0l9Jr3OzFPhoact/iKMePLexkrW1rU1ZXtlWTjknWXJ2W:s9H4Ay0l9Jr34FPhoact/iKMePLAxim/
MD5:	29B1C06A62213453C183F0C1DF2E79BE
SHA1:	B83A72F321867331790B56F4B2BE9FA43BA6E28D
SHA-256:	7069AAC23EF6187FBA5ABC600921FA1A5A09A95A495A31C679FD37359ED1886D
SHA-512:	2A9EAA144F1A3546A4005169DE442C71F53D4567ADD4031487A9D57DB4E1E19EFD8E90519FB410AB34504B8129EB57339637A77D54EBB8010F04C22A226B5CA0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k............" ..0.............H... ...`....... ....................................`.................................sH..O....`..8............................G..T............................................ ............... ..H............text....(... ..................... ..`.rsrc...8....`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...&.................. G......................................BSJB............v4.0.30319......l...<...#~..........#Strings.....$......#US..$......#GUID....$......#Blob......................3......................................................i.......G...........................:.n...J.t.....t...P.................C.....`...............................................).....1.....9.....A.....Q... .Y.....a.....i.....q.....y.....................I.....R.....q...#.z...+.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Data.Common.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2888192
Entropy (8bit):	6.830914579418171
Encrypted:	false
SSDEEP:	49152:6qlwbhVw+KH9yu1/8WROdkp40MukREyiNEXQ6ZvIq3V/mW9SuXsk5hBWmXo4x3XN:owhO0TaA6ZvIq3V/mW9SuXsYrXD
MD5:	E5626F090592930CAA68DEE33B4A9465
SHA1:	E183C1BD014B2D9813022B6F1547741D82AA27A3
SHA-256:	1B281F6891DAD1B4A14A120C47AB50472096201626BCB72A9DE7704B5BB81795
SHA-512:	6C0A4A28FA97E87388241D6A8A193A13228FF6DD730D7EAD1177E2345BE4649620E2142D03FCFF22ECD08196F48C43B5F07A75AEDEF01D2B1E13D158455A3325
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....h..........." .....T#...................................................1...........`...@......@............... ..................................t....](...............0.P-..`...T...........................................................x...H............text....S#......T#................. ..`.data.......V&......V#.............@....reloc..P-....0.......+.............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.a.t.a...C.o.m.m.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...D.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Data.DataSetExtensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.635443199113749
Encrypted:	false
SSDEEP:	96:eQClUdyx7KmhlB//UjDmDsDWbUzWaS7W:OmoHF/MwbCWaS7W
MD5:	4B63EDF2F984EE1290618C3AC102114A
SHA1:	66DC8126AD53ED41B2E9340EE705914156E8EEC5
SHA-256:	A3C65D0EC4932A89110BDC9AEC5BAB6B15BEC0F62E37ACB8F71F64392F04C47E
SHA-512:	D6486064EFCB3E7663B9FC5A71CE0035A0DDAFA7BE92A6C2F4BD72E47A1D7A4F9177516E202D6B6C3E795E5AA603FB213DFAF92FC689B7DBCEC81FACA4DE7B63
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../a..........." ..0..............*... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................8(......................................BSJB............v4.0.30319......l...0...#~......@...#Strings............#US.........#GUID...........#Blob......................3................................................E.............\|...............i.)...'.).....".....)...~.).....).....).....)...e.).....).....E...........v.....v.....v...).v...1.v...9.v...A.v...I.v...Q.v...Y.v...a.v...i.v...q.v...y.v.......:.....C.....b...#.k...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Data.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.684638619386625
Encrypted:	false
SSDEEP:	192:rM5ZvWYY6NaFRT4TFEmEI4az2nSMVhvMqiSbgEQJ6UhYEWioFW:rWAAaFiTCmM82SuxDJQMEWioFW
MD5:	06A449C1D8AB9842BD1E606A994C5537
SHA1:	C785BD85C30D4BAACBB985DD3A406B3DC20906BE
SHA-256:	17393CE3A49FA4ADDC3426C8E57620622A16A18549B987C251352E69A320B004
SHA-512:	9F6229804BE6699AA19B050E28699A4DE34643D459EF8EF7EC451D359A0D19EFAEBF74A1736ED3C11CDDB7F6314F33F6B115AEF3A90C7D0C72A40A1A99D4F30E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$............" ..0..0...........O... ...`....... ....................................`..................................O..O....`..8............................N..T............................................ ............... ..H............text..../... ...0.................. ..`.rsrc...8....`.......2..............@..@.reloc...............8..............@..B.................O......H.......P ...-..................LN......................................BSJB............v4.0.30319......l...T...#~...... ...#Strings.....+......#US..+......#GUID....+......#Blob......................3................................<.....H.........~.......................).r.........;.................Y.......................B....._...................#...........................).....1.....9.....A.....Q... .Y.....a.....i.....q.....y.....................R.....[.....z...#.....+.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Contracts.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.9818754785378783
Encrypted:	false
SSDEEP:	96:N1amI4CKZiT/eexvOLDmDsDRTGcWwxr1BwW:LamI4NZ1exaW6Z2W
MD5:	0C2C2F9CF67193F465D7B4341C7A1BCA
SHA1:	0FB7DAD0BA2BAFF9A5A98C4E9A8C6D98A4110DE2
SHA-256:	89B747EDD70CC6384EC7D87FCF99A663C48863B0833B82AE047E91FAE1D8FD99
SHA-512:	87593A16589B609A68D7AB8FF056EAAA5E07875E6C2EC846E28F967EFA089AC50EA71F0C35C982089ABB9BD422157498AC4E61D5994933330856100509891475
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x..........."!..0..............,... ........@.. ....................................`..................................+..V....@.......................`.......*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~......H...#Strings....4.......#GUID...D.......#Blob......................3......................................Z.........9.........................,...5.............{.........F.............................#.....p.........................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Debug.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.969878680619615
Encrypted:	false
SSDEEP:	48:6zk4gojleytwPVWaZF4ZhBG+Iv+KXkVP6zDmDiZDwBYZYKZWHWKpi25WmQK:Sjleytwx4kxvjU8DmDsDSqvW2aimW
MD5:	34E23CF2C57575283D7E680137CA015E
SHA1:	F24D7FD817F95EEE61F145AAD3C6F98EAE637F74
SHA-256:	645A929D44B5BC83019F6228E7D04ED858F5067890646F603FFB4208C647ABAE
SHA-512:	59915ECC8E68946E0DA10EE733C805F7F77C3F54D7D21A02BD9EA9BB3665F1E058E3556E07D1571D466776D8F36CDC0FF5191643220869D698735D7A09265EB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0................. ...@....... ....................................`....................................O....@.......................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ......................$)......................................BSJB............v4.0.30319......l...H...#~..........#Strings....<.......#US.@.......#GUID...P.......#Blob......................3..................................................W...R.W...g.D...w...........0.....w.......................>...........................................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>...y.>.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.DiagnosticSource.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	399872
Entropy (8bit):	6.734877554436723
Encrypted:	false
SSDEEP:	6144:lvh3GPOImJzDjGu/tvjEdBfexGFv9g3ffV:r7jGcjI7veF
MD5:	6C1077E84CB2D63D8796D09B517ADC41
SHA1:	F685A065D7B209EFC88A0914FEB0E5A5E113DDE9
SHA-256:	D8F204E8092CB86122DE315FE9E8101D5AEF7479D9D1B15CCB71BDD7540BD219
SHA-512:	C652C2FF5B7390ACD411C088B2A8660835BB935E91C5100F6205ABD9510C0EA6E62ADFF3A1C86234B0BE11A4F08912EE811E7440A647D3AAB9CA537F5743101B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...5\|............" .........l............................................................`...@......@............... ......................................<....)......................T...............................................................H............text............................... ..`.data....`.......b..................@....reloc..............................@..B............................................0...........................P.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .C.l.a.s.s.e.s. .t.h.a.t. .a.l.l.o.w. .y.o.u. .t.o. .d.e.c.o.u.p.l.e. .c.o.d.e. .l.o.g.g.i.n.g. .r.i.c.h. .(.u.n.s.e.r.i.a.l.i.z.a.b.l.e.). .d.i.a.g.n.o.s.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.FileVersionInfo.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.119026642523614
Encrypted:	false
SSDEEP:	384:oWdwV9WO9kI2u8FMXyGr/9oapxEkkI233yl7oQxPkl3rWP8O1Obk9lwfDpj5pA:8b9KDMXjnxfM3i55klbcjObk9uto
MD5:	372B15296B9F256F30393D37DB8C3B6C
SHA1:	387F3529E6A802762D9B9DEF19235B843DEA27B8
SHA-256:	E38469EEC541208F5D6F4A0A366A033875C27CCB9160ECABB80568E9055B8427
SHA-512:	CF34D10815C8A8897A5CAE28DB6040773D98B8004E4B1F0E8FDCA7E751293F651EE81099B7BEA5ABF47254859F91E7BB280E1172803DFD7D6C942985CCD6F3E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....I..........." .....`...................................................~............`...@......@............... .......................................n..L............\|..........T...............................................................H............text...(_.......`.................. ..`.data...K....b.......b..............@....reloc.......\|.......\|..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...^.#...C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...F.i.l.e.V.e.r.s.i.o.n.I.n.f.o.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...n.#...F.i.l.e.D.e.s.c.r.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Process.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	230912
Entropy (8bit):	6.635549958601621
Encrypted:	false
SSDEEP:	6144:6Q06XR1zrhVq9Q9FxFV9b3q3xKPafd4VbnMCNI4lK:vpXLhQ9Q9FxFQvMnnI+K
MD5:	AAD5D8EF1666ED99AD08FE1748F3A22F
SHA1:	0A0AF6C403578EB8F49780CC010232B168773A22
SHA-256:	F47CF2F00C2A8B09591C0F46A091FD8DA4CEFDBB095F6C6BF366FA9D302C698F
SHA-512:	E82A8B22A94072FF78E690130F7E9680FDDACD2FBAE23E651493C6D8846D34E297869D62F904C7DF42B6D62D102418B388A2DEFAC8EE1817B7E9DE538D776548
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....!..........." ......................................................................`...@......@............... ......................................X...................D.......T...............................................................H............text.............................. ..`.data...............................@....reloc..D...........................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...P.r.o.c.e.s.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.StackTrace.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.608926317135169
Encrypted:	false
SSDEEP:	384:nWnPgWDiJZ+DUnDwmeM8vk6fwC/FmPF/NMDn:cZwZ+DUns/M8vk6Y4mPFiT
MD5:	EDFD80E4260CCDE9DD2D649A6DACD0ED
SHA1:	7FF675FB6775E18A3E9F033281FE850B32BDDC3C
SHA-256:	15B00547F262E1751712E2015DE6232BB376CF6DC90EF5FB1A183C5E0B236272
SHA-512:	1CF4230F38CB6C8040770B394258BDD1D8D4482D9A56CA339047AA2597663DFACA6EB7564DBB625C7390F8DB0965203248DCFD7A52E6EFC4084CEC52DE5A7EE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....kg..........." .....B...................................................N............`...@......@............... .......................................F...............L.. .......T...............................................................H............text....A.......B.................. ..`.data........D.......D..............@....reloc.. ....L.......L..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...S.t.a.c.k.T.r.a.c.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	6.394538143640945
Encrypted:	false
SSDEEP:	768:uPspQcw/YyvLi8bdF31M7Y4NL2OSkkuc6T6EvWq:uPs+cwpvmAt9FK75vWq
MD5:	53262E031E6DDD02A2F58B299C617E77
SHA1:	50A3A27395122047BAA02F2C08751051E3EB6208
SHA-256:	F1D2F84F07F870E91B4C81A08DC8212B9F806A74F543AF6AADD9A2B8295D117D
SHA-512:	71908906B0F51C62E7C5461DA0263030353EF6D60BF9BDD4219E72ABA9190C59CF5F39BF7569A3D224278541DB23C2C2334D67550C241BCE339C414B42BC634F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....J............" .........*............................................................`...@......@............... ..................................4.......................0...P...T...........................................................8...H............text............................... ..`.data...Z'.......(..................@....reloc..0...........................@..B............................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...n.+...C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.e.x.t.W.r.i.t.e.r.T.r.a.c.e.L.i.s.t.e.n.e.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...~.+...F.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Tools.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.986504902614852
Encrypted:	false
SSDEEP:	96:INoRAlvWAytYSxvxvjUkDmDsDandWQaMUWn:JAmvxAvdWQzUW
MD5:	DC65E2D0B9FEB32E51830D9B997CD27B
SHA1:	655D8F89AB97AC8613EB6F4A5F8D4F5C5CA14469
SHA-256:	CD245C7AEDE106A754D6A3A0108DCC5EFB326F7D1DED63E1654E254F0881DDCD
SHA-512:	BF8AB05133D08C83D310967594D142A2FCCAC75AE924FD6D2BEAA8953920A89AEF30A849B3D3C0B0CC1A5A22A0EE9C8DA1014B08DFDDC5CFE3C712753B89D729
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0..............)... ...@....... ....................................`.................................M)..O....@.......................`......`(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..(.......#Strings............#US.........#GUID...........#Blob......................3................................................F.h.....h.....U.................%...(.%...........%.....%.....%.....%.....%...f.%.....%.................O.....O.....O...).O...1.O...9.O...A.O...I.O...Q.O...Y.O...a.O...i.O...q.O...y.O.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.TraceSource.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124416
Entropy (8bit):	6.515835111308888
Encrypted:	false
SSDEEP:	3072:Il0sZcKL72Rh60dpwQn60x7cftbgsjseIVwB0r:+0sZcTQ6aQn60x7cftbggzrB
MD5:	3B83A6BAB8EA9E995FC5618C4D78FFA2
SHA1:	4E789C0758013B735CA16D31F689708CBFC578C2
SHA-256:	1F39C1179187AFE037F687CCDA55D87B2D1EF3AF300934E29EABF056C17411E3
SHA-512:	294B8CFBED7366924272F6864D1CA9F1EBDB051B3D32E1A8AD60F57FE0FD394F635C82E2005E21DC257E4C1F684530CB71BB2A76FC3E1EA52B205B69C3AF9462
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...4.W..........." .....\|...h............................................................`...@......@............... ..................................................................T...............................................................H............text....z.......\|.................. ..`.data...?c...~...d...~..............@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.r.a.c.e.S.o.u.r.c.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Diagnostics.Tracing.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.183092540282057
Encrypted:	false
SSDEEP:	48:6uDQOSANAL8iRnBgocPjtYuqj+M3M+IvOX0gvNPCDmDiZDS/EfIddZAo8ZZWxtKz:0b8itSoI+j+M3MxvO0DmDsDs8WbKDW
MD5:	DB2C6FC287075F1CFCE4AE3C7D7A1005
SHA1:	84D008779B2FD1CC6ADD11711EBD70DE4F33A8D8
SHA-256:	4E70E4CD3A6F38E708D602E16ED2F5076E71367323E6DCB78346DB2F19D87CD8
SHA-512:	7ECA0D72BB91BEE690CD35FB2A1752B341D57604C766C10D34AEBF890C7B63F17197E3CCDC7DDBCC933918F1D8827AE9A92271C269DDB565AF358249E7F96D63
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(i............"!..0.............n-... ........@.. ....................................`..................................-..N....@.......................`.......,..T............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P-......H........ ..L...................P ......................................................................................................................................................................BSJB............v4.0.30319......`...x...#~..........#Strings............#GUID...........#Blob......................3................................ .....................O.......................c....._...........}...........6...........B...........................................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Drawing.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	6.365190723270025
Encrypted:	false
SSDEEP:	3072:xTwpM2ajTP0piuSnfQ/0INSTBXhQvgpIekmaHa:ypUTPUSc8yr
MD5:	ADFB81E3B7D4EB72B9F1B999E614B096
SHA1:	685264EA8885A3B603C9289C942449E58C67C9E6
SHA-256:	3C2E3E115A1A8C6205F700C93559E86AA9D74532DA8D07D1DF8034B87CBFB90F
SHA-512:	E9E2D82A0EEC8BCA7388BBE336422CDDDA152705BAD21F0DA1388AF908F46C158E8D3D8D5102F5A5BDCF87131D156CDD115B4C364AF1FB4EDEB6D0E8E1090140
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...S.'..........." .....b...Z............................................................`...@......@............... .........................................................D.......T...............................................................H............text....a.......b.................. ..`.data...jW...d...X...d..............@....reloc..D...........................@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.r.a.w.i.n.g...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Drawing.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.3925554507914555
Encrypted:	false
SSDEEP:	192:Ng0XI9Kt1QRP7uC8MxaIsCetAxAW9+OWxAtW:K8iP7uC8MYITeteB9+OWxAtW
MD5:	CB32CF3CEDBF9B4CA9A3523EA1BEA304
SHA1:	BAC76F94CC67ADD6CB98211C30EE76DC6731BC12
SHA-256:	75F47927F10F8AE39E3E902D3428CAC0C53F669ACBD98ED50BF98D4546331344
SHA-512:	0F8224F1BFA95256265E3B74950AB402AF2AC49672DAEE4B2DBA6CF3A678C5819013E80412E81D813B750607A5B25E03DC032F97CDA8D7CC92B01952E7663EBC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".c..........." ..0.............^=... ...@....... ....................................`..................................=..O....@..X....................`......0<..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc...X....@....... ..............@..@.reloc.......`.......&..............@..B................==......H.......P ..`....................;......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3................................................s.#...C.#...~.....C...........d.`...U.`.........*.`.....`...!.`.....`.....`.....`.....`.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Dynamic.Runtime.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.993872437781376
Encrypted:	false
SSDEEP:	96:3ejl9uyvJGX0UxvjUd8DmDsDcFGLBwMWs1CW:3A7YX5xAdTFGLSMWs1CW
MD5:	275380B4A1F991A0DF80F1D1E46CF970
SHA1:	5755C188E4B7C6AF42E6D9DB3B6EE8BB28AABCC7
SHA-256:	5A20968677CEE4D2D5831A231102C7BFF1EA8357EC51070508160F36AC533F43
SHA-512:	E0F0A9D62865354141A495CCA4B44D79A2C01F8EA7A04C77BBB18973E889377E1BB10BE760A3D023DF19B9D84873ADA6639161F47938C20D44F0B63F0EAD1EE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#7..........." ..0..............,... ...@....... ....................................`.................................a,..O....@.......................`......x+..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~......h...#Strings............#US.........#GUID...$.......#Blob......................3......................................&.........W.............................j.Z...9.Z.....A.....Z.....Z.....Z.....Z.....Z...w.Z.....Z.....#...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Formats.Asn1.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	219648
Entropy (8bit):	6.652178071284189
Encrypted:	false
SSDEEP:	6144:M48Hzk7z60t6/m18cp+QifTLMvWtz1ZSgSwq:M7H+zDPBwIWhj
MD5:	C1B9F45D9099ABECFCD1B5E21D73DBC1
SHA1:	DD57C5E9138F6888E1E5FB347DBB750C8A66DB34
SHA-256:	B5125809589FF1921774AD1A382C1B1530ED3C46E427289D861F903ACA8DAC7D
SHA-512:	7BB6CA87125A9279025376787FB50FD6C782011B6E805FA90912907DBCAC31C08179E12CC8CEA6BB282177A1C09991B43969310808092B23F12C1364754D91CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...8Vj..........." .........................................................Z............`...@......@............... ......................................d................V..........T...............................................................H............text...d........................... ..`.data...*...........................@....reloc.......V.......V..............@..B............................................0...........................@.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...\|.....0.0.0.0.0.4.b.0...b.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .t.h.a.t. .c.a.n. .r.e.a.d. .a.n.d. .w.r.i.t.e. .t.h.e. .A.S.N...1. .B.E.R.,. .C.E.R.,. .a.n.d. .D.E.R. .d.a.t.a. .f.o.r.m.a.t.s.......C.o.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Formats.Tar.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	266752
Entropy (8bit):	6.670766409249489
Encrypted:	false
SSDEEP:	3072:XhNCH4N0ycdmRMeMiwUcXTiEsJ/3ezh7XLH5qHhYu1RavhbLrh4gAHObB73+llax:xc4CyMeMcqnUHhl1RaHFAHOZuzR
MD5:	0B0BE43C758699440A70037773112523
SHA1:	6EB5DE6571CA0E84150D899890CA6F68B7E27994
SHA-256:	FAD85EF14042E8307072FB26C8D18A2B5B04F2B0F14EE18447276E50F88BCD78
SHA-512:	F3344A175448F3020E694B8AD986A52B6ABB8DD12DB9383F0CBCA176664DF000C500CDE2456C20F2E27C5AF8B4ED54AD31169EAB137DFB0BB508947536DDF651
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....6................................................................`...@......@............... ..................................t...D...................x...h...T...........................................................x...H............text....4.......6.................. ..`.data........8.......8..............@....reloc..x...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...F.o.r.m.a.t.s...T.a.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...F.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.Calendars.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.042163733773019
Encrypted:	false
SSDEEP:	96:KH4lojr3OYyslhKRsdE/xvjUvDmDsDT5RqXWDRq4oRqm0Rq7W:ZtDxAvRqXWDRq4oRqm0Rq7W
MD5:	C1E84128271B48D0E5BCB934B2FDAFD5
SHA1:	C2C481D513B986D592B835DBD5F925195E926A59
SHA-256:	596214E6E84830E612479C417FD20A07A4535BD22E0A6C18873A33C492E45262
SHA-512:	5A1008D934DB7B621F48B4E5E0F14CDDF427E316C22E5C1FF1585DC78590DE1A4C6FD4F7EB7FF428A531E2B7A982B80C6B38CDA5C1A5180E301830A0176E34BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L.~..........." ..0.............:+... ...@....... ....................................`..................................*..O....@.......................`.......)..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ......................l)......................................BSJB............v4.0.30319......l...p...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................;...x.;...3.(...[.....^.................I....._.................w.................G..................."....."....."...)."...1."...9."...A."...I."...Q."...Y."...a."...i."...q."...y.".......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.Extensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.055591437266271
Encrypted:	false
SSDEEP:	96:dJ/QnSl4UIzyVcNxvjUSDmDsDP+RPWYRg7Rp0RjW:7+xA7RPWYRg7Rp0RjW
MD5:	B0FBC2B37AE214A5C3854971B77AABF8
SHA1:	1EA8B70849E9B2A76BAAF145689EBD8BA5D3AC71
SHA-256:	C7CEDCB40EB6D844ECDCF5672D7B38AA51E979B0AECC9A30FB58FDC011BD0D5D
SHA-512:	1AD184F5BC56C606C7393E968DE64955457D81D32B55D593AC37015E11BA574F9FF7AD9D0BA5B8414151756554FDE3135F56AFAD2C0EF2B0B354C93A5F57588A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f!..........." ..0..............)... ...@....... ....................................`.................................k)..O....@.......................`......p(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..4.......#Strings............#US.........#GUID...........#Blob......................3..................................................8...x.8...3.%...X.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Globalization.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.83374697396166
Encrypted:	false
SSDEEP:	96:1sx6l6e7y27lgvfQlxvjUQDmDsDyKQwRLWdRMCRA0RHW:rpR6vfQlxAnSRLWdRMCRA0RHW
MD5:	D198499EE0EBDE0FFFFEE9437E7AD964
SHA1:	8CA8FE7379FF7887D94075EFB15A2DF8806443E1
SHA-256:	F3135041BE8E197D15E2F946CFE898025FADE23FDB44041C4EBE71D2F9061DB6
SHA-512:	946047AC2432C7389E0F146594D345B4411E93218810220729BE10AC1287BAC7FCF1A6FB0DB3B63A20BBCDA1494AF340FFF663D91E904DBE2E6D8A040289C13F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=..........." ..0.............r... ...@....... ....................................`....................................O....@.......................`......8)..T............................................ ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................Q......H.......P ..h....................(......................................BSJB............v4.0.30319......l...T...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................D...........o................Z.....p.....?.......................&.....X...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.Brotli.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.352983311433773
Encrypted:	false
SSDEEP:	1536:dDQvRxjsKHdFHxrma0ACL3j0elrK9wbwqkRpgH:dmp+Ai6ebwLRO
MD5:	18F25340B261803DDCB31EE681F6549C
SHA1:	651BEB21C56AE4380BBCE6927C614782B6457EF4
SHA-256:	4C88B95F85BAF4A4440F84B4F99FB8AC10AC61ED53D86561D956703972F73945
SHA-512:	65095EB63DC6743E593FAF8F921141C097393D1366BD1B02D755E46B818C5993301AFF0CC49F476DB9BDE26117CA46C67631CA4FD0F423BBBD130B0884C01FAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....{..........." .........2............................................................`...@......@............... ......................................\|...L.......................T...............................................................H............text.............................. ..`.data...W/.......0..................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...C.o.m.p.r.e.s.s.i.o.n...B.r.o.t.l.i.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.FileSystem.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.7304308492974076
Encrypted:	false
SSDEEP:	48:6R+lplmwWyljfZmENgadCJyKXkhP6zDmDiZDJGPZw4ObW8EZWf8W8FKmW8FTW8Yp:LewWyljfLqldUQDmDsDgBwaWuJmW
MD5:	09BC5B5671F009676F9AA6843D6FB820
SHA1:	2E76A88616A839E1BAE54A50CD91D4891B188640
SHA-256:	DB2D133135E7C2E634C61E3AF0E694FE4F48FF299E2806B8D8ECFEB794DBEB15
SHA-512:	EEE9389D5F2E873A7C2A5969A927A59482B16A016D78603FC024106CEB3629448AFCDED507411BA61F700374BC8AC2918909AA1E445CC5E7D2D4E8188C33BE24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;f............" ..0..............(... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3..................................................U.....U...Q.B...u.....\|.....7.........g.....}....L...................3....e.*.................<.....<.....<...).<...1.<...9.<...A.<...I.<...Q.<...Y.<...a.<...i.<...q.<...y.<.......C.....L.....k...#.t...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.ZipFile.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	6.163172275996026
Encrypted:	false
SSDEEP:	768:gqTIdfJkx8ICA6UhCk5Xy557m/SW+3JyH:gqTEAf6Uhd5Xy556fkyH
MD5:	547258C6C068A1EE461DC137F1E470FA
SHA1:	117EAA6505341442D215F180B84C3111C29046B2
SHA-256:	E4DC3EA77C46173A03A8A6583E08AF168CAEB24A78761A2F7E561AEBD25D062E
SHA-512:	AD57198A04425B166AB826C44383EDC95E9E1A673C85D12AD882DBC23B3C857E4325F3942525774487072CE046DD537262AC4A0D67B158D877BDEB3EB3EBCFEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....h..........." ........."............................................................`...@......@............... ..........................................0...............8.......T...............................................................H............text............................... ..`.data...c........ ..................@....reloc..8...........................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...C.o.m.p.r.e.s.s.i.o.n...Z.i.p.F.i.l.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.Compression.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	248832
Entropy (8bit):	6.66378504872572
Encrypted:	false
SSDEEP:	6144:67ZYTsBhyEtUEab9CscoWMLh5amOK4oHOxg53+:AZvbZS0oJxuI
MD5:	80E17D8845429FD01DA10E0FB82FC4CA
SHA1:	3B548C752D5A4B9DCCD915AB860ACE259019A669
SHA-256:	CBA3E958809E8DF121D609EDD54DCE9109AAB4DB76635D8E44AD40F451837ED4
SHA-512:	D6448CD5481580E88D5C683EEA93DC82941AFA876734555D44E603FCA39774EB2AB7589252D871FB2C16B04898CF615612C9044B0F4BD711068F675D7F86A561
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...m............." ......................................................................`...@......@............... .......................................4..........................T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...C.o.m.p.r.e.s.s.i.o.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.AccessControl.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.238174732123006
Encrypted:	false
SSDEEP:	384:GW7WVbWAeaul2Yd5zqNfdcdOgpC7bdOBHjM3eeUma/:+cfedcdOKC7bdOhjMueg
MD5:	7F6B5D5ED8E2901960C5FE073EB45910
SHA1:	75EE2022DEDF5A72270E671349B1D8336814D60F
SHA-256:	44F050435173FC777A9FB9BD20E3EF0A2D61732C3C9BC807A0D675A01125AA0A
SHA-512:	78E11B6B195DC13EFD566AEFFF96DCB68A7737514D1CEFBD326C9292859176DFD9814FD0D5B07D395E7530796F83A1D889F9B96FBEBA3226F5D3512D0BCC6B87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....L...................................................T............`...@......@............... .......................................O...............R..........T...............................................................H............text...<J.......L.................. ..`.data...Y....N.......N..............@....reloc.......R.......R..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...^.#...C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...F.i.l.e.S.y.s.t.e.m...A.c.c.e.s.s.C.o.n.t.r.o.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...n.#...F.i.l.e.D.e.s.c.r.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.DriveInfo.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.301666968715502
Encrypted:	false
SSDEEP:	1536:aL7lzTp1MJLNFCoIiBiUXrpSPBtAF8c2B:afxzMLFCoIikQAPbe8c2
MD5:	9BE40EFDCF1DAC47DC26E00955C0B59D
SHA1:	93825440C6387E639F23F6F061DD8038B532F8CE
SHA-256:	4352F5F88CFFC54572FFB7DA6732138D18D52FFCB578437657E271543D037035
SHA-512:	692193585DC3D9DCF18CB61626320F155705B08339B4DCD171B4F9C65B1C87C8A58737C93E8E3DBFC5B147D76582DA7542081C8965499BD17B397AF8D90BAEFC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .........4............................................................`...@......@............... ...................................... ...........................T...............................................................H............text...,........................... ..`.data....1.......2..................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...F.i.l.e.S.y.s.t.e.m...D.r.i.v.e.I.n.f.o.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.029497188617668
Encrypted:	false
SSDEEP:	96:FtIltKAMySlU7YDxvjUqDmDsD+AW/dqW:gz1/YDxAcW/dqW
MD5:	51A573705BF25937E261BACDD735F34D
SHA1:	E5F65B4B4D7D9DE4B926458574B1D188A17CFE9C
SHA-256:	4B8100F5348AACC6672803799C11AFC9231BD3E59729619E4AA9FE287577411A
SHA-512:	CE02F23E981F60E56B83AB6813158A0FB6B0637E20C53E9AE76753351959D6534C8846ADF652B522C1DA8BDFF7951C16997465E2A4C049926B316E783E9E7344
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Aw..........." ..0..............)... ...@....... ....................................`.................................g)..O....@.......................`......l(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID...........#Blob......................3................................................!.2.....2..._.....R...........E...........u...........Z.......................A.....s...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.Watcher.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	6.495998070567815
Encrypted:	false
SSDEEP:	1536:YJRTsxLvYYDLFZONLOvLmPDsWzHNmps5mmfm+t1/+IigGttvYJFRN2VuP:YvoxwrJ4LmPD1p3igGttvYJFn
MD5:	A19F8059FAD3C8E0C7146F44BEFB68EF
SHA1:	E08C93E4E5655BB1C88763485E86069A268AD9D8
SHA-256:	6F7149705AEFAE651CF8DADAFEB28866E282BC1ABDB32750B89B3BB70A8EC58D
SHA-512:	D6C54549F45527AD8000A0C466C610569B206F5BD24BAA5A9D467ED131539576E1915CBE22A04F29E9AC54BE52E2DE63F2BF3111EF97639E60CBA7DF759C3160
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....B............" .....(...L...............................................v............`...@......@............... .......................................E..L............r..d.......T...............................................................H............text...h&.......(.................. ..`.data...MG......H.................@....reloc..d....r.......r..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...F.i.l.e.S.y.s.t.e.m...W.a.t.c.h.e.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.FileSystem.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.925605077896596
Encrypted:	false
SSDEEP:	96:2bl4LypRHujXib+GxvjUUDmDsDUQEKQWWyp2W:QW4RH8cxAb5AWyp2W
MD5:	3E51F5EC1B01467B42A2DB3952317407
SHA1:	CB5D55B03C4C1C4163B7750EF0791D73606E21FB
SHA-256:	524901CDB2CE334B32521F9020CBAFB279843E2F3D19677591E600A43A18AA6B
SHA-512:	5A13DC1D5C737A182D6530633E20120D55DC20CD6B0372B2AFB46CB84A88505194D8DC59F4CDEB4A2723D65B3F5D3D3BDFA6777E5C3418A2F1243DFA958C9C42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............+... ...@....... ....................................`....................................O....@.......................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................L)......................................BSJB............v4.0.30319......l.......#~......p...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3....................................../.........h...................................J.......a...............-.............................../...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.IsolatedStorage.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	6.337399571381829
Encrypted:	false
SSDEEP:	1536:qCHObnhHl6o55i3SjZwRdAdKTC+htx63fH/f:q02nhHwo55i3SjZwS+htxAf/
MD5:	A382C72012E61167FF66A0085A593DD0
SHA1:	017990C72DD44C8E46D27B2869DC65215A9D6F23
SHA-256:	1C6DE85FCB77EB8F0B8BED7B338CD55CC6861741140511F3F9F9621A22D8D341
SHA-512:	E9B230C18F5402883A4C1ADB90CF74B385DBA86E1BB939C5CB7A632C1E7ABF3BBC6882870EB5F225347A5083E23C0AA9625C1F4DE5CB55C30633FB5842DC2B7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...K............." .........6............................................................`...@......@............... ..................................................................T...............................................................H............text............................... ..`.data....3.......4..................@....reloc..............................@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...I.s.o.l.a.t.e.d.S.t.o.r.a.g.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.MemoryMappedFiles.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.354606236684571
Encrypted:	false
SSDEEP:	1536:lF8zNSyz+yPxGP650+R1i9Ef9bj13jfIWeX9RH:lmZP4Wxf9FjAJX9R
MD5:	5C2D20BEF62F735A06471189A2A89300
SHA1:	1E1F2A5FB0BFFAEF8AE3649DB194F0452A689F37
SHA-256:	8042D8407B9049D6690A8975B69BE78DEBA6EBE7D92D933B84D31CDCD7C7D1C5
SHA-512:	1D669EB25E8F20E285CA5FF2756B2D9825946B72E1DE0E2CAACE7D483200B5FE31E11A597E4702523B5A47C452AE8179D7E4E46B53CAC7A83C8F867371684E37
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .........6............................................................`...@......@............... ..................................................................T...............................................................H............text............................... ..`.data....3.......4..................@....reloc..............................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...M.e.m.o.r.y.M.a.p.p.e.d.F.i.l.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.Pipes.AccessControl.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.109400928563531
Encrypted:	false
SSDEEP:	192:yW+WPWUdtJvNhHTiQpDLXnnjAP9eTiSPzhDJgb0WxZf9ppR:yW+WPWUdjviQFnnjAFeTiW5Zc/R
MD5:	2C1FA28993208788E8AB2D167CE59B3D
SHA1:	320C011FD4A4590FD08B9A09860C6820274C4826
SHA-256:	17E1AB5E0B7C0E9415C402336FBAB39C7DA96F7FD0A3BF2BD7266841DE3FFB28
SHA-512:	0FC57D40A46C4D995049A24568ABBF865B3C3230E650B42701A34E95D577855C21874FD5646C2A28F76733E650D1D89D8492C2F2744D38A23BC4DB157CD8E263
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....,...................................................4............`...@......@............... ......................................./...............2..........T...............................................................H............text...`*.......,.................. ..`.data...!...........................@....reloc.......2.......2..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...P.i.p.e.s...A.c.c.e.s.s.C.o.n.t.r.o.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.Pipes.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	116224
Entropy (8bit):	6.462170106534152
Encrypted:	false
SSDEEP:	1536:9FCQZqOc3R7JqnS4fyov+1tktorWJbID+W75S7F7WpYdi7fjidEI3qx6zsv:9kQ/cdJqnZDrVJbID187WPfjiPo
MD5:	4CDA3CE70F0EE3D9FC78FEA3E63B9B4A
SHA1:	351C75FEDE4DE1BE66E193AD4FFB1B5565B3EA31
SHA-256:	ECDFCAF2D05D3D2765C02E95E7E12CC5274C6EB0302B8619B90B9FEFC52F973D
SHA-512:	94208801B3CB490A91ABE1FBFE10AC10A80C8864FA4A4486946D3187946DA4B8E3A677B3DA1472264E72F280EF2351AE127DC59AC53CD6E5FCCBA9B7C2866033
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....Cg..........." .....b...b............................................................`...@......@............... ..................................T...........................@...T...........................................................X...H............text... a.......b.................. ..`.data....]...d...^...d..............@....reloc..............................@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...I.O...P.i.p.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...I.O...P.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.UnmanagedMemoryStream.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.078778583968658
Encrypted:	false
SSDEEP:	96:oiS1xelYoQdi9w4xvjUpDmDsDkpmlWke17wJW:3Wvew4xAQKWjB+W
MD5:	C0C89BF1138D93505EF063CBB2416A24
SHA1:	1A554B6BF477591BDA7A2D5F7CCF9E4D8D10E343
SHA-256:	AF4BE78C35EFC667127694950F84D71E6685645720DEAE1CE904CB415D46FA9F
SHA-512:	BCA16A5D0B6E7836FBE42E66A9B9568787B492D02778CA8633194B070DD30A17B33F24417A055B7AE4C3F9BB90BC9C5644A4CDD0AD00839A0C2A65CB2A77E703
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I(;..........." ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID...(.......#Blob......................3................................................$...........=.n.........h.....#.>.....>...x.7.................>...].>.....>.....>.....>...D.>...Q.>.................h.....h.....h...).h...1.h...9.h...A.h...Q.h. .Y.h...a.h...i.h...q.h...y.h.....h.....h.......................#.....+.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.IO.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.778892854167228
Encrypted:	false
SSDEEP:	96:MfclFmLyj2Qlw83ixvjU3DmDsDtfWveybW:MUz283ixALW2ybW
MD5:	36C92E1D92DC8A048378D56FAA0B03AA
SHA1:	06FAF701AAB76223A10A4477BBC16843F7B02263
SHA-256:	49D604665B026696469C846FD25177AC1C9240A514488C40DA6508A52513592B
SHA-512:	028BE11EF87B944AF3A492F7D5CCABB4FE552E418507D6786BEFA0FE9BCB11CFD2CF2AD8F748C50C0134DE1481FEEDE0D6F4BC5BDBB759A33C66A12C9D7302AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0................. ...@....... ....................................`.................................3..O....@..(....................`......d)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B................g*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~...... ...#Strings............#US.........#GUID... ...t...#Blob......................3............................................................=...........h.....#...........S.....i.....8.............................Q...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Expressions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3756032
Entropy (8bit):	6.7122233898641674
Encrypted:	false
SSDEEP:	49152:H1uax3JKqd27zmqU38Bn11Z39S95RsOB4L3E:Ozjnx8viOB4L0
MD5:	82F8A7A5601867BDCE5964D53F263B4F
SHA1:	49A31CE73CDFD23D33D44141B3454E21677B920D
SHA-256:	BECABE077C14ADF39DCF4AB5393FB56F4211038A6D6C17D2A9A4D262DDB0726E
SHA-512:	D4CCAFB57ED29672DF52D893E319D687C0D89AA73B17F1C29FBA53E2348D41F6F5C8F174453316EE280165AF892B1C257DD9D98737B322437A5977A01250F50D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....T..........." ......(..................................................P>...........`...@......@............... ......................................l./.`.............=.Xf......T...............................................................H............text.....(.......(................. ..`.data....5....+..6....(.............@....reloc..Xf....=..h....8.............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...E.x.p.r.e.s.s.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Parallel.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	787456
Entropy (8bit):	6.825896543349318
Encrypted:	false
SSDEEP:	24576:8uMorFecA474YDlVUlpdT079+Q/J9ps1wG2:8uMorFet474YDlVQz4syb
MD5:	9C7E101FE0BBC42CAC52B140F5F25859
SHA1:	83C53589F93FC623B094B8CC991E866A6019FF70
SHA-256:	11B921B161FE58C2557A359CFCCB0CD4D45DA865F0EE3A3A37B737D8F849F7F7
SHA-512:	5AF8D050C060B23700E6885DD451FF9E5E09E2CAC0526C043C36DF177B889D5150949E390C5BBD1B65F4D43BAA1F6E28C5FD9627B283C22F86567F2CAFF84544
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...f.n..........." .........b............................................................`...@......@............... ......................................X[..db..............4...x...T...............................................................H............text............................... ..`.data....H.......J..................@....reloc..4...........................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...P.a.r.a.l.l.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Linq.Queryable.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	6.462883654591577
Encrypted:	false
SSDEEP:	3072:LHmMA/OjafRHgAuWZmIiq1WCidNh7M2ljO/ww59JKetLUoAez:rmMG1Hbi9Dq/ww59rA
MD5:	27030F72081873D128FD464F3336589D
SHA1:	9CCBB2E9291DD2B86C583372CE75F0F64AEACD12
SHA-256:	5E66DAE99C63C6CA38DD7D924A64A584F4157EF6B952A6B4215FB03FE7FFA5D7
SHA-512:	79E4DE215EF8D9DC03EB1C1813B7E4C774857D8ECEF5EF530ACA7E9E6BC37C83537BCCD865CA12ED4E66FC6BCD5C889DE4C05A807732C7465B155C7B287FF578
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........................................................f............`...@......@............... ......................................\................^......x...T...............................................................H............text............................... ..`.data...L...........................@....reloc.......^.......^..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...Q.u.e.r.y.a.b.l.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Linq.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	519168
Entropy (8bit):	6.808950205715354
Encrypted:	false
SSDEEP:	6144:Obt46R7E2bufbFHJMo8QWH/Yz7Naze+kudjobMELq5F:Qm6R42bEv7oEN+qugI
MD5:	AD12C2655027237B6FCF87E6381CEA35
SHA1:	9AFD2025A0C38499C1238D870375C205D8F8F59A
SHA-256:	AA61DBF88E8984401E68E3ABB5CA2DA9D4D0ECD8FD5120FE00C1A3A7C2E9D1D7
SHA-512:	84F9BBCEB2011CFA7E0C0BA66021C6A588B2A0658CFFF30D510323B2842F63933C06D8C8CC96E287F318E10D8D77B87896E89FA505832AAA7691AE8E6972B638
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........d............................................................`...@......@............... ..................................4........H......................T...........................................................8...H............text...<........................... ..`.data....R.......T..................@....reloc..............................@..B............................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...0.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...@.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...L.i.n.q...>.....F.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Memory.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	136704
Entropy (8bit):	6.72496992016467
Encrypted:	false
SSDEEP:	3072:V0XfKRabktMjDkmzpZUdLdj5vwZuIBo7MWU66oYdsCBuqmw6bq0o7/m:6X2Yky0LVIBo7HrGsCBufbVoT
MD5:	B583CCD58819ED4B81805E408AAB1CEF
SHA1:	BCDF0FD20BA619640646CEA9AD877B90570DC3F1
SHA-256:	0B9858DB34990698A1BCAA800EC02F882D3B684C6063511687DD53FC3D72368C
SHA-512:	4DFFEBD48E41D8EC0D569503056F6B2F29F190F5C48B6FB333B7D528F83E100FBC15C267E741CE655A8107D03BC9D9CE206B7B3A2108068C50A24AF8D1D8A219
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....pu..........." ......................................................................`...@......@............... ..................................D...l.......................(...T...........................................................H...H............text...L........................... ..`.data...Q\|.......~..................@....reloc..............................@..B............................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0...4.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...M.e.m.o.r.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...D.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...M.e.m.o.r.y...

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Http.Json.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	6.5087516155737495
Encrypted:	false
SSDEEP:	3072:luOb5d4gWmeOcbTRRY4bety7/VhpMkMA:wOVdpWnOcbN3/VYdA
MD5:	C7CC2392DB6B99BC3B6A1341572F1A85
SHA1:	66A9271367EC21CEF366C9526106826790E20976
SHA-256:	7341DF48ABFBD5F294F1BACAE369BFC0872E40FE6FC1703FC25CEA4AA787F547
SHA-512:	8AF9D756A6E1C4B3B30A257FC040CB8B866BA1BC9B9BE0CF48F6A418AA356246FB762146333F30A5F0164A69F73E1AD3A89891B71D5DF6F1620BC5729EBBED81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....e..........." .....<...l............................................................`...@......@............... .......................................e..<...............p.......T...............................................................H............text....;.......<.................. ..`.data....f...>...h...>..............@....reloc..p...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....?...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .e.x.t.e.n.s.i.o.n. .m.e.t.h.o.d.s. .f.o.r. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.l.i.e.n.t. .a.n.d. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.o.n.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Http.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1731072
Entropy (8bit):	6.738860186622108
Encrypted:	false
SSDEEP:	12288:c+aZI8XsooaqbrQ37gBYdDqxKv4cBAV5n9v6m8yleb6BmEzvR1deL3y460/Fnhzv:c2AOapcBYdDq59gbuJ1bm6dAZ
MD5:	7FEE3FB9BFDEDB206FC89046E19AD114
SHA1:	ADD7E7AB17196826441882613F0CA8E735F4BF10
SHA-256:	B90D7B69010A834986B9D13A25FEF9E5C3AAD0845C8C1DE077BC6065AE445AB8
SHA-512:	5A81D21912963EFAF366AC6E4360D8E879A31CB718E4F9652753CD3FF156A7775623BC7BDBCC89E98E73683AB932F074553803F1D071F6402688FC6978D911FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...f5............" .........................................................j............`...@......@............... ..................................T....f..x............J.. ...@...T...........................................................X...H............text...l........................... ..`.data..............................@....reloc.. ....J... ...J..............@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...H.t.t.p...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...H.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.HttpListener.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	285696
Entropy (8bit):	6.58944813686511
Encrypted:	false
SSDEEP:	3072:3BBPeC7rtVrVNd8wUVP51gTuB58NyHJuvd0Ge+K6+uZ1eV+e6nRuCD9wElCb4Frf:bWODifVJul1Zu+e6nRuCDe+xK5Zk6
MD5:	57BF9720405C08E59CF908624725172E
SHA1:	2B135C8F1150700EF03D3D7DDB38447321A9671A
SHA-256:	78BC9D4229A1C1467D08E40649A1A4B48A9B8C2158FF925F263D817BF3C55CE9
SHA-512:	F5721D506AF5997DD1695F083225B635FCACADCEC9889B7D38E26C2441087726FF72878A4AF3825B9738B0D8A77026C980251C8D046559CFC5DE7BBCFF4576B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....V[..........." .....h...................................................\............`...@......@............... .......................................................T..........T...............................................................H............text... g.......h.................. ..`.data........j.......j..............@....reloc.......T.......T..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...H.t.t.p.L.i.s.t.e.n.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Mail.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	413184
Entropy (8bit):	6.67778940792755
Encrypted:	false
SSDEEP:	6144:N3AGnQkwXRQEh9M2J7ESRL9BFM/+MZvD8AK3XyZLmqXS9EJ8kk2eFqrCRtFFwpaF:NkXOEQ2J7je+M1A3aS9h3Fy3
MD5:	7562AA41769F68332100FA66CE908451
SHA1:	21612F7CD2D28908B591B09BC9C77FC7F5CF86A9
SHA-256:	62D2652708B313FB6B9FFA648F9B3DE6356E373BF65E8F9731382AC615A17B23
SHA-512:	77F3457655CAD57CA11000D40DD544D8AE9E1E025C4CC3D62CA95C6D1F3C439B785B161765627A1509636BBCA1AF1408E68A66463894E89B3BF94875AF95B38C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....&............" .........Z...............................................N............`...@......@............... ..................................T....b...)...........D......@...T...........................................................X...H............text............................... ..`.data...mO.......P..................@....reloc.......D.......D..............@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...M.a.i.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...M.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.NameResolution.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.447404887210108
Encrypted:	false
SSDEEP:	1536:h5sRcDC+NELuF+bObC4D3LAf74i3yLrnJgeDz:h+9+OaF+bObC4nAjh3yrnJz
MD5:	7B30617FC3575568A89B6064C57AC15B
SHA1:	15E67607486D91DEB8F067857DC163A3EB8D078E
SHA-256:	DE58689B2B2CB62EA2D5423FE6EF73E24EF8797C99490CC6349F858230DE261B
SHA-512:	6C156600201FCB0F4A74A0C2A8D57C03BD2B247394EA3C4CBA01E779651BFB590711C4BB514386764907EAB9B71C3FE3464388679AEDC87AC9FF63FA65FDAFAB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...>............." .........@............................................... ............`...@......@............... ..........................................\|.......................T...............................................................H............text............................... ..`.data....;.......<..................@....reloc..............................@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...N.a.m.e.R.e.s.o.l.u.t.i.o.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.NetworkInformation.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.5031321359606125
Encrypted:	false
SSDEEP:	3072:0xf/6FYw8QvvhZsO4camxvUtl0/e/pdEwwm13G1QD5gEF:IfE10m/gEBkG1QtgE
MD5:	67C65D1EE1B00ED51A9AF548BD850F04
SHA1:	DE03EE26D6FA98718D4ACE8ACBF8F0DD5022570D
SHA-256:	3EB4389CF19B4C871FF7524D604CAF94408A875B35E74CB7A105D9B54FC65597
SHA-512:	AD1E411C9053E663669CADFD01770D6295DFEB701EE2546CC2F4995815ED50A34C8FE7909299A1CCCF1313A8941BF629E313914B6A7889B86429D464A93DE476
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....nd..........." .........`............................................................`...@......@............... ......................................H...P.......................T...............................................................H............text.............................. ..`.data...c[.......\..................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...N.e.t.w.o.r.k.I.n.f.o.r.m.a.t.i.o.n...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Ping.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	6.477366379379019
Encrypted:	false
SSDEEP:	1536:kMo69SAzJbsJRttKVsRQYERW0rtC3XO9OWM2KaB:kA9ZhgTOYEM0hKXO9OWM2KU
MD5:	6D8465EE5E39926BE7539C0824E6BAFC
SHA1:	D8CE1D6B2FE38A44EF546D914BD17F5AD304ACB0
SHA-256:	E461896412ECDD8751A73F4F785916FCC4BC74AE36C852093E592FDE4046E14C
SHA-512:	B50FAF48791BE0DBDCBDD9CDDC55CC6EE4B487517292E1BE67084B2CF82070F4897B5A4D022C99A90608AF3B18798591E40C075F0F7D709F200AA790728D38FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....Q8..........." .........B...............................................$............`...@......@............... ..................................T.......x............"......@...T...........................................................X...H............text............................... ..`.data....>.......@..................@....reloc......."......."..............@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...P.i.n.g...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...P.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	218624
Entropy (8bit):	6.681953117634609
Encrypted:	false
SSDEEP:	3072:CJYwvrbBpyEHU4LPGsoIHzUu5OuVtTspo4X1i97uZHoHfGt1uvDFXCTetdE9R9zU:kBsEN+G7TspZX1iA5SZlt29R9Q
MD5:	D41FE29408DA171D54510321FADF3BD6
SHA1:	C8A3773FA7B8BEB17A8B0825665709BA2E5F3713
SHA-256:	E077D50205635FF243C8446610BBD8752A1A58FC91546DFA969C9E05C45E269D
SHA-512:	8EE4DDAF68D89DFC95E3F9F2BFF8BEB2785C5E82ACA8012E42804C754F9BAF07C59966FF5651EE4424DD76D856026AFE427C04A0A568D1864A3CA9625E2CE67E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...&.p..........." .........................................................V............`...@......@............... ..........................................(............P..........T...............................................................H............text...p........................... ..`.data...n...........................@....reloc.......P.......P..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Quic.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	270848
Entropy (8bit):	6.634439248669945
Encrypted:	false
SSDEEP:	6144:kSvcMvPRRJAIc2KIox5XzixMlPMXVo978yi:tvcyFKIHMaod8d
MD5:	839194D5A1AECF934C3AB376BB057E81
SHA1:	E7CF945A4F461819CE1D337884BEBA71024E8CE8
SHA-256:	BF92C70FC9B7D4F48376C2AF27701ADF6A5AA353845569C50656D9F45CAA3FCD
SHA-512:	4E5682A22CA12DF86B0AB7CEF4B360D8200112A7303A5A8ED4C982DD7BA37FCB3FA30FC0FE3F6B2CCED6AA0090FC379EF7632B469A76575ED48E19B45A82A675
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .....J..................................................."............`...@......@............... ..................................T...8................... ...@...T...........................................................X...H............text... I.......J.................. ..`.data..._....L.......L..............@....reloc.. ...........................@..B............................................0.......................D.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...8.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...Q.u.i.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...H.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.e.t...Q.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Requests.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	330240
Entropy (8bit):	6.595588049905341
Encrypted:	false
SSDEEP:	6144:1FVetdUAYWCztve78jDYWXpAB5h1/H2CrS:1mtdUAYWCteUsn/H+
MD5:	88CC6BBFB105ACDF283516F19D39FC95
SHA1:	EE772BABDBB808C6624E5C809001161E07938CD9
SHA-256:	2695D2CC506957970B0EEFCE7713CA2212D2F8BE8412EE1DFDBE35317C698F0C
SHA-512:	3B3C7AEE79D696F9ACC27E963C3EB9ED102B22EE4D2AA83AE0BA65BE5921EDF068D76F07FB0AE335FD6029F3D2A6CF57537BC5A34D849C8B66A7E95956BF0E2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...@............." ......................................................................`...@......@............... ..................................t....T...#..............P...h...T...........................................................x...H............text...@........................... ..`.data...............................@....reloc..P...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...R.e.q.u.e.s.t.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Security.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	700416
Entropy (8bit):	6.807624791653739
Encrypted:	false
SSDEEP:	12288:I/lkTLxk5ROlI0UWcFOTy7Z0goBmAq+cjtMIyhClzINsnd9P0+K:EYK5QlI0UWcwW0goBmAq+u4IINsnd9
MD5:	66B877D792AAB5C0580D45390117CDA4
SHA1:	E83ADC597B056C51073272DF1F069EF21431A759
SHA-256:	CB0F6708BF9884BBC98CFCA4841F9FC30FF6DBED2D7C175D445B64D66DE60D19
SHA-512:	0C2A0D477626A294CB8182FD941C5EF2450FFDFA860CF659DEF176024AEB6E93F8FE76FBA50632701CF41785A88D9571919DC4EE30C21EE1DE818142191E60A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....EP..........." .....p...>............................................................`...@......@............... ..................................t...h....<..............t...h...T...........................................................x...H............text...tn.......p.................. ..`.data....1...r...2...r..............@....reloc..t...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.e.c.u.r.i.t.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.ServicePoint.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.955142049619675
Encrypted:	false
SSDEEP:	384:CW+4FW/euufjXrLWa7hfKzpzY7y/enGRqCo9dbe3a23wLdRWwaJwQ/WMv:Z+eucTWoKzpzY7y/CkroiIon/WM
MD5:	8E1145CA6EE8FD4303FCDDBEC1E01DBD
SHA1:	B8C957BCF2A3421739EF3A8E1C40830EC33F9771
SHA-256:	321F28751E273612B781B7ABAD4D00FA83E455DA3E12E20498AF608CEAEA3495
SHA-512:	8D0A4E7198EBB9DFBD1A907AE1016748A922FFD1A24F1C055F93C57656F6689B2FCA4F15DEA341AA67D8EF86EB04D4DA78500B991AF99FB8F28ED34D92C264FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...v............." .....J...................................................`............`...@......@............... .......................................S...............^..........T...............................................................H............text...,I.......J.................. ..`.data...y....L.......L..............@....reloc.......^.......^..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.e.r.v.i.c.e.P.o.i.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.Sockets.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	583168
Entropy (8bit):	6.753702657095805
Encrypted:	false
SSDEEP:	12288:LI9J9FcfCIewyCuDxe8ez/rJn/Im1BHXS:k9JQNyY/Im1
MD5:	9E16A6517C5E37F8BA13E456BBB3D4C2
SHA1:	7DD1A0ADD4C0CE578360F1F12603C3CD3567FFDF
SHA-256:	7E124B4787435B3F67DA85EC746CCBC10F9B116D93E44595CC37ED673092A54D
SHA-512:	A3CCC44B361A14E44F6667E817285D0C8F4093F1F67DCB8B81DFD4208E13540151EA81EA40E35694175CBFCA9AC677E417A8655FE0FA8C9FBF2F7214313222A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" ......................................................................`...@......@............... ..................................t...tv..x<..................h...T...........................................................x...H............text............................... ..`.data...............................@....reloc..............................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.o.c.k.e.t.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebClient.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	152576
Entropy (8bit):	6.60158641558836
Encrypted:	false
SSDEEP:	3072:+IBDOnYBHMp1Bnn+PIJ55jk5q2pJY3ykJ9riDO0/l5RZ:+aOnesp1UIJkXpzNZ
MD5:	CB116CDB128636FBA0851446BC67D86E
SHA1:	94B7F16A87FDF0BDEDFB4F96B696BC6DA0670E7F
SHA-256:	EA06CA15628B49E4E52D4F6C289FF752374BFC1EA4D0F6D8B57B8AA77616D5FF
SHA-512:	2DA5FEDEE46EA04BFC0E18F38D03A6EDD5382194201868BB95BDBAAC06ACC9B0AE6B43E0C94ADD641E08A3419207C69DBF43B4691571C0AB7E355F725A2A3448
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....-............" .........................................................T............`...@......@............... .......................................................N......x...T...............................................................H............text...t........................... ..`.data...............................@....reloc.......N.......N..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebHeaderCollection.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.268264929396533
Encrypted:	false
SSDEEP:	768:m71xWYfg4YhiiodSy0Yx82s88krahmqOwA83qJKAFE6WHKV6q6G22N74GK6RH4w3:m71xi4YhiiI0Yx82s88krahmqOwA83qA
MD5:	06D2D3661EE4170E846469102C3D1A41
SHA1:	2ED6F98F4F87275BCA0A93C4B8A99575EE2B7ECC
SHA-256:	B22FC648E777E6F5A0D45F0D4615F0499A96089DBBB7D79B9E1C685800CD236D
SHA-512:	8E651E4F953485B74188972FCE8482102EFD7EC6C5ED0DAF756063452CEF7BDE34689F556BDBD26F55CE33D2158D6C78C7BEBACF78554BDEC5CDCB54F510B68C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...y............" ........."............................................................`...@......@............... ......................................x...........................T...............................................................H............text...H........................... ..`.data............ ..................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.H.e.a.d.e.r.C.o.l.l.e.c.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebProxy.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.028768141793083
Encrypted:	false
SSDEEP:	384:6w3WpvwWUWKmBOdzbOGKBEbCLv+CT1LfyORE/MRASYEpN:6weallKBEtO8Sr
MD5:	C95740CE54C465189B5FCED0D469F515
SHA1:	7E2E27910E477ED5079B8A1E43A8E54D9BAFA79A
SHA-256:	DC8DCE4766AE7D744D012DBCB73682727A8062B1A674A7DA73DF53690597F1F1
SHA-512:	A4498202D486B4DD83C1C22F01CD74608456DD5A42403B6671E7F8D6256C6980FAF140C857C6E86EE05E4917D66E0D81F6E6555FEF29E1127F85ED47BD8D5255
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...R............." .....B...................................................X............`...@......@............... ..................................t...dK...............V......`...T...........................................................x...H............text....A.......B.................. ..`.data........D.......D..............@....reloc.......V.......V..............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebSockets.Client.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79360
Entropy (8bit):	6.358159728836867
Encrypted:	false
SSDEEP:	1536:X4Wh9IUej4NrcM+vfH+Eu7U7b3aZVO4arC:XhcdpM+vv+Pw7b3aZVO4+C
MD5:	F9A1ABFAF030006B1C3F1AD7C1A49ECB
SHA1:	1AE4CD43AD74513DD9DB528795241F8997A10546
SHA-256:	42D9167874898B74B97D43517F216FD621813D8CDC1E5E0B0A7F2660A5171B33
SHA-512:	B5EC032E6794A9B93B2AC958C02EB0BDD48350C1E6E0EDED67EFD27CA191264D51E014E4766ECD8B1C5FE2A82063701A8D11B6ED5E46FD61ECFAE02C99B3BFD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...h.Y..........." .........D...............................................6............`...@......@............... ..........................................<............2..x.......T...............................................................H............text...\........................... ..`.data....>.......@..................@....reloc..x....2.......2..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.S.o.c.k.e.t.s...C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.WebSockets.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	169984
Entropy (8bit):	6.603390109773082
Encrypted:	false
SSDEEP:	3072:gG5tl652ar4DfgIUQeu0IeW+5YLbRbmvhIhkH9mUQ/JYf2:z5t85yDNQzIeW+ymvhKRUQxZ
MD5:	1A451267834F26ABF719D432DF3C27D9
SHA1:	40EF040D9B296F5A02A0AEC1864DC90E89D3F12C
SHA-256:	CEC8C973C26921E6B4E3E88697104DC8B2D163608E050A04516EDC26C1A75253
SHA-512:	C5DE8F1174FB1225E49090FB8C284CCA93E8851712C55F576C14C71835261C451D0CF998B58A946AC853BDE5EB5F1A3AB0B430E21BFD9A5D1A3E9F93463E889A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....#..........." ......................................................................`...@......@............... .......................................;..................p.......T...............................................................H............text............................... ..`.data...............................@....reloc..p...........................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.S.o.c.k.e.t.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Net.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.185627921923958
Encrypted:	false
SSDEEP:	96:Ne+lzHfhBterf8pKZyS3MgxvjUsTDmDsDKydwW+lWovVaW:DhHbcrkpKZyS3MgxAsMQZ6WovVaW
MD5:	48401E6ABAD9E7DBBDE3EAB46AB0ADFC
SHA1:	BB4BE6C45E17878F37E66337275381E63CEB7673
SHA-256:	A97AFC19B07CDD7A519359AA9D4E28E38A5A13DC86A148D1196BC3A779B8B534
SHA-512:	6113F1CE28C922751E69C02B77C7E26F83D22CE0DCDE6C081C820C32491A083A86D48BE84F77E5F277FECCCC6CA10BEAB41DCD71C357784A64D26203E1E797DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$............." ..0..............1... ...@....... ....................................`..................................0..O....@..8....................`......./..T............................................ ............... ..H............text... .... ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B.................0......H.......P ..$...................t/......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings............#US.........#GUID...........#Blob......................3................................6.....x.........................../.......L.................................p...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Numerics.Vectors.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.885246657974751
Encrypted:	false
SSDEEP:	48:6eqigv7dfJnMn4zdiRkrYme+IvOX0uNPCDmDiZDF0bdZxjZWsXK1f5WmQK:UiAhPdi9XxvO0DmDsDgDWa0BW
MD5:	2D3729FB75CDC5FE81C7B6EDB7561FC4
SHA1:	8623F2D9F247645EC844658936CE747369F33A41
SHA-256:	3E374A3D49607095CE7FBFEA1C0AD37C1861C2E07A9EC5C4E5AFC26473C4DFF5
SHA-512:	74A475F3F7CA48E5BD2567B39F106578CD78EE594FB56D09543BDD726FED1A53B83CA7E6C170FE7E23CAD500FC07020BB80942D24017B067EEC9A897CCE57319
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PN............"!..0.............~... ........@.. ....................................`.................................'..T....@.......................`......,)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H........ ..\...................P ......................................................................................................................................................................BSJB............v4.0.30319......`...8...#~..........#Strings............#GUID...........#Blob......................3......................................D.........]...........v.................\.r.....r.....`...8.....0.......r.....r.....r.....r.....r...}.r.....r...........6.....

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Numerics.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.6582940221857405
Encrypted:	false
SSDEEP:	48:6p+lClUrDluSTfxWVBAZadCcCEmKXkQP6zDmDiZDaOqsjZ9wknZWUzKRL5WmQKu:/tPluS7xWVclsUvDmDsDdtegWeQNW
MD5:	F9104B5AA0D19B51972DECE833FF2ACD
SHA1:	182189AE955469297908008517F3DEA915D37452
SHA-256:	3E6047EF208F2070ECE524D4F0B0E97C29D4D035F6ED8CB9DB5A48DDD25663E6
SHA-512:	093D7F83028F2843260BB664A608E9CB99966FCA809BB45E32300A41C948211CC1BFA2B501CAC98AA4C6574E3199C5F79FAD53B2EE1BEF9A0762B71A1AD41E7C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^............." ..0.............Z)... ...@....... ....................................`..................................)..O....@..X....................`......,(..T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B................;)......H.......P ..\....................'......................................BSJB............v4.0.30319......l...8...#~..........#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................'.f.....f...e.S...............K...........{...........`.......................G.....y.......-...........%.....%.....%...).%...1.%...9.%...A.%...I.%...Q.%...Y.%...a.%...i.%...q.%...y.%.......:.....C.....b...#.k...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ObjectModel.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.310650250920982
Encrypted:	false
SSDEEP:	1536:80QqYyjTukJbxyfN3QSsMWrHG43RNGQa:80YyjTxMN3yHG4
MD5:	E7940924FA3CA0A19527F29417F85545
SHA1:	11FF10C9A0D1C1354E1A0CCE36525CA3040305A3
SHA-256:	427E9424B2E1988D02F03BF84094A90A29E258A2E6E99E42DA5086F68D530FF4
SHA-512:	0321716C4A04B1CB42D90337C4C9811ABE9234FBBF667067BD38C3DF3FF6BBB0D96D0E2A52617A1423DA51338EF3CCBA460C727CEE3618F04498DFFE2452B905
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........4............................................................`...@......@............... ..................................t.......................X...`...T...........................................................x...H............text...d........................... ..`.data...'0.......2..................@....reloc..X...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...O.b.j.e.c.t.M.o.d.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...O.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Private.CoreLib.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12754944
Entropy (8bit):	6.874266685134611
Encrypted:	false
SSDEEP:	98304:SLAbobdTDh4dZflcEH5KP/f+xYKDCsultSwLiYopPp44VBML:aBbdfhSLoP/f+xYKm0MnoppJML
MD5:	5C07B5A5E0BCB2522BBE43FAD90B7CA9
SHA1:	FEDBD5291CA140DF5AE02166C41858EDEE2A1ADE
SHA-256:	A5733C3167302DA127CD1651475BB129C7BAD5247F0946F4D3D55803E5FDDCA1
SHA-512:	64698F9B97B71EF2CFDE1B65B525BF7DFEE062FEA157ED77FD3D776C21969A4AFD6A1C71FCC202196144B419D0837A245B7A16703806B3EECF8FEACA3E0AF424
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ..............." .....................................................................`...@......@............... ......................................H..........................T...............................................................H............text............................. ..`.data....&......(.................@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...C.o.r.e.L.i.b.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Private.DataContractSerialization.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2087424
Entropy (8bit):	6.763868149103118
Encrypted:	false
SSDEEP:	49152:JflNEAaMRtZAXOESAjVzeT2mOofLF12aLLvVrNI5b:JYAdRISx/vnu
MD5:	085BBBA5659ED8A044C43A1B2943F2A0
SHA1:	35E1D4E81419A3135117CE30464BEC9B13AC200B
SHA-256:	CDFF2FD69BD5EAD311BA4F914CFDDABF3C8755865E46540018DC57625242AF91
SHA-512:	D394F631AEAC3FEE5254C9D4E36554E66B4302FFA77F8008252D17AD6F14555E4A90C19B7F35500597A68EA09E6BF7571A4BF9A2AFAFE96A8C7BADC832199471
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....S..........." .........8................................................$...........`...@......@............... ..................................$....K................$..'..(...T...........................................................(...H............text............................... ..`.data...............................@....reloc...'....$..(..................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........,.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...j.)...C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...D.a.t.a.C.o.n.t.r.a.c.t.S.e.r.i.a.l.i.z.a.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...z.)...F.i.l.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Private.Uri.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	238592
Entropy (8bit):	6.779628935369436
Encrypted:	false
SSDEEP:	6144:Hg7DtXzvjktD2wEXcMG3rxqoeVmtGOlvzHJKn:cDitDSXcMG3t7amtGOl9
MD5:	529ABB4E2A2A4F1BC26C682B7C468CBB
SHA1:	C3D3927E9FC77F9EB3BD9D7F04BF4C2DB881E1DE
SHA-256:	6B1BCA224DE35D0C3DFC3505D138F1ADE12FAF9722BD8AEFC5B8A43C276CA5D7
SHA-512:	C8AC42569B34D19B113FAAA81C20FA4D48CD71EA7BB4121F63380AEFECB14206C75D42ABC89BC69DA96BAB358C55D816E0BEE10BE1FA698ED53294BC1FE80315
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" ......................................................................`...@......@............... ..................................t...X...`...............P...`...T...........................................................x...H............text............................... ..`.data...............................@....reloc..P...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...U.r.i.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...P.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Private.Xml.Linq.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	389632
Entropy (8bit):	6.718948645274057
Encrypted:	false
SSDEEP:	6144:lMtYE36NyeOI+iiRxpXQgxCkjCOYQQrLvsHpaEtNq+:lMtYE36uI+tRv/xNjCZQQHvuaEHq+
MD5:	0EFB3C94B728253233A3D24FEF5B563B
SHA1:	0EE2C0FB55794B1C7BC42E561D005E3BBDA45673
SHA-256:	6D450E0BD5717B79DAEB24A2ACC4AD36E995CDBE2841FD4583EB8D616F0CBBB7
SHA-512:	893182DE5A8AD0B94EA9803118A8F2AFDB68C278F21276135D840559D935FC1C604CF6390FEE23C651165BE3F65438A7406B5F34C5EC7DC61024A4ADA3174B16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...^............." .........`............................................................`...@......@............... ...........................................-......................T...............................................................H............text............................... ..`.data....V.......X..................@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...X.m.l...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Private.Xml.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8122880
Entropy (8bit):	6.83210086307047
Encrypted:	false
SSDEEP:	49152:aM8bq/XF+A2NKYiPk6Jf4aOfCFqbVXIoGb5qWeLFfMBrGpHobw27sYE585QeB2SY:aM8bq//f5cIa+QSJM0f+t50
MD5:	A4427BEC8E57CAFECAE1B6FB7FB5E522
SHA1:	27859BCAA240C558B39F6502C2B38D3650217148
SHA-256:	1C3AC8E9F530E3C461FFCB5921E8FEA5CF1E9CF0325A675E3C7DA8CC504DE65A
SHA-512:	58FF8E453BA93C0ADB60D9EB4A6D0BBB14537783EA24725D96C410A1A4D9C26E2F17DD649230455C96238B944CE900723768B93590A793CF8974808261E47EC7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....(..........." ......d..*...........................................................`...@......@............... ..................................t....Dm..................i..`...T...........................................................x...H............text.....d.......d................. ..`.data........g.......d.............@....reloc...i.......j....{.............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...X.m.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...P.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.DispatchProxy.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	6.447064997049979
Encrypted:	false
SSDEEP:	1536:GebuMsy3dNvbzTMuSxRVHJeeyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyu:GiuMsy3dNvbMxRV0eyyyyyyyyyyyyyya
MD5:	85F6312BB40AEB55A1D3BF9B6EA39D22
SHA1:	1B000C43655649698AC51C1BBA5338B581F7661B
SHA-256:	CBEA32864BA177BF1DA31DCE8506F83FF052B2C1E50BE9169E5D990A0B975819
SHA-512:	613F156570A548B610AC3CC1E33C0DF7EAD2D300FF1C34DC43DC6AEF437F60C328FBFA11E5D4E6BEEBE4F7AFEDF63FCF104272F01A8E0D4A6D2BCA99F75CF055
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....n..........." .........0............................................................`...@......@............... ..........................................\|...............\.......T...............................................................H............text............................... ..`.data....+.......,..................@....reloc..\...........................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...D.i.s.p.a.t.c.h.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.ILGeneration.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.00426516671027
Encrypted:	false
SSDEEP:	48:6EKXHZz8diRkMHBc+IvOX07NPCDmDiZDXoxTcZ9nEZWIoFKtAPo5WmQK:XdiR+xvOnDmDsDXRyWVTUW
MD5:	744A32047E063611B16D58E53623BA43
SHA1:	0448FAA29CE21B2EFCFA25F320DE885A681093F5
SHA-256:	4B013E49AC9410461DF0B061528DE0407AFCA7DDA01D48B86DA42D38176B4C1B
SHA-512:	1EB45217CB47325B44C8F0B66447CB6584E03E532B3FFD58CC58C7DAD4DDFB99663CE8DE04790D71AFF5F4D8B205033DE6CEF879BDAF4F714A00FE46BBEBEE51
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...E............."!..0................. ........@.. ....................................`.................................G..T....@.......................`......4)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ..d...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..l...D...#Strings............#GUID...........#Blob......................3................................................"...........;...........f.....!.b.....b.....7.................b...[.b.....b.....b.....b...B.b...O.b...v.............

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.Lightweight.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9011345011572405
Encrypted:	false
SSDEEP:	48:6AEcUeBpB2F0sdiRkf0S+IvOX0INPCDmDiZDIwf3ztZynbZWJomKk0VPP5WmQK:/UpOsdigxvOUDmDsDI0LOWxEVJW
MD5:	802D50B3497EB3D872821C424FBF31A6
SHA1:	5605880A7D2B7AF43D2CEB39B19E96665E527921
SHA-256:	F7FDCC8635D66B707B6556E395F9A73449A886EBAF0E6463E5EF27459829DBCE
SHA-512:	BD8745361C5D16F51826EB8C75712FD8BFF63B908B621D0FD436B076BEEEB48BC4D54DFD790AA2306A6540300D525161E67FFCE795CBFDDF31229351D813D34B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0................. ........@.. ....................................`..................................)..Z....@.......................`.......(..T............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..4.......#Strings....<.......#GUID...L.......#Blob......................3................................................0...........I.k.........t...../.E.....E.....>.....~.....~.....E...i.E.....E.....E.....E...P.E...].E.................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Emit.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.423128033613358
Encrypted:	false
SSDEEP:	3072:MN53gnriRYbKatxLnzBsVkrcn0uZQ1KEy:EWWSrn9suJuZQ1KEy
MD5:	290137A4FA63839C9ADF550F0E898B1D
SHA1:	6CB81EB8175C99B9BB578DEFDB4344F18D169E1D
SHA-256:	B6396812EF195622E0977BA1531D037287E33B74A1231CC5D3E3C19F9CA10C29
SHA-512:	368B9B8FCB9AF07973938D336370978B51CB5309377467DC6393557CD639068DAA84EA4E83E3624EBACCCD930535E230A07C749D3DA9EA41373B1C6B80BBB52A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...=.V..........." .....\...J............................................................`...@......@............... .......................................x..l.......................T...............................................................H............text....Z.......\.................. ..`.data....G...^...H...^..............@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...E.m.i.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Extensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.9530092592196775
Encrypted:	false
SSDEEP:	96:9sWkvlvSX8y1gafxvjUeDmDsDupzWKZWW:Qv8XzTxABWKZWW
MD5:	419E86D791240CA2B77045BFABE140A5
SHA1:	B2A3F2AEA81903F5CB43242B00593EAF18DF3527
SHA-256:	099734B7101A9ACD83CD10B71B6D5CC944C1377ACC2C6E2D3A1B97480C593657
SHA-512:	A8581D1C50273E23D86F6F3D17895D90335C7B720A8CBF5BC1A42DFE57BF6BC3F8563F643719C670162720B2A38DC72992C6EA8E430F93B31C8EDB9CEF2660C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............v)... ...@....... ....................................`.................................!)..O....@.......................`......,(..T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................U)......H.......P ..\....................'......................................BSJB............v4.0.30319......l.......#~..(.......#Strings............#US.........#GUID...........#Blob......................3......................................................x.....3.....4.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Metadata.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1087488
Entropy (8bit):	6.6821621981636605
Encrypted:	false
SSDEEP:	12288:cN0z7qnesy63AeclWDlLeO9om5Eoa/m3WlUlfeGW4brW0NUUBXEqTip8iP1EJ:cN0nqne0AecicOWmi/NKmGW4b1mXpWJ
MD5:	7347750BAEAC1804C6A6D577A43B649B
SHA1:	4BF5D316278E91365E1F1FD2C30EC0F4CFA7958C
SHA-256:	B862986B70795F170D01AB3DFD5ADD3EF6BE631283600AAF9068CC7DEFC098DC
SHA-512:	9A1EF3260B550FB9A23145092B4D9F4E635F933263C1D5CDCBBE5911D9BB168B52B339B428297B05074CDFD3268AAE3A94E915BDFF3F0EFF4CBF36D1B6DF996B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........~............................................................`...@......@............... ......................................0...D.......................T...............................................................H............text...8........................... ..`.data...1j.......l..................@....reloc..............................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e. .p.r.o.v.i.d.e.s. .a. .l.o.w.-.l.e.v.e.l. ...N.E.T. .(.E.C.M.A.-.3.3.5.). .m.e.t.a.d.a.t.a. .r.e.a.d.e.r. .a.n.d. .w.r.i.t.e.r... .I.t.'.s. .g.e.a.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.124756911527386
Encrypted:	false
SSDEEP:	96:wvBAI4j2a2disHHxvOtDmDsDjlaLWSx+W:2SI4jCBHxQlwWSx+W
MD5:	64CFDD31499E1E7589CE4A2C841EA62A
SHA1:	D3962760F2283B6835F32BA65DCB608A31A4604A
SHA-256:	401242400FC427D87EF3F141DFD63789846F88371CE67E3A2351B4C44F2354B2
SHA-512:	E534B6F56866C42F7459CF9414536BCBE95EEF1F210CD073A9F0E954473DE5852DD9533CBA29FCAB5E02287B4751E8CF29A907B8DFFB6D3509C794D39E62809A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6..........."!..0..............+... ........@.. ....................................`.................................=+..N....@.......................`......8*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p+......H........ ..h...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................3.........@...........Y.................?.g.....g.....`.................g...y.g.....g.....g.....g...`.g...m.g.................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.TypeExtensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.751924391577986
Encrypted:	false
SSDEEP:	384:4NCWmBeWGrYaw3YyEkM0KCfMTzk7TZ5P00a+SKYDlLZmrXr:GIG8aDcTZa+jYRZ
MD5:	BB1EC59C07742849C9351180CCED150F
SHA1:	EF2873BF0CFE6470F29FE34F3CF532C19DC54C37
SHA-256:	F864A8DD2A304E9FAD4E2CA49F07F4CF26DED3D5E866630CAFF7D5B4DF678E5F
SHA-512:	A9EF7121797F5EF0B2AD20D585605C7CCB64C8375B245AAC8D868375483C85325831E666803E5C5CC9EE6094A50FE34E1A580FC181BCC19300764B935D3A419D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...b............" .....B...................................................T............`...@......@............... ......................................tJ...............R..........T...............................................................H............text....@.......B.................. ..`.data...=....D.......D..............@....reloc.......R.......R..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...T.y.p.e.E.x.t.e.n.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Reflection.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.9954754259958176
Encrypted:	false
SSDEEP:	96:WQcl4kmyPZ6yluHNobjbhxvjUoDmDsD186wjWhFCW:GCkNQKBxAY89jWhFCW
MD5:	C2972BA581575836BAA619F144637BFB
SHA1:	560D5C943BD7BD00364A75BE7F2EA16019A85BA4
SHA-256:	9E1990AF78D989C411847AD079476CD5AE8AB2661B786D8E19A4363674880B49
SHA-512:	02FEA56D48722FA2290D5DFA2E5DC62E3983C6BA54128EC1181B72F944596EBEBB0C6271A7CBE5870C337274F83EADB1CD7A7B549AF046D22C43D635725129CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-..........." ..0..............,... ...@....... ....................................`..................................,..O....@..h....................`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................,......H.......P ......................4+......................................BSJB............v4.0.30319......l...l...#~......\|...#Strings....T.......#US.X.......#GUID...h...\|...#Blob......................3................................"...............M.............................q.6.../.6...........6.....6.....6.....6.....6...m.6.....6.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Resources.Reader.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.8531136005295945
Encrypted:	false
SSDEEP:	48:6r+lCft3Ml33Xye6adCX+Iv+KXkyP6zDmDiZDGRZxFZWsxKzp5WmQK:lO3Ml3Hye6lXxvjUtDmDsDgFW4+3W
MD5:	143546DC2CC649168B662333CD9522EC
SHA1:	F1E3DAD0775F5DD35F8FC59B89668867B3A9F630
SHA-256:	9D8F02EA65DAA27C085CE46D62E59EB8D4C0294C1F147D501E99FBD72ABDE919
SHA-512:	7C87B9F32924D7281F4B1E9D47AF8FFB059C8ED693BB6CF4C40842628D557E248C3D3492FAA4CBBA49338D3141AC5A7374BD11A17C5BD44563C42C013B0B01E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R]&..........." ..0..............)... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ......................\'......................................BSJB............v4.0.30319......l.......#~......h...#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................%...x.%...3.....V.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Resources.ResourceManager.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.8706473038970213
Encrypted:	false
SSDEEP:	96:mA6ljbly3i4S9CjxvjUbDmDsDBewe+WZbwbuyW:n6tbojxARvWV6zW
MD5:	AF7C0203E35AFC4587F4FF3911E755A3
SHA1:	422B9827826A8FC68BB2B37659427C6139241334
SHA-256:	4E81383AEA69834E308B66C8FFE4D34227F4EA62B25F17FF2C0A565B24861F91
SHA-512:	3CC35A376C98CDFFEE2FDCD2C57B0A2B7654E5BA2B869B3140CAB746009A3E158CBD63B32CE5D66ADFB416A4ADA1DA61F9F95FA39F2578A64771870FC42AEA4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............j... ...@....... ....................................`....................................O....@.......................`.......)..T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................I*......H.......P ..H....................(......................................BSJB............v4.0.30319......l.......#~..\|...,...#Strings............#US.........#GUID...........#Blob......................3................................................9...........U...................A.....A...........A...r.A.....A.....A.....A...Y.A...i.A.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Resources.Writer.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.164964673406475
Encrypted:	false
SSDEEP:	768:yP6Fcl/uk2CfmMCfxssm3R2/j0dHYyFM4Ig4P8B:yP6Fcl2/CfmMCoB2Q3KGB
MD5:	8E32ABF8ACF37700F098AA0CD0DCCDA0
SHA1:	9E131125A3A1880BAD083DEFA0540FD03EA40C93
SHA-256:	3CC6DB4E10701EC919252E1BDC58E3975B36C6D8DFAB76AE90C57DFC122207E7
SHA-512:	42BAF072712A0071234B61B74944CDBAF326ED00AA46F0FF6D03ECE7D38E4010C1D3CAC135190B6FD9B2468541D21DA5BDA2EDE40DABFBB03A8C437908008318
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....~..........." .....^...................................................~............`...@......@............... ......................................Xl...............\|..........T...............................................................H............text....^.......^.................. ..`.data........`.......`..............@....reloc.......\|.......\|..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.s.o.u.r.c.e.s...W.r.i.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.9669537810084807
Encrypted:	false
SSDEEP:	48:6U+lualOhW0lzSqnLyFladCsY+Iv+KXk9N1P6zDmDiZD9Ahf8Z3Z4Q8nlZW1JnU+:Kl50l2cLyflbxvjUUDmDsD+kTQWgJ2W
MD5:	8968503FE76B3C8A88AE2C1D9254801E
SHA1:	BBF673478DD67547B4CF5964C13DD394BDE9E0C6
SHA-256:	C02BBA32B2B9E10428601EC2F0BAD0EF40389A03C2FFCC5A2FC284905F7BF231
SHA-512:	7EAC2083E4DC412DEFDAFD5168A9CA190C45BBC6A519160B1B049744E4F428E7814F8DABA8725A2280B3079FD0106FE543FAE8BBB8FBE833DB09A08DCC2247EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U..........." ..0.............F)... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text...L.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................%)......H.......P ......................h'......................................BSJB............v4.0.30319......l.......#~......d...#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................4.....4...Z.!...T...........@...........p...........U.......................<.....n...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	4.767551768095952
Encrypted:	false
SSDEEP:	96:vEWsCLWPYqaGmvPFV/xLMlUFufVCX6xvP1lzWVrundDmDsD1xHYT:8WsCLWPkGa3ZLMlUFzqxH1lzWVitxH8
MD5:	6E1E3F2B3ADF5D19EC463B35AB43FE5E
SHA1:	F66FBC20A6CD592CE32ACFE3069A7A0D17ACC3C4
SHA-256:	717B3D9E6FC3582154DA6CD728D54EDA324000E493FDBFC768401245AA31E0A9
SHA-512:	D314D07F20BD7AA45BB448DB92DCF73B9DF642F911170253437BA65FC85AC97FCDEEBFBCD64C9B8B4E69551E4D99D9E709000A6AE330289604906C95B836163B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....n..........." ........................................................."............`...@......@............... ......................................,................ ......(...T...............................................................H............text............................... ..`.data...v...........................@....reloc....... ....... ..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...V.i.s.u.a.l.C...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Extensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.152786926618699
Encrypted:	false
SSDEEP:	96:O1lqyQGQSj5onbC/6VSZ7r1x21ZlxvjUPDmDsDYukRDJW8gNW:qG/Sj5r0SZ7r1x+fxA+FRlW8gNW
MD5:	0E123166AD38872666B9222D56C35461
SHA1:	6F6B48FEE6311D57EE8F275A322E5B96B15DC945
SHA-256:	3A79B35E2FE0A669B224EF0E035BF61BC90DA599D2FFD17EFD5BFB9CDD14D74E
SHA-512:	B6D00E1A7DA93219EBD751784AFC58C939C626E3080220148D2CE8936C82344FAA26179EBECEE79817704214AB9B02D76BE122529DE3CDC800ED0057CDC53CF6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@............" ..0..............2... ...@....... ....................................`..................................1..O....@.......................`.......0..T............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H.......P ......................l0......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................I.....3...................................................i.v.........N...........%.....B.....5.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Handles.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.0221133857729745
Encrypted:	false
SSDEEP:	96:1wWXKl5GLh+yOUa+oW4xvjUdLKDmDsDr6cqJwIWAZmW:u1lfxxAdwqqIWAZmW
MD5:	8EA31614D4235B7A6A2AB619C20B9CB9
SHA1:	3180EB385EA274AF209D14AD5B9EA9BE415ABD66
SHA-256:	AB1B67C7F73999497EF4BC2F1A4A300351790A478ED1BC0F0E5382A267DE3F12
SHA-512:	489E00E34EAC731BD639C4D5D34DB35241E90ED4EE77153A43C7C1D0986F94D80D0C94EBF11025E9B4A3475DDE3E0FB89C8E9CC25C996A44DE2BE4AD13B1042E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..D.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3................................................(.`.....`...f.................L...........\|...........a.......................H.....z...................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(...y.(.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.InteropServices.JavaScript.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.287378031486416
Encrypted:	false
SSDEEP:	768:yogxGMiFMwIOFV7ptGomAMcnbDSO+MH1Q+k71Gb52:yhwMiFMwIOFV73XjMcnbDSOzVzkEb
MD5:	4B87639D9902F0C0E54189A11FB2D234
SHA1:	39D4A5FA4BAD1662257A7003D00FFE2BBE270730
SHA-256:	478B5156FDADBBD657BE978445D44102E5864F292178B3DEBD3268050FC5A7ED
SHA-512:	5E0F2FFE0CF11FE8DC1A0E64CBC362EEAAAEA2F7BF0E4156BBD8C2401C696A78F9F99E38AA4E6EA7D9662FAA6DBA196D928BBF7E6B880ADFDBC334EA80747E35
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....d...................................................n............`...@......@............... ..................................$...Dh...............l......(...T...........................................................(...H............text...,c.......d.................. ..`.data........f.......f..............@....reloc.......l.......l..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........,.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...l....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...I.n.t.e.r.o.p.S.e.r.v.i.c.e.s...J.a.v.a.S.c.r.i.p.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\|....F.i.l.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.129839485128649
Encrypted:	false
SSDEEP:	96:qeOF07lvU1eCyllFxvjUIDmDsDHKFIWHDUW:f7e1eNxAEHWHDUW
MD5:	EEDB5CD1D91B1A751CEE180D34D06E35
SHA1:	92E76F81EE0E02546008B05136478FC47388498F
SHA-256:	65577B40972F856ACF3C0DC136B4BD6BBC171FD73E0FCF483D17922BE524F8A3
SHA-512:	7289E814C32F3D494C6427B7FA563FCE7A325C8C240D5A7B1DFDFF48C6AFB0DDE232A16E2228DC57B82F697C9B471E947EE5060E253A25C0138FD0408AA73ABD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.`..........." ..0..............)... ...@....... ....................................`.................................w)..O....@..h....................`......X(..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..(.......#Strings............#US.........#GUID...........#Blob......................3............................................................@.O.........k.....&.7.....7...V.....l.7...;.7.....7.....7.....7...".7...T.7.................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I...y.I.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.InteropServices.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	6.347499630257155
Encrypted:	false
SSDEEP:	1536:foGf8t1CUTle2Ctw3a6+67NspnSPM+l5+JkmVe6Yo:f3EYUT82Ctu+dSPM+rekmM6Y
MD5:	473BD8E2218E463D8FB1AE641C8076A8
SHA1:	982DFB88F129084D388B5645190684E149835C37
SHA-256:	98E2975023E3B569DEBA935599A28B57DF53EA7288913B9EA966A2518DEEA39A
SHA-512:	A3C0B484089BDAC279984F6664AD933CF3743A8382D4A243641F127209025B5195F46E0154E7649DF7ADD5432570DC2CE71D9C16011941968A9FF0ECD1FED504
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .........6...............................................(............`...@......@............... ..........................................\............&..........T...............................................................H............text............................... ..`.data....3.......4..................@....reloc.......&.......&..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...I.n.t.e.r.o.p.S.e.r.v.i.c.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Intrinsics.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	3.984541697794905
Encrypted:	false
SSDEEP:	48:6+k2Xvg6/zparXE3hmIFdiRkpaHMfrX02NPCDmDiZDAlB1Z3xZW6lK3d5WmQK:NX4wzYXgZFdieeQsDmDsDArPWmyLW
MD5:	CD5E62400F461CF3DE55FB881468F178
SHA1:	C7DA148C8EE1F00AA466F187CA78E2968C0D927B
SHA-256:	215778977250AB6C63A569FB2C973158E525F6640A0DA3332C148771C1104661
SHA-512:	187DA1DE019E1F49E9FACC0F484D93085CBBB888FA82CAAD88F4DCBFC18A3F4CFBAF46128D97A6D437F7F76CA6A1312D41300C2EA15EB2231BE061D99507F1ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0.............~/... ........@.. ....................................`.................................+/..P....@.......................`......,...T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`/......H........ ..\...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..P...d...#Strings............#GUID...........#Blob......................3................................M.....I.........B.$.....$...[.....D...........A.............k........."...........{.......................b.....o.......$...........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Loader.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.021323958603903
Encrypted:	false
SSDEEP:	48:6kpgCvwBI3/f584h53HBnfpxhiRk8xm+IvOX0lTNPCDmDiZDIH2dOZQY5qZWOmKD:u4B/HBnfpHiLgxvO5DmDsDsQrW5ZGW
MD5:	8F4B6A00C10EF6EAF9E9E8B6105EB3E9
SHA1:	D952E5E01A19A3744ED017E023D37ACD23FDF60A
SHA-256:	DFB49CE727FD17B446BC90335A5E13513AD7B3A49577D4F1A9A08712D7ECEB14
SHA-512:	8D11E7CCB753CA8F5AE37529BE97D5B581304BF2DDD5E8836446A443BA8C6FFCCFF77FD7EF601933DD96C203B86243F90C9787469098C73C6B1E94B0FFE0F8D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t............."!..0................. ........@.. ....................................`....................................P....@.......................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`...(...#~..........#Strings....0.......#GUID...@.......#Blob......................3..................................................P...X.P...p.....p.......v...V.....z.....).......1.....1...?...........>...............................P...........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Numerics.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	6.854502206787544
Encrypted:	false
SSDEEP:	6144:HEQz+8miKy66Yto76Pu6J/FGQV5IfAzt9dp+Y0eYJqZp:HEQzQiKl6Y4oxV5e+t9dxzYJYp
MD5:	140E63B4F56608BDCC0EE29357EA6F09
SHA1:	713578FE2FB348CC9076F2C2AAAD97B8CF58C023
SHA-256:	849E11451108D22C882BCEDE76A5FC454318169F877EBC63715CF9C93C4A0E48
SHA-512:	AEBC3920EDA4D7CD58B89E603B2C35EF89EAD2A782EEAD03C9734714DEF4EF13DD54B846775CA76A283CC3EE1592342DA7971EC869BB556B216643918378CEE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." ......................................................................`...@......@............... .......................................................~..p.......T...............................................................H............text............................... ..`.data...............................@....reloc..p....~.......~..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...N.u.m.e.r.i.c.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Formatters.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.6686870646135015
Encrypted:	false
SSDEEP:	6144:1Vjp21d2b6tSfPSWXoG3W9cnJvgBMhrMaT8ScXzvZWHsud:1lp6d7tSfPeG3KcnFgBMhq5zRhk
MD5:	B4142D0F7B1172BC3484DDB39D3711D5
SHA1:	5DE7702E54D9E5A614D3EBF244634080E75CDFEB
SHA-256:	696457A5D9B80B2FDE3CF913461EF9761BFBB50BF5FF7384C00D30DCA6A12F4F
SHA-512:	0990439381D17C5666EA0296FD78E8DFDEA5FDF743D8A4BA252120688626587EEA13C61700F611D08263F5768E63320DB54969AB0F1BAC82C91003AB9B58632B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...`............." ......................................................................`...@......@............... ......................................4...`............x......(...T...............................................................H............text............................... ..`.data...............................@....reloc.......x.......x..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...F.o.r.m.a.t.t.e.r.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Json.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9832445590744032
Encrypted:	false
SSDEEP:	96:z8tZMvzkyaxvDEDmDsDiEPwyVWbuodB5W:z8wg/x2IyVWbuodB5W
MD5:	2A316A14B5EE047ECD7D82236533B5D9
SHA1:	A82E79884C3D25B02B1F0DF138D70729502CEABE
SHA-256:	4106BC9A5C81BEC0785ABFC8D50752EF7727050EBA2A4F7413B26691BB1557E8
SHA-512:	4616CAB1332A1DDB5CF25789A3D271065F72D7F3E94CD194F7874B8C4484207D3E5E287CC7C2BE521C86157A79822E80382EF208ACA1C1B2D970F9C2D248F253
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6..........."!..0................. ........@.. ....................................`................................._..L....@.......................`......P)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..x...d...#Strings............#GUID...........#Blob......................3............................................................3...........^.......O.....O...a.....w.O.....O.....O...w.O.....O.....O...G.O...I.........................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.611633076346825
Encrypted:	false
SSDEEP:	384:1HWFISJBrW/t1vT0B2E+ac7ntmEOR9pnUkO2akIGt6HHDtax14pYoz9o:1qhJButVpEyY99pnsbV
MD5:	74E5AD6BBF3C918D4CCC3050568EB75A
SHA1:	1C3CAA703C37E2CD1440053F53D990BC59270747
SHA-256:	AA2282D1BF64A33EBD93D33E187963FD5908AADC7D18C39ED2A4C7392CB3BB32
SHA-512:	C6EF669411EA23694D25F288D21BE128A292E5A2BB86E98D16FBD1D8C4E55690566CE5AAD07546883FF87263BB104185C65438468D919F6A1F84877027F9CE2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...I............." .....6...................................................F............`...@......@............... ......................................P<...............D..,...(...T...............................................................H............text....5.......6.................. ..`.data........8.......8..............@....reloc..,....D.......D..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.Xml.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.163966299089815
Encrypted:	false
SSDEEP:	96:n3L8B5zQpr20X1Dk8C+KxvD3FDmDsDtwRMWsBfBBgW:7Wkr20FI8NKxGRMWsBfBBgW
MD5:	268DA63E4CDE55FBD220B175659D8090
SHA1:	4819153DDD227C247043938CD47F0678D73B85D9
SHA-256:	DC41F0F35ADBE3C63D25B2D819BB3FC042B21FB39EA1986351534C1D02B783C9
SHA-512:	308C04D645F94AC1AB85B9A55D711AF3F55053BE3751FB038A29A420E1EB6B0F8B45F9D472CAFF2342EB8D3DEA81E16D96B2DB39DE6CBBBA727115BBAD1B23FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...KA............"!..0.................. ........@.. ....................................`.................................U...V....@.......................`......H-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H........ ..x...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3................................"...........................W.a...............=.............Q.........R.......................9.....k.....m...................A.....

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.Serialization.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.17274809466052
Encrypted:	false
SSDEEP:	96:QXItClIufXqa2z6ONIVxjpX1Dn8C+uTUxDmDsDSXX2LWgMr4BHW:qNXP2tNIVxj7j8NuYbLWgMr4BHW
MD5:	13DEA1521C4057658C24E2BC4E9B994A
SHA1:	BEF32159684B108B8A49F31BAC999733A1109EAE
SHA-256:	31A12CF9D4296874C7FFB1C6B1622E170F635949554EFC68E0CD58AFD037E2C8
SHA-512:	9AE6EE5C968B789C46A76C7E57EFCBEE6418B2CBAC78F6642DB2FB58006BB96C9F712F9BFB721B1A2927871E3B00528401744F7ADEE8121E7EE5465A45CE0920
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0............../... ...@....... ....................................`.................................u/..O....@.......................`..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......P ..............................................................BSJB............v4.0.30319......l...d...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................~...<.~.....S...........Z...a.;...{.;.........#.;.....;...0.;.....;.....;.....;.....;.................3.....3.....3...).3...1.3...9.3...A.3...I.3...Q.3...Y.3...a.3...i.3...q.3...y.3.......:.....C.....b...#.k...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Runtime.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	4.89511926322131
Encrypted:	false
SSDEEP:	768:A+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDLf:EB/LuYdy50b4b7RSHPJ
MD5:	4E4622AF5BB4B5DDD44DB61C0F493632
SHA1:	E23FC54DF2E3A2BDF56CDD915B7B29CA39ECD069
SHA-256:	8667FFA72FC45C5FE3F46B48C660DE80DBAF3936934EEF8D6A08E8FE49749551
SHA-512:	A8006D1BC57A5EB72836AD2757D9DD4480C1DC5B6BB2A8F3FD1DC56977BC7C7516DB6DFD465285CFD6C01A370F2224425A4069980DA71512780F53F9D1961979
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...GS............"!..0..x.............. ........@.. ....................................`.....................................N.......X...............................T............................................ ............... ..H............text....w... ...x.................. ..`.rsrc...X............z..............@..@.reloc..............................@..B.......................H........ ...u..................P ......................................................................................................................................................................BSJB............v4.0.30319......`....2..#~...2..T@..#Strings....<s......#GUID...Ls......#Blob......................3................................{......#...........6..`..6....m6..(7....4.. .....%.....%....m#.....6...!.6..&..%.....%.....%..s..%.....%.....%.....%.....6..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.AccessControl.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	5.501608465852966
Encrypted:	false
SSDEEP:	768:127AkytJgoLzTABpatoFzaA4tk5IEK+MiLyMngyEH3T:1GWJzYmtIQkVyT
MD5:	BDC99BA981CD8648D14C3597C8002FBB
SHA1:	40CC71AA823311BAAEAFD592CE6E79AEAA480A5E
SHA-256:	92EBCA0709502FB3DA93028EF374387787560310EEE57B162E12F332F08051E9
SHA-512:	E3DA4402AA9C38F1A3BE7CA766B5AE567B853596E95E56AA69921C1E449C7C7A03E4B0CDD448CB4CE59ADE4EE25589B4D2724592317AD5B7FF8BCA5504955DBE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....+..........." ......................................................................`...@......@............... ..................................................................T...............................................................H............text...x........................... ..`.data...............................@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...A.c.c.e.s.s.C.o.n.t.r.o.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Claims.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	6.289793765073727
Encrypted:	false
SSDEEP:	1536:tXEYQ0byB4X+bX5SiRPuDQu6O/U/xOQwQ7rzUU3q2bP6YILFqgkWr:t59bP+bJSouP8xKFql
MD5:	CC1F7024CE6F6796EDE6A12BCA0F9AC0
SHA1:	A5780BDF25CD25B936E543BF73E9BC07EFF22005
SHA-256:	A39D8CF548E28D9D7C69114EB07BB685CF6DBCEB5F8EDD53545C6FC2F4F1429B
SHA-512:	31E14A32E18233626051C7EBE6184B1339B61845A93D3CDE316FC2FAB88131FDD30D4BD55127D418798F1B958C1008575A6710E8ED3661815811D4F65786D12F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....C..........." .........8...............................................8............`...@......@............... .......................................................6..8.......T...............................................................H............text............................... ..`.data....5.......6..................@....reloc..8....6.......6..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.l.a.i.m.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Algorithms.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.157132583311948
Encrypted:	false
SSDEEP:	96:ZWslkKyQrdjv4rT5fqJxvjUlDmDsDBBOWqkBW:564EqJxAyWqkBW
MD5:	48FE71E7E4BF4317F8018E52678F0998
SHA1:	5A479889AD285050E73C999B5D66CDE08DB80B4B
SHA-256:	AF2821AC0055093EABA5979314DC31D6B250F244821FCAE8291CA8B226B446A5
SHA-512:	5F202814B2B6082162ED3B2FB7DAB08EB2794715163AC38265B5AFE8259B5E68ECFEC5CCAA25A20DF879123F3846C3FAE6717D9F99797F4F376C3063690CD9EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%............" ..0.............R0... ...@....... ....................................`................................../..O....@.......................`..........T............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................30......H.......P ..$...................t.......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....\|.......#US.........#GUID...........#Blob......................3................................>...........................?.....6.....j.....%.d.....d...U.M...k.d...:.d.....d.....d.....d...!.d...S.d.....H...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Cng.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.116092071785417
Encrypted:	false
SSDEEP:	96:ukleMuuyRTElyhxDYoFaeUW+xvjUFDmDsDTaewjWx2fW:/VnAxNaHhxAsjWx2fW
MD5:	FEEE1083B5D5A97284C2C53B42E32057
SHA1:	004926C1A0F11A32B33BC0107D207879BE08517A
SHA-256:	C948CA7119C94B02EF74DDDC3B171952C6F9E746092A6DC82E78877BF0317BDD
SHA-512:	72D5FD9C7CFBA927BCC10CEFE25000A3B31B33337E1AA4A40145312E0EAF1F2702C1F59D999C42C209A71D39008A2E662FD66EA6C652AEACD2CF8C0E6AFBEEB4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..............,... ...@....... ....................................`..................................,..O....@.......................`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ...................... +......................................BSJB............v4.0.30319......l...<...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................d.........J.!.....!.........A.......J...n.....,.........................................j.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Csp.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.185740473691228
Encrypted:	false
SSDEEP:	96:/JlJeuuySbvl2Cj0j5jzjgjDj8jKj3jgjJjYZxxvjUhDmDsDxPbwRWLgtW:xSbUikV/AvcaTAFCxxA1ERWLgtW
MD5:	6438B5A61406C82BF991242AA3FFD792
SHA1:	8ABF46E6517B898269DB31E0972E137789F1B1EC
SHA-256:	3CFADF70558B8E057D466BF230B05BF584D5A521BF3CF98C7CE93FF4ADCA68B3
SHA-512:	18AED8A80ADEA7B7E3CB51588CCE999D80F82D0C64E6364828EFDCD5E252B918F353CC1D7BB930C01F4DA9F54BE5FD83F0D9D92F52D839F8A7890663D95A4A11
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H.:..........." ..0..............+... ...@....... ....................................`.................................y+..O....@.......................`......\|*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .......................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID... .......#Blob......................3......................................................x.....3.n.........^.................I....._.................w.................G...................h.....h.....h...).h...1.h...9.h...A.h...I.h...Q.h...Y.h...a.h...i.h...q.h...y.h.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Encoding.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9924607807621277
Encrypted:	false
SSDEEP:	96:hy+khlomUyLWtANoYV1zo+IkBxvjU4DmDsDFP7W5ZWW:shZo8V1zoYBxAwW5ZWW
MD5:	30B299397896FA09888463F2CC28BBDC
SHA1:	0A507AA298141BAF37E6B8EE3A212C0D26204CA6
SHA-256:	61B99E6CA4D9A78BC3C4909F6CEA5132CE91FE9C555AF8D6EB6C06B4F93E18E9
SHA-512:	EBC9DC8551363F5E478D4FBDE655FB9D8294B055C3B13D4184DAE25BCC0F49B5E4CBC57EB7A26AA857FDB1DA6D0C63D077816DF308AF4670A9B1F544D6B74E2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ....................................`.................................o..O....@.......................`......h)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...L...#~......<...#Strings............#US.........#GUID...........#Blob......................3................................................ ...........^.................D.d.....d...t.7.....d...Y.d.....d.....d.....d...@.d...r.d.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.OpenSsl.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.1040392606002625
Encrypted:	false
SSDEEP:	96:vcvePR8lIyoCl2xvjUdDmDsD9D/9WAmdbijRW:ULgzxAFz9WAm5ijRW
MD5:	7923463890F684759EE5BDD6EED7795B
SHA1:	683EBF7263A49C295D3BAF9733FC3E635D2F0FBB
SHA-256:	D800E1CF68F8008BE98DB84CBF55F7AD32058797E77922FB18DCDB5F86B34181
SHA-512:	D6DD8A09716D93E418AC0E75A000DB932BF4B228AC24F31E18BA9F7784726A07AB59AB521031C4383D6C858B4DED0ABDDDE908ADBAE4BCF0CB30660A00900D23
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..X.......#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................\|.....\|...E.i.........p.....+.Q.....Q...[.J...q.Q...@.Q.....Q.....Q.....Q...'.Q...Y.Q.................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c...y.c.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.Primitives.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.124906515582101
Encrypted:	false
SSDEEP:	96:yPl8NyxqlWFuPxvjUJDmDsDHpjoWI+3W:Y6y3FuPxAGWI+3W
MD5:	DCAFEF98300FCF0207D6CE867A51BEE3
SHA1:	131367048A5ADDE455220264D09146BDE077634A
SHA-256:	9D6664511063754CDF7CC18A23453EFCDD49248293CF7DBD9E683FA1AA4EC2AE
SHA-512:	2ED5A61AAA509E73FA7DC75CFFDA5ACD5172F94B84E4CFBDA4E80C08EB143DDBDC55FFA82B5747DCC318AE35FAA00230CD98D99FE045DC7BDDAB79EAD94476F1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M............." ..0.............v+... ...@....... ....................................`.................................#+..O....@.......................`.......*..T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................W+......H.......P ..H....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................4...........r.................X.............(.........m.......................T.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.X509Certificates.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.401225353293449
Encrypted:	false
SSDEEP:	96:yvla7cVyX7NTyE1siPcXHxvjU59DmDsD7CXWemfW:Qw7H2oc3xAhsWemfW
MD5:	19741B653B74463314E62EEF08503C2C
SHA1:	E81B28B4A1878DEBEC29740A2F1DA48B1CC5E39C
SHA-256:	16A6C462D0E337A950F01E2B7036336F5E99339A6DF3D3BEE6AD4BF905F2897A
SHA-512:	27FF1584686DAB8C56541B9FC1613B2476FF4F1C558EE691154C758E0FDFA83D6F217F68F24191644C8EECE44BE890982A142F7780240E98A3D7101184FEE737
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z............" ..0............../... ...@....... ....................................`.................................o/..O....@..H....................`......X...T............................................ ............... ..H............text........ ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......T...#Strings............#US.........#GUID...........#Blob......................3................................-.....r...............'...................X.....k.....k...........k.....k...i.k...&.k...C.k.....k.....k.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Cryptography.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2036224
Entropy (8bit):	6.714774918281042
Encrypted:	false
SSDEEP:	49152:QNK3Q5WZbPzjqhfStprkVGsv5wanfzsz8xfn/Nzn+LlJqU:QNIbqNSoWanfzrKJ1
MD5:	860782841457B66AC92529DF84FDD762
SHA1:	CAEF9D05F61C65B7222F090110A97CD78345C469
SHA-256:	D79F9619B5623957A718B0A0A6A0BE35044D09A1FF2FFA97BE6056E08F87CBEA
SHA-512:	33F22DB1F3751271DA57D19FA69F1A05FD6022AC7D7F6CD8CAF8CB84FBF681C691942FAE404FF044BFFA08DBB3324DB2894644FEB2CF408D17FD9E70A0D562CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....I..........." .....&....................................................$...........`...@......@............... ........................................................#.........T...............................................................H............text....$.......&.................. ..`.data........(.......(..............@....reloc........#.. ..................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.r.y.p.t.o.g.r.a.p.h.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Principal.Windows.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.436538490435295
Encrypted:	false
SSDEEP:	384:WcfWFhOWGEMo8LaIaYh88fZQJcWzbM9Z/CUsw67Ky/cYLwNidc+0L4:1ofMo8La+h8KEcWc9BCxqb+u
MD5:	9C62F94C2B526953BF49721880CC78AC
SHA1:	261EF047A1347C07A82D8E25914FE2B8AE2A478C
SHA-256:	93AB29A9C27461775348BF449DCA0001B40BF122FC6A254E64853780689E029F
SHA-512:	04B234CE230F887F9BD38C9C9828319AF97F9CD1AE6C8E84FC8390D09C2DA20223DF48273F46861DCFE9A79D1B506657554F0CB403F839A99DB5CECB911D5702
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................" .....b...................................................j............`...@......@............... .......................................f..$............h..........T...............................................................H............text...D`.......b.................. ..`.data........d.......d..............@....reloc.......h.......h..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...\."...C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...P.r.i.n.c.i.p.a.l...W.i.n.d.o.w.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...l."...F.i.l.e.D.e.s.c.r.i.p.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.Principal.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.934454702067044
Encrypted:	false
SSDEEP:	96:ldgdl4600AyQelfxvjUxDmDsDGIRvjWVUmfW:sB0LCxAtjWVUmfW
MD5:	FA8C8CD277E45031D9F8D7235C4B5F01
SHA1:	5C214B2A3083C8A90655E54CB5B959290DD28ADA
SHA-256:	273B8730DE1547A2BCEEC3858505458A553D16BCD8FFCC44D539910B91B38AE9
SHA-512:	BD52A5743CEC71AB424C72A622E94AC8C29AB9BBBDACAB8B54DF60626BDC4312A84F41A7F404A0D16AA2C2A52E2A879DD953AADC92B9721C985AF67872C2463D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1a............" ..0.............f)... ...@....... ....................................`..................................)..O....@.......................`......$(..T............................................ ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................G)......H.......P ..T....................'......................................BSJB............v4.0.30319......l.......#~..4.......#Strings............#US.........#GUID...........#Blob......................3..................................................=...x.=...3.*...].....^.................I....._.................w.................G...................$.....$.....$...).$...1.$...9.$...A.$...I.$...Q.$...Y.$...a.$...i.$...q.$...y.$.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.SecureString.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.045816927658356
Encrypted:	false
SSDEEP:	96:NMWOlAvBPxadiuTxvjUQDmDsD86NwpyW1O3W:KxMBPxotxAswMW1O3W
MD5:	11C7B6796C208F874ED87E45E1FA28F6
SHA1:	97EC89F7B125E0263BF6A1FEAED9DB64E023506B
SHA-256:	E86924FD17BF39E47298AE00C6E1C82F3632C7C8C523D0073CD2AF34113E2750
SHA-512:	5EC85DFCF49FFBAFF979826777EDA92AF509C8C3FB48D783A2111A856AD574CE3D23B7F8B1CA7B7397FF9222C8E3DB77A0860BF43CD01393D0C44E9A8ED26DFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v............" ..0..............)... ...@....... ....................................`..................................)..O....@.......................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..D.......#Strings............#US.........#GUID...$.......#Blob......................3............................................................3.Z.........^.......B.....B...n.;.....m.....m.....B...S.B.....B...w.B.....B...:.B...G.B.................T.....T.....T...).T...1.T...9.T...A.T...Q.T. .Y.T...a.T...i.T...q.T...y.T.....T.....T.......................#.....+.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Security.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.210416107184997
Encrypted:	false
SSDEEP:	96:q48FltEEZdo87XHkp8p3jDv1spZFi6k1AkMJJkxvjURDmDsDUMfeM3WsKDW:qvx7XHkE3jDvupZFiVyJSxAZR3WsKDW
MD5:	E6275CA3A50ECA49BA0ADC66E5844389
SHA1:	279E0E77CCB26DCD7BF9F840BCF18E5D0B386CA1
SHA-256:	D7DD61D7D1B51AC436F8F60462B6657FEB011D9A2725ACD3EB48BA4E094306C4
SHA-512:	2CDBD3DB0B12E03F8AAB2408C80607A1B8CD655CA49F7EA5050F3796601A15C819494B4945FB68ED5FEB323DD4785351EAE89BD07496FB8C313D881E1CC1F93C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]............" ..0..............3... ...@....... ....................................`..................................3..O....@..X....................`.......2..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................3......H.......P ......................P2......................................BSJB............v4.0.30319......l...H...#~..........#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3................................O.....................0...........3.......x..... ..... ........... ..... ...r. ..... ...*. ..... ..... .................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ServiceModel.Web.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.08910048710099
Encrypted:	false
SSDEEP:	96:6eVUlugsxDWojzWTpFUrDmDsDMrWGlM5W:6nspzAWGlM5W
MD5:	9E46CA359CAD6D3B968C64A8C5CC1C22
SHA1:	7EF38280B5492A24BE818FF835AB62E5C8E78FDE
SHA-256:	A06446DF2839B141D50D5B3AA9BF2BC7A346B85E1F6FB1F3F6105E4CDB19AF59
SHA-512:	C7F8A1B0A8009F2184B067F5F8DDE76B8F2C02D059EF714AFDAC0403F3D451E7D6B85869D5187F176C85FA6BA7273BE39B687FBB2C26DD57D3A684EB1E9F521B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s............." ..0.................. ...@....... ....................................`.................................3...O....@.......................`......H-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................g.......H.......P ..x....................,......................................BSJB............v4.0.30319......l.......#~..8.......#Strings............#US.........#GUID...........#Blob......................3................................&.....................?.................%.].....................&.................>.....[...................{...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ServiceProcess.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.047376730948328
Encrypted:	false
SSDEEP:	96:aMlumYpJ3ArYxvjULDmDsD4Q4pWnielpFW:7NucYxAGpWnielpFW
MD5:	E165EA3EB9ADDFBD018030291AEBBFE7
SHA1:	9F77B4F5A600C0166CDA384380CB9130FA714CD8
SHA-256:	31CD908605B66188DC39E51BF324846D842DD0BCA82ECC6089C35CEE549B21D7
SHA-512:	5B3DF93FF131DD4741E847BC2D7CAFC1E9331CF4CA8F6D6471CACA462279E7B54B465C7C6CFD2FC95CDCD55BCDBFCFFA24530FE53E4212CEB5960884F1813948
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z..........." ..0..............+... ...@....... ....................................`.................................;+..O....@.......................`......T*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................o+......H.......P .......................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................!.........f...........\.....:...........B.^...H.^.....;.....^.....^...+.^.....^.....^.....^...p.^.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encoding.CodePages.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	841728
Entropy (8bit):	7.512532271719518
Encrypted:	false
SSDEEP:	12288:bf7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rlMpVEZk+uV:bD9km6k/IwRYbiBeKGChn8Z
MD5:	21D9F4FB8C03118B3EA1225AE13717AB
SHA1:	C9C65A740ADEF5D531D7C376DC50A630C8FB94DC
SHA-256:	FCD4B2C79B6B776949CD9739F86076A5E9B6B65671899140CCFD483028C8567F
SHA-512:	E1925A46B64966E143825E3754C2A5F58F89F9B30465088C9B83B0CD62C09CCA2FC0B1FDC213A9C63C1663D77ABAD08BFC5858600F69A9305F46DA99BB626A9F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....V0..........." .....0................................................................`...@......@............... .......................................R..................4.......T...............................................................H............text..../.......0.................. ..`.data........2.......2..............@....reloc..4...........................@..B............................................0...........................t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .s.u.p.p.o.r.t. .f.o.r. .c.o.d.e.-.p.a.g.e. .b.a.s.e.d. .e.n.c.o.d.i.n.g.s.,. .i.n.c.l.u.d.i.n.g. .W.i.n.d.o.w.s.-.1.2.5.2.,. .S.h.i.f.t.-.J.I.S.,. .a.n.d.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encoding.Extensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.940454029788917
Encrypted:	false
SSDEEP:	96:nmjzXRpR4WdinK/xvOQDmDsDVaTW6sJW:nmXhp/tx34W6sJW
MD5:	F873624E031E6C992D4F7BCF341B9221
SHA1:	55AAD0A9D8A3252AB16AAD382AB28CC3ABFA1779
SHA-256:	755C803EB954949870B5DEEAE410159D40DE8207A183ECF370148BD2E85A82FF
SHA-512:	916598641D89ED2A621D701E40BD0A85F7AD683858369D7B922EBD6438CEE27404FA2E1DCA11EDF27E83FA9A82C5082069CF4F9FE3B39E849B063B944D8EED88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...F}............"!..0.............^... ........@.. ....................................`....................................P....@.......................`.......)..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@*......H........ ..0...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..`... ...#Strings............#GUID...........#Blob......................3......................................O........."...........;...........f.!...!.z.....z.....s.........;.......z...[.z.....z.....z.....z...B.z...O.z...v.............

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encoding.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9136537063800705
Encrypted:	false
SSDEEP:	48:67Y1g/0lFrXOy3ndBadYJo/ktyP+Iv+KXkWP6zDmDiZDRAZQYyXZWnTjKwK735W0:mclFrXOynNZ0PxvjUJDmDsDIQtWfgNW
MD5:	7F7CF24B6050F36CA19028C00CBB0F9D
SHA1:	9E595E4C5A3D5EDD5BB29D8C9778FCEE2454196B
SHA-256:	CB3609C961D8C8150423B472C68BCFFF3ADEC709008E4255ADD94CCC1BA80D8B
SHA-512:	31B459B1AD242A5D2BE1FC915EF32BEBE64E7B7CF71CCEE98A703283037D7B64D9398B3502A769A66C95F190DE10AA4091CB710EC93A90FA8A1DC44D8DBDEB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W.J..........." ..0................. ...@....... ....................................`.................................]..O....@.......................`......x)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...T...#~......T...#Strings............#US.........#GUID...(.......#Blob......................3......................................M...............x.....3.....7.....^.......m.....m...I.f..._.m.....m.....m...w.m.....m.....m...G.m.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Text.Encodings.Web.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110080
Entropy (8bit):	6.368079525859768
Encrypted:	false
SSDEEP:	1536:7i7mMLZ8QZ9Njc/JDD3lhjdPTp8K76+1PuLM0dyxNXzaTZqWUPFOZse:7fA8f9Z5N77Ze0NDaTZ1UPFase
MD5:	B810B9986AE25E70F716BCBFE1ADD3A6
SHA1:	F12ABF3A6C99ABA106EBF9C6242EF633E09A13D5
SHA-256:	7DE6FFCAC03A9FB29877A7A8FB467C889AF2F8560A3C605E3F11C2C2B5C2E9DE
SHA-512:	5CADBC9CBE9929CF77DDFAD58E60BC36D63EB331528D5AF489E9A967A366D9BF7D08A4ED9C299722E61A0E865CDD5B8FF2B77F2E4975587C7E42933D278FF2D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ................." .....f...F............................................................`...@......@............... .......................................w..X.......................T...............................................................H............text....d.......f.................. ..`.data....C...h...D...h..............@....reloc..............................@..B............................................0...........................P.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .e.n.c.o.d.i.n.g. .a.n.d. .e.s.c.a.p.i.n.g. .s.t.r.i.n.g.s. .f.o.r. .u.s.e. .i.n. .J.a.v.a.S.c.r.i.p.t.,. .H.y.p.e.r.T.e.x.t. .M.a.r.k.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Text.Json.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1466368
Entropy (8bit):	6.77912402281333
Encrypted:	false
SSDEEP:	24576:LYbOt2HlSx8ImtdfgxlIuR5K91h2Ql3zOvq8PyFb:cbXjImtdfgxld5o1Kvy
MD5:	0F99AB5E20AD1345BBA80289D4B88730
SHA1:	60D5E308C6EC837580A07C0559263BB46FD174F1
SHA-256:	FBF2C797FC70FEC5ADFBADA98C200E4231B0A99D541523FEE1C7909AF6060B2E
SHA-512:	4ABD9E7B1371044922BB5B470B18246B58DD0D7456C776984D96CFC77562AB1B69272A63F21AF7804AA8331B12D19E140185047E8850961185D6B5FE563AFCE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...)*............" .....~...................................................`............`...@......@............... ......................................................D..........T...............................................................H............text...X}.......~.................. ..`.data...............................@....reloc.......D.......D..............@..B............................................0...........................d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....=...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .h.i.g.h.-.p.e.r.f.o.r.m.a.n.c.e. .a.n.d. .l.o.w.-.a.l.l.o.c.a.t.i.n.g. .t.y.p.e.s. .t.h.a.t. .s.e.r.i.a.l.i.z.e. .o.b.j.e.c.t.s. .t.o. .J.a.v.a.S.c.r.i.p.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Text.RegularExpressions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1012224
Entropy (8bit):	6.873971317890411
Encrypted:	false
SSDEEP:	24576:6qQpLmil4QQh8inDiv67tA0ehjK2rh3xxu:upDl4QQrivgehjKyC
MD5:	E12C1259F9854F6FF6B79F804A117EE6
SHA1:	64D5D52D19D97237ABAAA698C676BD024C71C96B
SHA-256:	719828B405FFAAF4E2F7A51EB39C4EBC4A89D92D500D443D48C314D5CD075817
SHA-512:	CA26E6C9A9817EBE03F5A2FFA27A34388145902C47071CF01B987CF53E688CCB4978CAF668EB8AC3D791940E4610533CBB76B234AA877D0D93C07A78B0CE3EB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....w..........." .........................................................r............`...@......@............... ......................................8....G...........^..........T...............................................................H............text...X........................... ..`.data..._...........................@....reloc.......^.......^..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.e.x.t...R.e.g.u.l.a.r.E.x.p.r.e.s.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Channels.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111104
Entropy (8bit):	6.6457617624583145
Encrypted:	false
SSDEEP:	1536:kZogiLn2vlVNgwk6qja1leLQeWoioIu1sdzG0:kjiLn2vlVNRVqW1leMeri
MD5:	5654ADF341D7831498CDECD6D35A97C1
SHA1:	6534F0999AB684E8840C644515CFF0EFBA89D686
SHA-256:	E3A712EA9909DAA742E60A4317EB9CEF86BAE6D7E719F54D41F1C4DF4E7E6BB2
SHA-512:	4170D4B5F6D3885F28EEF5C70F17BFE54E150C339709E8F71DD943B0E913C39E8F8B4FCA919C14CC02E2ED9463448AEDA02C2AD6E5CBA868CEDCA830B30CF5FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....J..........." .....F...j............................................................`...@......@............... ......................................d`..........................T...............................................................H............text....D.......F.................. ..`.data....e...H...f...H..............@....reloc..............................@..B............................................0.......................x...0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...l.....0.0.0.0.0.4.b.0...0.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .p.a.s.s.i.n.g. .d.a.t.a. .b.e.t.w.e.e.n. .p.r.o.d.u.c.e.r.s. .a.n.d. .c.o.n.s.u.m.e.r.s.......C.o.m.m.o.n.l.y. .U.s.e.d. .T.y.p.e.s.:.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Overlapped.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.993705306267922
Encrypted:	false
SSDEEP:	96:bI/HpdKiI+bHsxvOPHfDmDsDLHdH85WcuHW:byHCdCHsxcHdHdHgWcuHW
MD5:	73AC121DC988B240A9534156EBABC513
SHA1:	923D96DC68A30CCEA5D5F895526B611AB96FC7CD
SHA-256:	894A7ABAF3D20F1354046FB67CD03E93B946895D23F1A4B18F3660B99D800959
SHA-512:	73A604E3173C4A59CEFCCC2001FB17CDD43B9D6A1AFC88DCDBD79844A3EB904B250F02BFE115A6698392226304FDF43CE679504FEF1FB613BE6CB9416E3559B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............."!..0................. ........@.. ....................................`.................................C..X....@.......................`......@)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ..p...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..p...H...#Strings............#GUID...........#Blob......................3......................................................4...........7.......c...{.....V.............c...t.....}.................9.....................................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.Dataflow.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	478720
Entropy (8bit):	6.783772480086556
Encrypted:	false
SSDEEP:	12288:viRE5DklxqnJbeAFRsJTuiKwIrD6FB5v3SxD6DZWX9gLb9PRnT:vvelx0wQw5vixD4oX9gL
MD5:	9BE7A074F8237E03AB6AD66B31A0499B
SHA1:	326BC7A5D19861CAE044DDBC3E7291D441B03111
SHA-256:	022CDA2AC16C4024888B874D06BDA1BDD7956CACFB402A0AB9714F49172F1FEC
SHA-512:	AA40B737445461238B49C9608DD83D8CB3FD86FFA87DE08E753B5A4C4B93422509FF1BA213FB879D0B4652A3265EDC740FBEDEFB98A203A283CD52F60CC749C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ....h............" .........................................................N............`...@......@............... ..................................P... ...,1...........@......P...T...........................................................P...H............text............................... ..`.data...............................@....reloc.......@.......@..............@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.P.L. .D.a.t.a.f.l.o.w. .p.r.o.m.o.t.e.s. .a.c.t.o.r./.a.g.e.n.t.-.o.r.i.e.n.t.e.d. .d.e.s.i.g.n.s. .t.h.r.o.u.g.h. .p.r.i.m.i.t.i.v.e.s. .f.o.r. .i.n.-.p.r.o.c.e.s.s. .m.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.Extensions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.298034520422525
Encrypted:	false
SSDEEP:	96:1yxnlGql+6yXkXOfde05Ue0lPwencmrRU4cDmDsDP8uOKwGWSOXW:MxnghfhVe05Ue09wencmO4oOtGWSOXW
MD5:	519C2363F28EDE7146572B519A7E3E88
SHA1:	A9E1C48D70DC417B8F0CCE232135362A2CCCE20B
SHA-256:	C5E42FB4EBA989C52324284019ABF7DAF880202F1FC23CFBE95D231596BC6BD1
SHA-512:	AE038B7BC05F7876EE188E472E16D50920AAB93771AC02004842A26025043B16EB37742DCE77FD5935691F9F27721D9DEECC02B58C01B9FEEA68ADFC7C5B7B94
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]............" ..0.............R+... ...@....... ....................................`....................................O....@.......................`.........T............................................ ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................3+......H.......P ..0....................)......................................BSJB............v4.0.30319......l...d...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................s...............1...........A.......O.................................W...........1...................p...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.Parallel.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113664
Entropy (8bit):	6.601867653242959
Encrypted:	false
SSDEEP:	3072:mqxdaJZ+dG1VBBzqdrhYnS+51Vmkg9GEU9kkkaP+lz+b:xdKtSVhmVMwKo+l
MD5:	4CA4FDD71CC22CE19E25F019AC345D84
SHA1:	488DF0BFA5786CEAD4E20A2704C77ED0969A031A
SHA-256:	DBCDA5E8216FA33DA48FF30F9F6AB5C90A93517875DC6F2B553D3A0667691696
SHA-512:	4B2B5C7D5E139696F184253831F69980545F0B78DFA5A761F59094BC2FD480CFFA6E30D56F624669C382B6C5BE9E8F626A3F77684829A8154319C2BE8584C064
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...bK............" .....X...b............................................................`...@......@............... ......................................Du..........................T...............................................................H............text....W.......X.................. ..`.data....\...Z...^...Z..............@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...T.a.s.k.s...P.a.r.a.l.l.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Tasks.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.004184534930114
Encrypted:	false
SSDEEP:	192:CB2bcWiW1Wfk3kP9BfxAdqnPQz9WHazW:Eaf4fk3CBpoqPQz9WHazW
MD5:	402602F9BDECF542F8CA733238D28395
SHA1:	B808555FB213D021B2783377F2525E8FD392570F
SHA-256:	C0C980EA9B5A886A792591489D702F763079127CD65D6D3FAB4712E8928FEF5C
SHA-512:	134FE6702D88BD4E503CA47341F2A34B07624AE55C07B8565184A18767F4112FB87D062197C08EFE145B72B56F50C4045BB1B95406DC17B0F1A8BBD1657A1155
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............" ..0..............-... ...@....... ....................................`..................................-..O....@.......................`.......,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ......................@,......................................BSJB............v4.0.30319......l.......#~......H...#Strings....X.......#US.\.......#GUID...l.......#Blob......................3................................&.................o...w.o...2.\.........].................H.....^.....-...........v.................F...................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V...y.V.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Thread.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.096637441759316
Encrypted:	false
SSDEEP:	96:5a0fjszKdiI+bprsxvOvMDmDsDxkd7TpWcC7W:5a0fAz4dEpox0gkd71WcC7W
MD5:	897C023B35985306905D8434F39C7CF0
SHA1:	7B5535B197B75DF9C2EB0F7C4345044CEEC709AF
SHA-256:	07FFFC1729661045BF2A9F8415BD193792DFB9A8E210B9CCE46B6B07D373ABEA
SHA-512:	4C99BCD9EAC9E10F981E0F2588C87EBDA8AF3C973F250BF619569A54B69CBB08FF9F0AF1DE1836246B6DC52A24A92224B50FEA5C124C6142360C05E8B7681D98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ks............"!..0.............n+... ........@.. ....................................`..................................+..X....@.......................`.......*..T............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P+......H........ ..H...................P ......................................................................................................................................................................BSJB............v4.0.30319......`...\|...#~..........#Strings............#GUID...........#Blob......................3......................................].........U.@.....@...n.....`...........T.............y...0.!...9.!.................................u.............@...........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.ThreadPool.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.911149772615472
Encrypted:	false
SSDEEP:	96:36gWBmT0diI+QT2GxvOPGDmDsDP77RWEmvW:KtmTqd92Gxco7lWEmvW
MD5:	C5E55840826B31657FB5BB5A188FEB12
SHA1:	B1C983BDEC2033B603AC2A45D47115D808F41D7E
SHA-256:	4451810E6462B51469127FD322B3096DDE46DC513A56FC0B549D2D0288EB0624
SHA-512:	CB762C914E6B8E935EFA5257CE3AF71A5CEEB4CC9B7660438B434CB09E49F405D768B0BD7206221F86B1531CF2FFC8D3DEAF4738926F4D29190252E7C3771270
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0.............N... ........@.. ....................................`..................................)..L....@.......................`.......(..T............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0......H........ ..,...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..`... ...#Strings............#GUID...........#Blob......................3......................................P.........7...........P...........{.....6...................................p.......................W.....d...................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.Timer.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.855693160510187
Encrypted:	false
SSDEEP:	96:8iMAlJfyka+26NNxvjUdqrDmDsD7viWwMWs1CW:XsF6zxAdqJv4MWs1CW
MD5:	A6AB56374CDDA5D1BD76F7483D9C216F
SHA1:	7766A8AA1CCE2E889B450E3CBE0337FE41B894F8
SHA-256:	677971EC7D604F1518AFFB411EB57FED885427DE9D7700134F5BB719E2F1FA0F
SHA-512:	0DB05E68ADE7BC43BC51C4FE3D22B19D1CC58A18D9AA64669B5805DD1234A771C314425668576BDE49DC6F05B9B354B060BCB5DEAE11A463804E908CF9CB5D65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6............" ..0.............")... ...@....... ....................................`..................................(..O....@.......................`.......'..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................d'......................................BSJB............v4.0.30319......l.......#~......d...#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................3...x.3...3. ...S.....^.................I....._.................w.................G...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Threading.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.358544929350117
Encrypted:	false
SSDEEP:	1536:/Ou9dxr5fvwCJdrdZ8j0MjwdV3ShPeGgaMoW9z:/v9Dr5fvDdZ8j0MjwdVihPeGgaMoWt
MD5:	0DF1B925E07DEFC57B8D72AB3804CE0F
SHA1:	98AC434436A6F6F83AFC73E1CAFC395994475D99
SHA-256:	6906708C5B40EB8E86D35698BD778D66B347F0E5DC326614A1B291AFDDE08125
SHA-512:	85BB6E3E6457088DB20AF44EB38E59BAF496322F1CD7866DD3571C3587CE3243FE236998572B23678648EDBA66CC05382567404E2F046F85A331775858D8BC4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. .....Q..........." .........2............................................................`...@......@............... ..................................d.......................T...P...T...........................................................h...H............text...\........................... ..`.data..../.......0..................@....reloc..T...........................@..B............................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...T.h.r.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Transactions.Local.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	354304
Entropy (8bit):	6.6013931036352815
Encrypted:	false
SSDEEP:	6144:EmI2kEE3tXeFy3CGaBSnFvg5PFQ5PEhsEhk7i77OkFGqyOXXvzW+/OMV6/OOPGC+:EX2a3tXeFy3CGaBSna5PFQ5PEhsEhk7B
MD5:	71204CF324D0B76252936AD774063E58
SHA1:	759FEE733FBCBF5A66523F2023291D30D28EDB90
SHA-256:	A5DD46C94E8A92E2542143494360AB198DF8446E62642613FBD62A9DC7F8C835
SHA-512:	709C3F2FC1990EC9EE1A5B5EF43B2EB6EB4CA1DA0CB2E17EE4405AEEE2B94D4412F114F7A8D3657A7E2F0648673BD87BC861595483CA3409D66EF699CB3F4A9A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...K.W..........." .....`...................................................h............`...@......@............... .........................................L,...........`..........T...............................................................H............text....^.......`.................. ..`.data........b.......b..............@....reloc.......`.......`..............@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.r.a.n.s.a.c.t.i.o.n.s...L.o.c.a.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Transactions.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.073845929514683
Encrypted:	false
SSDEEP:	96:G/vCluv6lUABcDhlNHl+3RaUgDmDsD50UWzliW:GS/UABcDhlNH43RP61WzliW
MD5:	F4B0D7BFF530B30BC753A119573C4DC8
SHA1:	E3B7E0EB2ABE329654DEEE21F14D6F6DCAAAE40C
SHA-256:	272687A9EB1170E0604B01278CED2C786A0897D85A85BC823A63AC1FB5905636
SHA-512:	768A4E2A13250FAA0F9E5A92DCC8BF65693373624DD4C7FB00CD1839F6089BF91B6F3BE6348BC10D6D9C32175C76497D98F647347743CE192174E320836DAD02
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9............." ..0..............-... ...@....... ....................................`..................................-..O....@..x....................`.......,..T............................................ ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................-......H.......P ......................@,......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................$.....3.........0...........D...........o.....*.1.....1.....K.....1...i.1.....1.....1.....1...P.1...X.1.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........C.....L.....k...#.t...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.ValueTuple.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.219839558375717
Encrypted:	false
SSDEEP:	96:Zcjls3Wy+UfgrRUoDmDsD+Dw3Wt7VWhW:06yhObk3Wt7VWhW
MD5:	0A3ED751E3517CA7671C59549F3FFC35
SHA1:	4998C769869EFC7566FCCEDBA95231CB5571C37D
SHA-256:	944E374F2AB5DF41AAC853448D48089ADEE20C8F1F2AC4AF74DF76599895E179
SHA-512:	9E92E22E4D11F39B74117237CD4E070E01EFC44B808929B2D6E9829CA9875A21FFB32CB4BE85D541CBF17951965073DAFD4A53FCE80259D7E0C9407E91969939
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....QX..........." ..0..............)... ...@....... ...................................`..................................)..O....@..h....................`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................D(......................................BSJB............v4.0.30319......l...,...#~..........#Strings....d.......#US.h.......#GUID...x...\|...#Blob......................3......................................E.......................z...........+.....b...Q.b.....[.....b.....b...4.b.....b.....b.....b.....b.....i...........t.....t.....t...).t...1.t...9.t...A.t...I.t...Q.t...Y.t...a.t...i.t...q.t...y.t.......................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Web.HttpUtility.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	6.478057561088385
Encrypted:	false
SSDEEP:	768:qDuC//xJPDt2GN/nK92QWMrbbuBM7BWs3GXfXSXEmDZ4rWI6i:qDuYvBfVNKbbGm0WGvCdWa
MD5:	F446FF3DD000C4C274CD284C5C20C99B
SHA1:	BA20750970D77353E09B6AD277E057D794442E08
SHA-256:	9E1D3BD379B8A23E3D0B9168B2E732EDBE872CA33B82192A4BB357CA05E9BCEC
SHA-512:	15A46F9B698F50213578C7AA3CC0D6E86074E0E31D4136B8509538E313D168A4CD349BE85D6152A42AAEB6D89F2FB327D0DDAD8FD473F4E0BFFBBA08D0597BF0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...Gf..........." .....r...$............................................................`...@......@............... ......................................t~..........................T...............................................................H............text....q.......r.................. ..`.data....!...t..."...t..............@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.e.b...H.t.t.p.U.t.i.l.i.t.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Web.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.73122352605951
Encrypted:	false
SSDEEP:	48:6GB+lZ5uO0lzMeMyadCcxL+Iv+KXks9P6zDmDiZDcswS7zEZABHZWhTKaob5WmQK:yy3lNlixvjUskDmDsDTv7z+CWVvo9W
MD5:	2EFF15E08F2261AE7754F989A69AD999
SHA1:	FDF653A91FB1EB85E0262F069D61DAF12B8F9F49
SHA-256:	FCF64B46C66B804FC1C2561553B70FD3EF7ACF6A6C8E9F67EF0E03A0FB157113
SHA-512:	5F1A4046A97743DD86010B91E6D276FA927417789B8CE4186A4CA35E94950239304A918A9CFCE5DD5E79FB5E478FE988472A65AFD05D5CC3A1915D354056C2C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6..........." ..0..............(... ...@....... ....................................`..................................(..O....@..8....................`.......'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B.................(......H.......P ......................H'......................................BSJB............v4.0.30319......l.......#~.. ...D...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3............................................................>...........i.....$...........T.....j.....9....................... .....R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Windows.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.884953040905424
Encrypted:	false
SSDEEP:	96:DIlG6LyMahlogigEIxvjUUDmDsDweHBWElSW:UUEaHtjxAjmWElSW
MD5:	847B00DDA2C28116D46A8F999717EBF2
SHA1:	28380AD5CDACEDDC3EACA1E7E1AF067C95BB9495
SHA-256:	4830C1FAE23A384BFD43E445260655B6FD6863A87BA930A726FB7330E0BA3E64
SHA-512:	5D0A0556B3027F5B36465FCF237B2D2ACA47C491FF6A01B8555895BD1A1D2F5FF1C6A57078F29DACA1E8913FDD954F7C3ABB9D8B26E7F34E4E7FF435BA8CA520
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ...@....... ....................................`.................................M..O....@..X....................`......t)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...(...\|...#Blob......................3......................................X.........U.............................y.....7.......k.................................u............. ...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.Linq.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.7762859354743266
Encrypted:	false
SSDEEP:	48:6hLbQ5IKlupbxWUMadCBI4KXkjP6zDmDiZDV8pZ9wkgZWUUKSk5WmQK:JIKlup1WPlSNUWDmDsD+velW1H4W
MD5:	415AF166D5E3D9ADFA7DDE1AB026BA1E
SHA1:	E5F67288F867EB591C5DFD4F32A67CA19A6DCC95
SHA-256:	13947D5628E32378CF22715EE7AC100FA4FA0CE3C7F69105BD524DAF83AFCB61
SHA-512:	D5014ABF669A36D84ADF6B6B9E1E71488197C3AFC9D199B10FA5DE654D3E93CC41332153DC7685D5C475B8748AE0605CFCB872138D7DF41FF7FC02655E8F5E99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............>+... ...@....... ....................................`....................................O....@..X....................`.........T............................................ ............... ..H............text...D.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................+......H.......P ..@....................)......................................BSJB............v4.0.30319......l...$...#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................L.............................p.@.....@.....,.....@.....@.....@.....@.....@...l.@.....@.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........:.....C.....b...#.k...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.ReaderWriter.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.487137055734802
Encrypted:	false
SSDEEP:	192:hWPE1VEB5q9W+4cgPy67e0O4FCofdxpW1/AW:71G5qkxK67ex4FCCpW1/AW
MD5:	DD0DEFFCE8B880BFB6796C27C5ACA34C
SHA1:	5B513DAD745BC1473D11EB512D5B509FA17EFE72
SHA-256:	4F423716C472FBACAC3846069AC37EAF3E82B6C057BBFFEAA5B99A8CC38B2D4D
SHA-512:	BBFE788C432D295A1AEE918A070E9D678BFC6EC40E9336D6A1B3BB8CB58E0C1938A89A934D7F01BD8D0BC3B2642A4EE4BF257DED67BDA85CFE1E912A4BB963EC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M.O..........."!..0..$...........B... ........@.. ....................................`..................................B..L....`...............................A..T............................................ ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........ ... ..................P ......................................................................................................................................................................BSJB............v4.0.30319......`...\|...#~......8...#Strings............#GUID...$.......#Blob......................3............................................................G..... .......b...-.....f.......i.......................................[...............................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.Serialization.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.784444384389591
Encrypted:	false
SSDEEP:	96:IR8luA9tWsbkUuDmDsD60BLW7MaPEqHW:Y8V6Ch+LW7MIEqHW
MD5:	7086A6C42E41477F26FE4303ECF78B04
SHA1:	A39684AC1F73DBF0C71194C7E230A2A94F615E98
SHA-256:	109921FA078E1B22F6492000EA13AB9DEE3EF9F187103A2E224A79C4DDD969D1
SHA-512:	9FD935F16A117E232E5C275B2F36A93D02E042C62552624C1F6536340368241DEA9A7D80071EA85694C2200347599DC9F11C815316F69AE018FED916737CECCF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2............." ..0.............N,... ...@....... ....................................`..................................+..O....@.......................`.......+..T............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................-,......H.......P ..<..........................................................BSJB............v4.0.30319......l...4...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3......................................".....................X.................._....._...B.?....._...'._...Y._....._...3._....._...l._.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........:.....C.....b...#.k...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XDocument.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.123441933313115
Encrypted:	false
SSDEEP:	48:6aLotzMtR8Fc7UyakCpAsK+IvWX0ONP6zDmDiZDLFYW/jedZQYynZWnTjKh75WmJ:EfyMqpxvWODmDsDLGWibQdW/QdW
MD5:	F75FCBE951CDEBAAFA125492AF4E1146
SHA1:	609FFBBA433911568DCF4BA5F102ADC9E39BFF8D
SHA-256:	2EA5CDB51DC444CB615E60E3EEDBD88D493C4FFDBC2C22D57FE40D75E0491853
SHA-512:	D160EE93B16D36DB01AEAC0A77FB34C655E4512BF2AAE3E4B7FF8DF60CF7D419F5C70A5AED04E643F70251B803AC0DF1958573126B0093787B2455A31E0F2F21
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....N..........."!..0..............+... ........@.. ....................................`.................................y+..R....@.......................`.......*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~..d.......#Strings............#GUID...$.......#Blob......................3................................................L.............................p.L.....L.....8.....L.....L.....L.....L.....L...l.L.....L.............................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XPath.XDocument.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32+ executable (DLL) (console) Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.35388622521183
Encrypted:	false
SSDEEP:	96:sehW0heW2q1rqVR3eJ5zYxvmoDmDsDqTz:jW0heW2qUV5eHYx8T
MD5:	EB9B9176263C182765835FD575691519
SHA1:	E50250EE079110BDE8E07E94DD6F35C5A4B0545C
SHA-256:	E1342830C83BD57E0858939B4651781D7F144F59A3F857C9AF738157CB877674
SHA-512:	C92B0BD7B9626723E5EFB7E0ADD2F520B6F2C4609E69D2E02B4AE924DB5C021C6C0D12B13E213B6E3E7E3B13B1FD0FC3353D29937FA375FA20DD6DE9ABD3DD05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE.. ...a............." ......................................................................`...@......@............... ..................................................................T...............................................................H............text............................... ..`.data...2...........................@....reloc..............................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.................n+..........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...X.m.l...X.P.a.t.h...X.D.o.c.u.m.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XPath.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.966508413450255
Encrypted:	false
SSDEEP:	48:6dc5gK/T8mnv0Gij82akCEeUW+IvWX0EjNP6zDmDiZDdPvZwIWNZWvJKQSx5WmQK:0uHxLij82MZJxvWfQDmDsDDwIMWB2vW
MD5:	52CC539F95DA2B628E8B172708D85AA1
SHA1:	4F30E60D93A1091A7FFCEE6CB02F9F386200A12C
SHA-256:	4C3E7361B2EBF59ABE9362D60C21E10846BB5D1B15AAF49DE642CD1785428474
SHA-512:	8E4A5930C50CCF7D05EC71755D8722A13AFCB4A82B9D7AE09C61839FD3AAEF7F882480C55F19B2893EC4A1278FCAA9B181A9066FA9371296A834B030440A32D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...03..........."!..0................. ........@.. ....................................`....................................R....@..h....................`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................*......H........ ......................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~......\...#Strings....P.......#GUID...`.......#Blob......................3......................................'.........C.............................g.{...%.{.....d.....{...\|.{.....{.....{.....{...c.{.....{.............................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XmlDocument.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.071246315019028
Encrypted:	false
SSDEEP:	96:30laIyQxHUi6xvjUdgDmDsD1Jw14WA9bnPUW:kYexl6xAdl14WA9bnPUW
MD5:	E3315C821612812F16FB80E1FC1EA21A
SHA1:	C948170C53F8C726E6CF1E5B78945DB9E74F5170
SHA-256:	5B756D7F2FD06ED7EE3F920D0CC3D7BA137AAFC68BB33ABC4A46B4DBBF332485
SHA-512:	80628C2806BF3C3040F0792B392EB0F71898BB9B931E93A67DDAA48C5E5AC2E3DDE4BCB835AC20C383416E54374DFA49F8647884E141243781415E4BA95C2F3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}............" ..0..............+... ...@....... ....................................`.................................A+..O....@.......................`......X*..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................u+......H.......P .......................)......................................BSJB............v4.0.30319......l.......#~..8.......#Strings............#US.........#GUID...........#Blob......................3................................................P.................<...........g.~...2.~.....1.....~.....~.....~.....~.....~...p.~.....~.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.:...+.P...3.f...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.XmlSerializer.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.32439821897926
Encrypted:	false
SSDEEP:	96:QGmcwjUh464LNNik5IxvW6DmDsD/BfGWpa1vW:Q13ohYBNTWxdeWp2vW
MD5:	9DACE73970B1140DCE89C50BE93157D3
SHA1:	39635DD19793E89DE596904CC263502F23E20B69
SHA-256:	B271DA95A5B7F2873649862DB8A65BFEEC3816F31D261A4A330ADCC64CDD00B6
SHA-512:	1EC012502EF4D75331B51DF5884D55A0B8787AC32388781609FD7CBADC9DED60F0BEE33BE74EB7141FFE8E4B9DED923675991D78D337A5E15A80A1C9E1795A40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q..........."!..0.............^3... ........@.. ....................................`..................................3..Z....@.......................`.......2..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@3......H........ ..4...................P ......................................................................................................................................................................BSJB............v4.0.30319......`.......#~.. ...p...#Strings............#GUID...........#Blob......................3................................J.................................+.....F.....H.....N...............................................................................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.Xml.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.461198258075189
Encrypted:	false
SSDEEP:	192:PNl85jxIpwwvB5u9LBpRc//Y8bcLN8yGafRskmMWKvjsW:85FIeq5ufyw8bcB8yGVtMWKvjsW
MD5:	41E20670F6E98A78F865F80A9C48AFCD
SHA1:	3CAF378ABC8787E4995F38D173BDBD9EB0AC08CB
SHA-256:	73355A6686E069ED409517F9D714D8E8C51306B0D727D7D219150651D8BA6B98
SHA-512:	817934972E42228CC1E4A749FCEB6ECF59E1D225A2E639F27D80D4349C99A54E27A485CDF54F297C2B65728C21E6FE21CB0A4D84489C89CB6931764F0AB33740
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...E............." ..0............I... ...`....... ....................................`..................................H..O....`..8............................H..T............................................ ............... ..H............text...0)... ...*.................. ..`.rsrc...8....`.......,..............@..@.reloc...............2..............@..B.................I......H.......P ..4'...................G......................................BSJB............v4.0.30319......l...x...#~......X...#Strings....<%......#US.@%......#GUID...P%......#Blob......................3..................................................................S.....:.y...<.....O...................................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........:.....C.....b...#.k...+.....+.....3.....;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/System.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	4.906204991432642
Encrypted:	false
SSDEEP:	384:sTWvvVUai8offaJUz8Ki5DN+tKyFg0kUL1HGGgzG5RxVbKL2u2502zq1TXzrtwRr:KcUxA2Zi5wRNn5LVb0U502zq1Tntuk
MD5:	A1551FAE988E82B29C266873515CE8DC
SHA1:	9C18B93B4CBF4A382D631BED5B41CC41FE1C393F
SHA-256:	C647906EDD2019F829F533415ED1DE19A735049D1EF8C9F0FE11E3886F318453
SHA-512:	4A828503DBA6FE33FF18054174D9CC6F51CBC4AE2DB2772CEC7F55FD5B957966563F5505E581FD1E5ADEDB369FA9DCBAE18A4E01A188A300DA54D7EAAF007E83
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]..........." ..0.................. ........... ....................................`.................................A...O...................................x...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................u.......H.......P ..............................................................BSJB............v4.0.30319......l....:..#~..T;..4R..#Strings............#US.........#GUID...........#Blob......................3............................-.....................\=..\.\=.....<..\|=............; ..2.; ..T.M.....==....==....; ..9.; ....; ....; ....; .. .; ..P.; ................M;....M;....M;..).M;..1.M;..9.M;..A.M;..Q.M; .Y.M;..a.M;..i.M;..q.M;..y.M;....M;....M;......[.....d.........#.....+.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/WindowsBase.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.143646083216824
Encrypted:	false
SSDEEP:	96:t2clLwtmaITQxoogifQlMQyYUDTpFUADmDsDNu+iWVrcW:JytmaITFWQlMXDsKudWVrcW
MD5:	7F38FFEF26995B279F5BF0A25CA1B0C8
SHA1:	F6BE99E69F5AA8513FAFB1B646C09CC2B63ABAAB
SHA-256:	58FFA7DE24D5460BAD8045E8D38EB7B132BCCE99667A1EE1A1681D200E160FBB
SHA-512:	E1F1E49C1FD353DFFB5AC5F0E65894D7B5BE3307ED0AE9FB090FD257172784539AAE212558B490BFF246F7A6F7B9191B93519CA2B09F3EBE8995A77E896C5A07
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..............-... ...@....... ....................................`.................................K-..O....@..8....................`......x,..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l...p...#~......8...#Strings............#US.........#GUID...(.......#Blob......................3................................................................................r.....r...Q.(...g.r...6.r.....r.../.r...L.r.....r.....r..... ...........u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u...y.u.......................#.....+.C...+.Y...3.o...;.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/createdump

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|PIE>
Category:	dropped
Size (bytes):	206016
Entropy (8bit):	4.86475099116289
Encrypted:	false
SSDEEP:	3072:KRhwVyw+Ixh2Dut1SpkveW3e5CuGik6+2:IhwkZnie6e5CuGik6+2
MD5:	547B93ADD2AFBF7BCC5C7EA4E0F17979
SHA1:	53EDC3E0F05F42DC8C44C7DA8714E5E1BCA5D2A7
SHA-256:	E35674ED581AF6EA01904C803AF10CD040746CAF0BB9C421B62D00BC9688964B
SHA-512:	CA3D15D63F853DFD5740DFD5373B0AFB7EDA3C0F7A127BDE950EA1DF4922E27F3FC80CDAE3960FE22E3125585F2BD9F38EED52866FEC5B9B7091ED010D13C919
Malicious:	false
Preview:	..........................!.........H...__PAGEZERO..........................................................(...__TEXT..........................................................__text..........__TEXT...........H...... ........H..............................__stubs.........__TEXT.......... ;.............. ;..............................__gcc_except_tab__TEXT...........<...............<..............................__const.........__TEXT..........pF...... .......pF..............................__cstring.......__TEXT...........X.......".......X..............................__unwind_info...__TEXT..........,{..............,{..................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST........................................M...........__mod_init_func.__DATA_CONST....................................................__const.........__DATA_CONST...........P..............................................__DATA..................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Globalization.Native.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	171840
Entropy (8bit):	4.321040554161497
Encrypted:	false
SSDEEP:	3072:k99TMikE04VIfecZ18GEy82BvhrwF3BHVyECICURjBEOBXlXxv6ImIip/8SEOrVH:Y04VIWfqXrd6/x6We
MD5:	ACC6372FC48D5704A459218038E1E85B
SHA1:	F0610296CE22DDCFEDE3A1A072EF325D4AF840A1
SHA-256:	9022587BB4181302ACDCDD86B185DF620C7C722B8FEA05D2F20A4790A95DE9BB
SHA-512:	BE15AC704F04AD717289503BF28844C797A828B56E2E7F0F54CB2C8BB054CC2E6B0D12C514B1098EA800B3C27C2F4BCC3B14999F2F4CC4E6BFE61BC9CC11CA94
Malicious:	false
Preview:	....................................(...__TEXT...................@...............@......................__text..........__TEXT..........pD..............pD..............................__stubs.........__TEXT..........7$......x.......7$..............................__cstring.......__TEXT...........$......I........$..............................__const.........__TEXT...........:......L........:..............................__objc_methname.__TEXT..........L>..............L>..............................__unwind_info...__TEXT...........>...... ........>..................................8...__DATA_CONST.....@.......@.......@.......@......................__got...........__DATA_CONST.....@...............@..............................__cfstring......__DATA_CONST.....@......@........@..............................__objc_imageinfo__DATA_CONST.....A...............A......................................__DATA...................@...............@......................__objc_selrefs..__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.IO.Compression.Native.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	920624
Entropy (8bit):	5.89450487227591
Encrypted:	false
SSDEEP:	24576:FSilAYmFJsFrFVd9vFxZd9F1t1pFJBA3iAmZfRy:FSilAYmFJJGZy
MD5:	2A02F344281B7465E6F91BF6065EBA11
SHA1:	F267AC61A466B63DC4185C56338B18E1B3AFF503
SHA-256:	E7420FDF633D76309CA9079FC378A4ED2EFB1D4BC33955A686ED43840F130E9F
SHA-512:	D2676DFAEE6BB8F891B70570A80CCA6CF6A4E2A6D46CFFB6671634D7B76F4DB95169713DC7A8D36DF1EAE5D9A01A3D355B45C9FF64E0AFE29224C3848CB9C3E5
Malicious:	false
Preview:	....................`...................__TEXT..........................................................__text..........__TEXT...........%...............%..............................__stubs.........__TEXT..........g.......~.......g...............................__cstring.......__TEXT..........................................................__const.........__TEXT..........................................................__unwind_info...__TEXT..........`...............`.......................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST....................................................__const.........__DATA_CONST............ ...............................................__DATA...................@...............@......................__data..........__DATA..................M...........................................H...__LINKEDIT.......@...............@......0...........................H...................@rpath/libSystem

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Native.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	160432
Entropy (8bit):	4.173734697331538
Encrypted:	false
SSDEEP:	1536:gyYgGNEA51hW8gT4RaAc8ASr5inN7IhEEpGHGK:gB6AzhlgT4Re8JrYnN8hEEpGm
MD5:	E7A6F9370172F6E7A74862B69999B7E1
SHA1:	D2D09177A3C9FB94D6F050029A308D47C96E8F42
SHA-256:	073B9B5ACF5C0B13DBBC86AD614316852812831C6355B7EBE982639F96BD2787
SHA-512:	1BBDC3ADA7AEED1A837C5C31A666DE4B8DB8C12CA98B4EBAD223777392B107FD9D14820FDF299BE521B99456CA6777C9A0A1E3FE33353CDC1F0DD22415BB3711
Malicious:	false
Preview:	....................................(...__TEXT..........................................................__text..........__TEXT..........0=......=.......0=..............................__stubs.........__TEXT..........m...............m...............................__cstring.......__TEXT..........{...............{...............................__const.........__TEXT..........................................................__objc_methname.__TEXT..........H...............H...............................__unwind_info...__TEXT..............................................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST....................................................__cfstring......__DATA_CONST............ .......................................__objc_imageinfo__DATA_CONST............................................................__DATA...........@.......@.......@.......@......................__objc_selrefs..__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Net.Security.Native.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	86256
Entropy (8bit):	1.8724937879132915
Encrypted:	false
SSDEEP:	384:Tw+Z3Sm+qGhdPjh6r+Q8/rpRr7rkxrNab8erP:Tw+ZimJG3Vg80ab8
MD5:	055CE11DFDCEBD4367C37F16348CD902
SHA1:	8B669B4C38E09AC94EC768483BA1843E9F48291A
SHA-256:	6CD0F92169A52D5B898CDFB425405EB180C8F1526FEED06C83F2BD5020F88719
SHA-512:	2AB485BC9B77A9AF32FB32A35934D87DE4A5B0827AF7215F3908D31B6B7BE67D442FB957250B9B9A39C0CCC92C58DD51DC1619B0E31EA4BDEB4053677B300788
Malicious:	false
Preview:	....................0...................__TEXT...................@...............@......................__text..........__TEXT..........P7......h.......P7..............................__stubs.........__TEXT...........>...............>..............................__const.........__TEXT..........P?..............P?..............................__unwind_info...__TEXT..........`?..............`?......................................__DATA_CONST.....@.......@.......@.......@......................__got...........__DATA_CONST.....@...............@..............................__const.........__DATA_CONST.....@...............@......................................__DATA...................@...............@......................__data..........__DATA..................M...........................................H...__LINKEDIT.........................................................H...................@rpath/libSystem.Net.Security.Native.dylib......"...0...........................................

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.Apple.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	166368
Entropy (8bit):	4.277854247880567
Encrypted:	false
SSDEEP:	3072:JvzZ63/5U5DlCPUcIhCWFRoniP6j+spqTN+P+:JFO/m4scIhCWFRoniP6j+spqTUP+
MD5:	8BB5C2CD0ADE70F16F27F2AAEF767AE7
SHA1:	609AAC4239B16901B5D9048AA123C53554A6F127
SHA-256:	9243D5C30E22AEFB8AD35633A130C91EC98109CB40F341A1859D2DA6069FDE84
SHA-512:	B065812FD1E04A67E6C44FFC2D30C16439B4ABC6CDE66CB2215F0BEEBACF198CE18D2E8A0F7BADDC3487992C15E930C298A79AC904CCE957622C810BBEC6502E
Malicious:	false
Preview:	....................................(...__TEXT..........................................................__text..........__TEXT...........G...............G..............................__stubs.........__TEXT..........................................................__const.........__TEXT..........................................................__cstring.......__TEXT..........@...............@...............................__swift5_typeref__TEXT.................. .......................................__unwind_info...__TEXT..................................................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST....................................................__const.........__DATA_CONST....................................................__cfstring......__DATA_CONST....`...............`...............................__objc_imageinfo__DATA_CONST............................................................__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libSystem.Security.Cryptography.Native.OpenSsl.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	266176
Entropy (8bit):	5.226409294451243
Encrypted:	false
SSDEEP:	3072:ig24OtYM4X7oPNkgRH76b5ZYvXF/STwU1QTlzi:t9Ot14kGbg1+Ul2
MD5:	05D5519C5E07D8015376C62EEE7E4F95
SHA1:	875D84B5BF9B54F3A67456A43FFA066EA3D6708A
SHA-256:	F0F896D117F74754F91B378BA809107B05612F6545D60B958A30F43FA06341AF
SHA-512:	0A85038D482462AB0D859CA946ADE202912DF9C87695BD65CE0596BEBDF615AA0BE016093063893CAC5AE3E62C3FE6A1295232C3907D5DC91BF83E897A49C40A
Malicious:	false
Preview:	........................................__TEXT..........................................................__text..........__TEXT..........P&......eQ......P&..............................__stubs.........__TEXT...........w...............w..............................__cstring.......__TEXT...........x......w........x..............................__const.........__TEXT..........................................................__unwind_info...__TEXT..................x...............................................__DATA_CONST.............@...............@......................__got...........__DATA_CONST............(..........................."...............8...__DATA...........@.......@.......@.......@......................__data..........__DATA...........@...............@..............................__common........__DATA...........A..............................................__bss...........__DATA...........P...... ...........................................H...__LINKEDIT..............

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libclrgc.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS>
Category:	dropped
Size (bytes):	967072
Entropy (8bit):	6.337552282019723
Encrypted:	false
SSDEEP:	12288:WC1Q2CB+NHfZVpuvfltr2rWv3ReBEPBjMcec07lsuPxMr86J:B1Q21Pq6Z0Bjfe0upMr86J
MD5:	1074967F156355B6BDFF673E2E4D9D07
SHA1:	4C48AF31ACE364CDEE17BC5F0BF928B8CA3198E3
SHA-256:	02AD85E23969788E00DE50F09398691C241F114F1BD4E156B223F7411F2C8AAD
SHA-512:	0147F6D645730423F6954DC66AE9AC8311BBD4700828D282A76B4FDB5A05478C1917CE45961BF788F13F45F7AD06C1D54FA4F867E21E23FAF7F94A4ECD95EE3D
Malicious:	false
Preview:	....................................(...__TEXT..........................................................__text..........__TEXT..........pN.............pN..............................__stubs.........__TEXT..........2...............2...............................__gcc_except_tab__TEXT..........................................................__cstring.......__TEXT..................w.......................................__const.........__TEXT..................x.......................................__unwind_info...__TEXT..................x...........................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST............`...........................H...........__mod_init_func.__DATA_CONST....`...............`...............................__const.........__DATA_CONST....p.......p.......p...................................8...__DATA...........@...............@.......@......................__data..........__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libclrjit.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	3153840
Entropy (8bit):	6.510177971581124
Encrypted:	false
SSDEEP:	49152:D1fmNFTfKFdXhCoMDdmXYv3IRGq9by+YUFVGZBeOiVk1HyAFcv:5fmNIFdgoMDMU4RGKyMFQZBYVku
MD5:	0014FA47944FA96B9169C8E7FF80BFC9
SHA1:	D2C55202810C79683DBEF07E1EC26C83CB174449
SHA-256:	3C819BBB12F95FB1CB230BB742E5CBA1B0889C65DA331B59653A65BED80AE9A2
SHA-512:	1A39EFA9BC4FDACEE9B78295DB3BBC160915CB897E18FB73EA696D63910CECECD8B3E123DF93AB01B0BA825C3C62229EAD499CA85C246B69D98117D53AC014B6
Malicious:	false
Preview:	........................................__TEXT....................'...............'.....................__text..........__TEXT..........@\......jx#.....@\..............................__stubs.........__TEXT............#.....H.........#.............................__const.........__TEXT............#...............#.............................__cstring.......__TEXT............$...............$.............................__gcc_except_tab__TEXT...........r&.....h........r&.............................__ustring.......__TEXT.......... .&......7...... .&.............................__unwind_info...__TEXT............&......6........&.............................__eh_frame......__TEXT............&.....H.........&................h................8...__DATA_CONST......'......@........'......@......................__got...........__DATA_CONST......'.....8.........'.............................__mod_init_func.__DATA_CONST....8.'.....`.......8.'.............................__const.........__DATA_C

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libcoreclr.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	6738240
Entropy (8bit):	6.551235627974232
Encrypted:	false
SSDEEP:	98304:AOzpyF6tM663Jh6dJZz9sxmgBP7BeOR8:K2/WDR
MD5:	CCE888B2661F2DC3668716D7B8BF4E2F
SHA1:	DBD9DCB6D7D87E7E1BA3E81BDE604070757517A3
SHA-256:	43DBDE84CD570C916EE59EA2F685D6CF3FA83E23A7D447279B8445E4CA5786F8
SHA-512:	9252A8765C0AEAEF108F723F61CABF0C3B6154C9BCCD2108568AFA21D91596EDE92171B3720B0E0D00DF4F0C59E5327BA07B6EE7F1B4A2096E01187C52AA7F33
Malicious:	false
Preview:	....................p...................__TEXT....................K...............K.....................__text..........__TEXT...........0.......sC......0..............................__stubs.........__TEXT..........B.C.....>.......B.C.............................__const.........__TEXT............C.....l.........C.............................__cstring.......__TEXT...........D.....4........D.............................__gcc_except_tab__TEXT..........$.F.....\=......$.F.............................__ustring.......__TEXT............I...............I.............................__objc_methname.__TEXT..........p[J.............p[J.............................__unwind_info...__TEXT...........\J..............\J.............................__eh_frame......__TEXT...........mK.....H........mK................h....................__DATA_CONST......K...............K.............................__got...........__DATA_CONST......K.....0.........K.................5...........__mod_init_func.__DATA_C

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libhostpolicy.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	446144
Entropy (8bit):	6.042123254097315
Encrypted:	false
SSDEEP:	12288:LHTECRhfO4aB9SqLF8ZNPjOZndRMPkuEU5:bTEm2VBwqGZNPJkuEY
MD5:	E5E1A75798BAA6AABFF962CE5350AD3C
SHA1:	CECEECBED8F021D5EB4B4C74C688EEDB9FA2FB65
SHA-256:	270510B5C291FD9DB3722BC9405F57D09D1EA5AD70804D03F7A72D4A7BBE9044
SHA-512:	ADFEA573148B129402719596C44FE9C7907E273D082B11CDF647CD2C1E000F6BCA9DF797A4DE60F011186AA787FA135B6E012FC1FAD28E96A859686F1E024221
Malicious:	false
Preview:	....................0...............(...__TEXT..........................................................__text..........__TEXT..........@+......aQ......@+..............................__stubs.........__TEXT...........\|...............\|..............................__gcc_except_tab__TEXT..........(........#......(...............................__cstring.......__TEXT..........$........:......$...............................__const.........__TEXT..........................................................__unwind_info...__TEXT..........P...............P...................................8...__DATA_CONST.............@...............@......................__got...........__DATA_CONST............(.......................................__mod_init_func.__DATA_CONST....(...............(...............................__const.........__DATA_CONST....0...............0.......................................__DATA...........@.......@.......@.......@......................__data..........__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libmscordaccore.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	2445040
Entropy (8bit):	6.444282705924424
Encrypted:	false
SSDEEP:	24576:wQjmrBDQ7ZSOjBcYdpD6hXJrp/e5ujLg+Dt+uiucuDeh3PzxmuHsE:wQjW5Q7ZSOjBvDWXX/djs+Dt+3bxv
MD5:	4B322C70D6E02F3485D208889AA5EF87
SHA1:	4EB2DDC456F27623DDBBF3D2A2A2FB2881DD172B
SHA-256:	28CB25234D730AFD3E7C33D9CE81900E1E087AA114928E797FEFEA97368E8275
SHA-512:	D700963F8353C9AADB1B32C84C57FBA0C9CF3B3543E16B1B24B98B73CEBA8111E780EC405CCF59A58D0CC7F499CFDEDAF2438AFB2C05833AF13ACC39D490B074
Malicious:	false
Preview:	........................................__TEXT..........................................................__text..........__TEXT...........!......ZG.......!..............................__stubs.........__TEXT..........:i..............:i..............................__const.........__TEXT...........n.......j.......n..............................__cstring.......__TEXT..................\.......................................__gcc_except_tab__TEXT...................C......................................__ustring.......__TEXT...........:......p^.......:..............................__unwind_info...__TEXT..........P.......he......P...............................__eh_frame......__TEXT..................H..........................h................8...__DATA_CONST....................................................__got...........__DATA_CONST....................................................__mod_init_func.__DATA_CONST............P.......................................__const.........__DATA_C

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/libmscordbi.dylib

Download File

Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|NO_REEXPORTED_DYLIBS\|HAS_TLV_DESCRIPTORS>
Category:	dropped
Size (bytes):	1756800
Entropy (8bit):	6.418018969365482
Encrypted:	false
SSDEEP:	24576:K8XxjSngxqQWMyzKGbhh2DwR5rJlRs0gPf/EDq:K8XxjSngVyh2DwvjgHM
MD5:	E391FD0C68230AE9B266E85BA8B39C8D
SHA1:	D72E078C6972AAF87838662377C6703EB9FA74AF
SHA-256:	A20B3ABA95F1D12ADA3FBEA583ED26CA4A8351D5C8195F53277C83979384999E
SHA-512:	209C84DE8E7788ACAB6255EFFE9BFE8E4273FBA1F4FCB702FB7C16BB687FCC924C40551A88E664D8C1F4F73C7154F860417FB7A5424F601D7EDD39CB0A1A676F
Malicious:	false
Preview:	........................................__TEXT..........................................................__text..........__TEXT.......... 2......`....... 2..............................__stubs.........__TEXT...........)......H........)..............................__cstring.......__TEXT...........,.......#.......,..............................__const.........__TEXT...........P.......(.......P..............................__gcc_except_tab__TEXT...........x...............x..............................__ustring.......__TEXT..........p.......`+......p...............................__unwind_info...__TEXT..................O.....................................__eh_frame......__TEXT..................8..........................h....................__DATA_CONST....................................................__got...........__DATA_CONST....................................................__const.........__DATA_CONST............................................................__DATA..........

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/mscorlib.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	4.929357518798905
Encrypted:	false
SSDEEP:	768:4t51EDMpCUoqFY66Gw17oqZn/TEHmyrchswz6EEZcYf5o4ba2yGlG1QeY48lCi5:4tFcC3ZcYf5o4bZyGc1A4c5
MD5:	B7DF42F8DA8243167A671CD7DB807982
SHA1:	7D56F836EFC3DDBA77CD526F033B95F501D624F0
SHA-256:	FBBB0231DF2CC670D70D9771CC341E4F91FE037534817B8C2BDC52BDBF307923
SHA-512:	28A4A503BD4D1882E95D9D5FF16ABFFB7DFC9A8F1D33A659921E7A8965574DD4358BBEF62D37A7ED3604296940EA56BA68157C08F5880CBC935A4C1097A87367
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................... ............`.................................m...O.......(...............................T............................................ ............... ..H............text....... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B........................H.......P ..................... .......................................BSJB............v4.0.30319......l...$O..#~...O..(b..#Strings............#US.........#GUID..........#Blob......................3................................e.....b/........L%.O...).O....RO..EP.......+..:.:4..J$:4...&S0...+.O...%.O...(:4...&:4...":4....:4....:4..U&:4....:4.................N.....N.....N..)..N..1..N..9..N..A..N..Q..N .Y..N..a..N..i..N..q..N..y..N.....N.....N......R.....[.....z...#.....+.

/private/tmp/dotnet.DUZHkmnca/shared/Microsoft.NETCore.App/8.0.14/netstandard.dll

Download File

Process:	/usr/bin/tar
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	5.0932220853268335
Encrypted:	false
SSDEEP:	1536:PYsYXj0p2NYq5V4bgDHsPdIpuSE5L3Ukcz9wF:QMkYe4bgDUAxCF
MD5:	CC5BC921FB6963881BF191137F659C31
SHA1:	35C4826395DAE7DE4FABAC643A649AC69DBA1634
SHA-256:	6B0915EEF0015FD806B8A4EA24E63F45164A8C1AFEC4E6E7AD57BA640D9825D1
SHA-512:	B8A4A9D4450FF82D97BAE6EDAF0EAE212BED1CD82A8A990480D7DE9A5DAF0D59E5A48F076811FD76009F9C9A2EB02F7FFF73BDDD0A3EC18B6C19A895B35091E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K..........." ..0..X...........v... ........... ..............................XF....`.................................;v..O.......8...........................hu..T............................................ ............... ..H............text....V... ...X.................. ..`.rsrc...8............Z..............@..@.reloc...............`..............@..B................ov......H.......P ...T...................t......................................BSJB............v4.0.30319......l...`...#~..... ...#Strings.....Q......#US..Q......#GUID....R......#Blob......................3............................P...,......H.........5....:....'...m......,.@..5#.T..P4.T...7.J...B....i5....u:.T..n7.T..&1.T.....T.../.T..(7.T...(.T.............................)....1....9....A....Q.. .Y....a....i....q....y..........................................

/private/tmp/dotnet.apAJI0d8n

Download File

Process:	/usr/bin/curl
File Type:	gzip compressed data, was "dotnet-runtime-8.0.14-osx-x64.tar", last modified: Fri Feb 14 06:59:32 2025, max compression, original size modulo 2^32 72171520
Category:	dropped
Size (bytes):	30721387
Entropy (8bit):	7.996705576569949
Encrypted:	true
SSDEEP:	786432:jVOR4Mc4NEVadXBpPMjjCAPl7afu4S6cIL5PHDEm1x+:0CMc4NIuEe24uItPHY3
MD5:	01E2C1AF269617B53E52B74C9DD2F5D4
SHA1:	A0E956F5BE52895A41864C900725DCD7D43AEDE9
SHA-256:	A57719F0999C94E0EF62A043B1EEF495F2E263F2A2502EF25294B4C94FB42E6F
SHA-512:	110DDC273596770B1E638A7B2464B49C6ABE9BBCC1241E4447C949BA1D9AFE01E9564D9DE7485281B5DE2C6C22746D6156D2193332B8D212BFFA42DBBA54E831
Malicious:	false
Preview:	......g..dotnet-runtime-8.0.14-osx-x64.tar...\|.W.(..i.....[J.P.Me...n.6.,[J.Gm..+.cid......48..zo..K...R...[....i...4m..BS....t.R..[..%......H._.....K3s.<...}..vUo.v.e),+...a..kjj......]g.w....j.......Z1.E............W.`+}.!.W..o.....k.w......Y...uk.jj..kq.....k......\...E"..._..%.o...uk...;....^_{....N#.o......Z.7...{.<w..k..5o.......~Yl...hHN..X.....M..+.~M..U..v_....aI.&......dBS....TTA..b".WEEVeeP....SV.QU.W.../+r..H.M.;.".b2"..%.Ov.Z....dE......MD.}.$..7......5..$E.^H...E%.O.'Cz\Nh...hLV..............RL.&D\|f<...Z.R..0.......PL.c...h<.[.....TWa..O..O.....iX.zo,..;.pTe....$.;q..IET.XL....o.k.wT..>...8.T.3...$...]I@.2..N...[.w.x$..%.ph.d"....W.......i,...I.....0..U.H.`.{e.0h..+Y..`..ZT...I....&`L..'vw..l.t..@....qm...,..t.....-.....#B..O{..bG..i.^..hov...:.\|..bG..h...\|p/...nm........@..`9T..!b......+k.uy.p.....z.w.-..v....K.....wk..%vn.....A..Pm{....Z...{\...}..........................l...M>.gS...Ay..@.Sl..yZ}.V...%`1.;q....=

/private/var/db/.dat.nosync0295.Ai2DQE

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.982914434460289
Encrypted:	false
SSDEEP:	6:TMVBd/4o+tJCc4EyfdUdBRECcgtodAvbBvuIvHJBvVchZCvAMcvtNxTy:TMHdgo+tJVEdQiCXtogpuGvVchZcAPbw
MD5:	1759FC0756A06F64FB0A04EEB5A15C55
SHA1:	F7EFD9D46F441CBFAB640428F50F99FA4412049C
SHA-256:	97ECCE72E2D582806BB7852FF846DBF7B881112870C9B9EA43F8C31CD16529A8
SHA-512:	7552D8995140727C6C20CC691735EF5271DBBBB3E2CAD295AE500D5ACC9E60D0237601F89AB4843DD287A2BC0848A665CB0B6AE2AC002569EC40D59464365180
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<array>..<string>/Applications</string>..<string>/Library</string>..<string>/System</string>..<string>/bin</string>..<string>/private</string>..<string>/sbin</string>..<string>/usr</string>.</array>.</plist>.

/private/var/db/receipts/com.atera.agent.bom

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	Mac OS X bill of materials (BOM) file
Category:	dropped
Size (bytes):	45420
Entropy (8bit):	1.266770984543049
Encrypted:	false
SSDEEP:	192:k72wFm2pGWS9vFXMW/5vRTPPgun3cj/+kOmjG:K2mm2pXYvK05vRJo/Cm
MD5:	1EDE0E2BCCFD76A7195D49066E55D59F
SHA1:	A82C7EB8B78677FC7CDAB109725031252F37911E
SHA-256:	639DD93BE670FCC60D67EF953A97947C879A59EBAB8E6056B501010312B5216E
SHA-512:	DCD75737070960A0E620BB8CC0AF458E64A3DA06EA8C6020CF0B967FD46503BDD4344B35D8DF56FC35482E18A956BDEC25D2D82A897E76087580F2B7F9B44315
Malicious:	false
Preview:	BOMStore..........[...U...#"...<.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................nfo............tree.....................s...=...........................................................g...f...........%...$...:...9...................\|...{..."...!...........y...x...........p...o...s...r...F...E...........C...B...I...H...........m...l...................................O...N...(...'...............~...........7...6...@...?...................L...K...1...0...+...*...4...3...........R...Q...........................................v...u.......-...........j..

/private/var/db/receipts/com.atera.agent.plist

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.6423382708371195
Encrypted:	false
SSDEEP:	6:NPnjpAhVc6BJ71Er4LXe8laxDCH56rWCeADZA1yzLhgXcQf1unfA4RRgGzbVOXlb:TArLbA4SrDCHqWCeum1yzLhgXcQovlO5
MD5:	672881C81F1F9B854DFC5AB3841B1E8D
SHA1:	396F221B3FF8CC75C0C69B7E5620F8F6B37D51F1
SHA-256:	B63E8006BF158A6EDA52C38F7C63C680254FB60CFDB64F492D395FAD05397A0B
SHA-512:	0B6D58AD9B5F666FA1D3F82C87E415AE0A3410AA96E83ADCE1D602EBE780D7991834747AA613D275EC75121A143AF8F9E386895F6FFD706FD0BB266048CEEC51
Malicious:	false
Preview:	bplist00..............._..InstallPrefixPath_..PackageFileNameXPathACLs[InstallDate_..PackageIdentifier^PackageVersion_..InstallProcessNameP_..atera_agent-2.2.0.pkg...WLibrary_.K!#acl 1.group:ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C:everyone:12:deny:delete.3A..3..._..com.atera.agentU2.2.0YInstaller.....+.=.F.R.f.u.................................................'

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/mds/mdsDirectory.db_

Download File

Process:	/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533814637805397
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5:	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3
SHA1:	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C
SHA-256:	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
SHA-512:	1DC5282D27C49A4B6F921BA5DFC88B8C1D32289DF00DD866F9AC6669A5A8D99AFEDA614BFFC7CF61A44375AE73E09CD52606B443B63636977C9CD2EF4FA68A20
Malicious:	false
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/mds/mdsObject.db_

Download File

Process:	/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5:	D3A1859E6EC593505CC882E6DEF48FC8
SHA1:	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32
SHA-256:	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
SHA-512:	EA2A749B105759EA33408186B417359DEFFB4A3A5ED0533CB26B459C16BB3524D67EDE5C9CF0D5098921C0C0A9313FB9C2672F1E5BA48810EDA548FA3209E818
Malicious:	false
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Boms/com.atera.agent.bom

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	Mac OS X bill of materials (BOM) file
Category:	dropped
Size (bytes):	45420
Entropy (8bit):	1.266770984543049
Encrypted:	false
SSDEEP:	192:k72wFm2pGWS9vFXMW/5vRTPPgun3cj/+kOmjG:K2mm2pXYvK05vRJo/Cm
MD5:	1EDE0E2BCCFD76A7195D49066E55D59F
SHA1:	A82C7EB8B78677FC7CDAB109725031252F37911E
SHA-256:	639DD93BE670FCC60D67EF953A97947C879A59EBAB8E6056B501010312B5216E
SHA-512:	DCD75737070960A0E620BB8CC0AF458E64A3DA06EA8C6020CF0B967FD46503BDD4344B35D8DF56FC35482E18A956BDEC25D2D82A897E76087580F2B7F9B44315
Malicious:	false
Preview:	BOMStore..........[...U...#"...<.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................nfo............tree.....................s...=...........................................................g...f...........%...$...:...9...................\|...{..."...!...........y...x...........p...o...s...r...F...E...........C...B...I...H...........m...l...................................O...N...(...'...............~...........7...6...@...?...................L...K...1...0...+...*...4...3...........R...Q...........................................v...u.......-...........j..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_1P3fH2

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.7856513349781515
Encrypted:	false
SSDEEP:	384:FqksxsSQ3CVWtkGaWQuYSMkYpetyGBJWORfyRTlFwSQI7VhggdDygcWUQ4iYLEBi:FqH0yVIotetvBnRKRTrNn7V+gByboak
MD5:	EF1687B53BD798976C843CBAA9066F8E
SHA1:	8932CC0CEC3E9B79E02EF051541F7D10D247C022
SHA-256:	A0B6C860FA5BDB3F0EBE5C7AF709FC686A9AA575B616B706BD65A5D0C1FD4226
SHA-512:	55FFA5C101A31AF429DFF9129AEDA7F21624D8D3D71CC71E5130483E88F64C5E4C0ECE6E54175904658B4B5310FA14D41E0B6CB70B9D9AB0DE8BD2B13AED9F24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~............." ..0..j..........r.... ........... ..............................:.....`................................. ...O...................................X`..p............................................ ............... ..H............text...xi... ...j.................. ..`.rsrc................l..............@..@.reloc...............r..............@..B................T.......H.......H0.../..................._........................................-.r...ps....z.-.r...ps....z..s......o....v.-.r1..ps....z...s....o........0..V.......s.......}.....-.rA..ps....z.,..o......./...s....(...+&+...{.....s....(....&...(...+&....0...........-.rQ..ps....z.o ... ....1..{.....o!....{.....o"...t......,...{.....o!.....{..........(#....{....o$... ....3..{....o%....{......o&......,..('..............U.4.........s(...}.....s)...}.....s...}.....().......0..:...

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_20M9Ow

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27936
Entropy (8bit):	6.439499005095801
Encrypted:	false
SSDEEP:	384:Hxrv7hVmaET50kv96TG/FwzzRjz6qMvckxGMCWsfNWCx5kHRN78DuNNPR9zbKrQV:97hUaETSkXZp32No8D69zQGF
MD5:	E1F852E450395BD9CAD83625CA41AFAB
SHA1:	8A5C6332C4208E319E648C8850AB709C82EFE48D
SHA-256:	FEFCDB267A73099CB90E5AF56B5EF2BCA59BED974339B3A6810352BDE23537A6
SHA-512:	54FD5ACAA24C426B42AEE7B855B6614C9C1E2676D0F54683D4A2B059DB7C9BDA70988C6CEB43F488ABC34759F575CBDB75C3F0649CF932CF5FA2F53A66CF2881
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ya..........." ..0..8...........V... ...`....... ..............................j.....`.................................oV..O....`..\|............D.. )..........XU..T............................................ ............... ..H............text....6... ...8.................. ..`.rsrc...\|....`.......:..............@..@.reloc...............B..............@..B.................V......H........'...)...........Q..X....T.......................................-..(......s+...z..(,...,..-..s+...z.r...ps-...z..~......0..........(....,....(.....o.......&......................0...........(.......(/...-..,....(....,.r/..p......%...%...(0.....(1....(....,.r/..p......%...%...%...(0......(2....(....,!r/..p......%...%...%...%...(0.......(3.....,&(....,..r/..pr/..p.(0...(4.....(5.....(....,.r/..p......%...%...(0......(6...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_41tZoQ

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43680
Entropy (8bit):	6.298455087782778
Encrypted:	false
SSDEEP:	768:CKEGbmbB0QERF7v6EtkKS+1ke97a1O33ttBOP7yW5yfyqTuia+15OFyx/iCL9zRv:CpGe0QERFhkKSM7ag33ttBOP7yVfHTuu
MD5:	F45226E320F41097397B1BA7468C2D1C
SHA1:	1181845C7D16AC4C525EEC67EC3A6DCFAA78A433
SHA-256:	446FF16E903E7479558816E213A3ADEE9A1C1ADAD65A56D853801B10933E29D7
SHA-512:	417466F57FA8C6D942BE5D86B14DA5915D507DFBD7AA8D2700B4DD79A9668897A6A6ABAAB225BE45076BDB8D86CCF4777BB3C699B4002A081E4407604F4E2F87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7............." ..0..v............... ........... ..............................u.....`.................................?...O.......l................(..........H...T............................................ ............... ..H............text....t... ...v.................. ..`.rsrc...l............x..............@..@.reloc..............................@..B................s.......H.......d<..LP..........................................................~......0..........(....,....(.....o6......&......................0...........(.......(7...-..,....(....,.r...p......%...%...(8.....(9....(....,.r...p......%...%...%...(8......(:....(....,!r...p......%...%...%...%...(8.......(;.....,&(....,..r...pr...p.(8...(<.....(=.....(....,.r...p......%...%...(8......(>....(....,.r...p......%...%...%...(8.......(?....(....,"r...p......%...%...%...%..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_6lYypJ

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30480
Entropy (8bit):	6.3752259567419305
Encrypted:	false
SSDEEP:	384:tzVZvGPhQTlrYouEsdS+YlOjqm6t4BWOXURWNYA6VFHRN7wsjR9zDmEf:tP+5QqnHNfG8FClwsF9zTf
MD5:	8C79F5FBF8CE8EB2DD851DEA54735D1F
SHA1:	5AD81D2A8E2E0FA8D44A5438EDF9D834EC0517EC
SHA-256:	9864DBCFDBFE395BBD64DEEC7568FDAF0CBC3850F0CD8F53E7359189BD158082
SHA-512:	D4BB78FE5E191A9FBF42B1259D1267E205E5E59C3E6493EC18270DBFEEA30E0C617447EF67C2DF93E48BECA85F995C20A093DEB3A52DBCD4EE112001A708C069
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5............." ..0..@..........~^... ...`....... ...............................w....`.................................+^..O....`..X............N...)...........]..T............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...X....`.......B..............@..@.reloc...............L..............@..B................_^......H.......p..8/...........Y.......\.......................................-..(......s....z..( ...,..-..s....z.r...ps!...z..~......0..........(....,....(.....o"......&......................0...........(.......(#...-..,....(....,.r/..p......%...%...($.....(%....(....,.r/..p......%...%...%...($......(&....(....,!r/..p......%...%...%...%...($.......('.....,&(....,..r/..pr/..p.($...((.....().....(....,.r/..p......%...%...($......(...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_7xd8jH

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	JSON data
Category:	dropped
Size (bytes):	80444
Entropy (8bit):	5.061269785240325
Encrypted:	false
SSDEEP:	1536:5ty54YA04NQRmHrl40fYcUPCVgKgI0GYrhf:5ty54YA04NQRmHrl40fYcUPCVgKgI0GS
MD5:	F662B87E38AA9F2B007DD169D7E32BE3
SHA1:	506FE8EC3D22DACF4C7718B4420771BBE1348DAF
SHA-256:	219D0B0C4A1EF114456E99B4D76B651A1455004769EF8278A972EB780F2B80C2
SHA-512:	AC83EE6A667F49480E580EBDE9F93B62D8C9B80E86C07BCB1E0B3D33DFA6EDE8B7AAF6BC164C891C360602BFD28241E5DCD053EAAA03F847A5E86AE8C615872D
Malicious:	false
Preview:	{. "runtimeTarget": {. "name": ".NETCoreApp,Version=v8.0",. "signature": "". },. "compilationOptions": {},. "targets": {. ".NETCoreApp,Version=v8.0": {. "Atera.Agent.Mac/2.2.0": {. "dependencies": {. "Atera.Agent": "2.1.1",. "Microsoft.Extensions.Hosting": "8.0.1",. "Microsoft.Extensions.Hosting.Systemd": "8.0.1",. "Serilog.Extensions.Hosting": "8.0.0". },. "runtime": {. "Atera.Agent.Mac.dll": {}. }. },. "CommandLineParser/2.9.1": {. "runtime": {. "lib/netstandard2.0/CommandLine.dll": {. "assemblyVersion": "2.9.1.0",. "fileVersion": "2.9.1.0". }. }. },. "Microsoft.Extensions.Configuration/8.0.0": {. "dependencies": {. "Microsoft.Extensions.Configuration.Abstractions": "8.0.0",. "Microsoft.Extensions.Primitives": "8.0.0". },. "runtime": {. "lib/net8.0/Microsoft.Extensions.Confi

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_8V1EFz

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	348728
Entropy (8bit):	6.1936099512697345
Encrypted:	false
SSDEEP:	6144:uAE/zk4Ti/OgxYFWMZdNQ/0HQRYjFTs+LgPcue:i/R+/OgxrMeujvLecZ
MD5:	329FE2E4CF6181FF7B854100CCB20D20
SHA1:	6BD766FD05B42F9D087DB991190B6DD805DF3691
SHA-256:	7416EF9A6E5A0B5DE587438411CE8AFCEF17E240B26FA4C72C58821448E546D9
SHA-512:	10A9F40912CB69EC4A36CC8D0490C0B2994D1AE13DC37631D169DBDA0A98E1B0EBC24CAD2BC527FD86811AD21085D40C2D1A0A69C95AAFC61046B7307D3759FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E`..........." ..0.............::... ...@....... ....................................`..................................9..O....@...............&..8,...`......$9..T............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......`...D/...................8........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}......{...."..}......{...."..}......{...."..}......{...."..}........0...........\|....(....-...\|....(.....\|....(.....i3..\|....(.....{....-@..\|....(.........}.....\|....(.....\|....(.....{......{.....i(.....{.......}......,...,..s ...+.~....}......{....>..}......}......{...."..}......{...."..}......{...."..}....*..{...

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_9WjK8k

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64776
Entropy (8bit):	6.311554225434336
Encrypted:	false
SSDEEP:	1536:UahqHoZX+NmzYUGrCUidKHPhwMEbBolCixzZr:UYXfFGrCLQvhwME+l7tr
MD5:	18638600345307F00B51037BDF4374A1
SHA1:	E8FCA245A2B9A21589BFE18526C97C22939ABF1B
SHA-256:	5E01894CBC0661BACB8CA8F485A40D5EE4E02F28FEF58007668A0276431B4693
SHA-512:	6A15B951C71D03EA49677EF3BC4F0095CB78CF2180E2199422DA4497E3E3BC7004272E10AD4B2DFAD27948F4C94E843F9617BFE6DDD3FA5BCA4CD10BF1618B09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............." ..0.............Z.... ........... .......................@......2H....`.....................................O.......H................)... ..........T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...H...........................@..@.reloc....... ......................@..B................9.......H.......LJ...............................................................-..(......s-...z..(....,..-..s-...z.r...ps/...z..~......0..........(....,....(.....o0......&......................0...........(.......(1...-..,....(....,.r/..p......%...%...(2.....(3....(....,.r/..p......%...%...%...(2......(4....(....,!r/..p......%...%...%...%...(2.......(5.....,&(....,..r/..pr/..p.(2...(6.....(7.....(....,.r/..p......%...%...(2......(8...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_9trNip

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71464
Entropy (8bit):	6.267666995316433
Encrypted:	false
SSDEEP:	768:kwj0b9108ypuuQwXi+uYTql2csO55555+VfF4MMv0nrtrGvAo92h9Hxsk5hIvT2n:kk05uO2csr4UJGyh9Rth9RMiiqzh
MD5:	743B9AD9C66C2E44454B71E026CA50D7
SHA1:	FB2C2C366BB5C72E1B1E8CE2FFE8F7AB0B21F21E
SHA-256:	D42DA097BB5EF92A3EB9889726E5C231BB5D0D4CA7CA7132ED944514D52BEC01
SHA-512:	6B548F9D68FB049BFEF406FC252C282DDE1AAFE2110CA829BF8EAF400FE50C998D3CC57DD913E02028C157D4340D1600792754D6C0B8785D5534AEB3A4C4AB62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5............" ..0.................. ... ....... .......................`......PR....`.................................I...O.... ..P...............()...@......H...T............................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B................}.......H........Z.............P...x............................................-..(......s6...z..(7...,..-..s6...z.r...ps8...z..0..l.........~..........(9...(:........,.r/..p(;.......+.rA..p(;.....,..r...p(<...-..r...p.o=...+..+....(>...........&.........~........0..........(....,....(.....o?......&.................&....0...........(.......(<...-..,....(....,.r...p......%...%...(@.....(A....(....,.r...p......%...%...%...(@......(B...*.(....,!r...p......%...%...%...%..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_CogYNC

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.585942310781508
Encrypted:	false
SSDEEP:	768:oOTQws5P6l+m38DHBXLSycBHdDVXR/yx0PtmF4zx:VQVPW+gKZZcdXR6HG
MD5:	5C857C5926B0E7FCE94FA5301759E49D
SHA1:	477A1D5941D796E784FEB93CAAD41E54DB3AAC03
SHA-256:	FE02A7C70B0669B0E0449BF605D090BE868EFF0B11556DB3156EC3D9834C47C6
SHA-512:	EFF3D65BBAE69DE2F05167725924A8E63285A46B826B4A64E5A7C22C7E025441949C923FB8146CF83FAB5932748D479D285C29356317C6791C01FA449C64BF24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n:............" ..0..n............... ........... ...............................7....`.....................................O.......h..............................T............................................ ............... ..H............text....l... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............v..............@..B.......................H........;..PN..................D........................................0..,.............................................(.....0.............................................(.......0..(.........................................(.....0..&.......................................(.......0..S........-.r...ps!...z.-.r%..ps!...z.-.r/..ps!...z...s"..............................(......0..V........-.r...ps!...z.-.rM..ps!...z.-.r%..ps!...z...#...s$.............................(...

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_DdTQjp

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25248
Entropy (8bit):	6.510919949383382
Encrypted:	false
SSDEEP:	384:s/AAJD8hnUtgIKJ0F9lTAPRIrfWD5GvWOYA6VFHRN7yRG49R9zpVxX:+AQ864Jw9lwYTRFClqG69z1X
MD5:	DA1D9121971E73F60307667DFD13E63A
SHA1:	1BC2D101648BA91A65C048ACFC1A2315752E91EF
SHA-256:	8452B6B513467A2112C921EDFAD1AB22A6BBC3F86F121954F71FC5D80A72A530
SHA-512:	54A85A173FE628112645F1558538F5C4DF9A382289680D96B5B2200975653D1581B363BF9CEF0F5734CBCD569BA315C7C9310F909EA94E53E6A0CD1122A7C892
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O2..........." ..0..0...........O... ...`....... ...............................g....`.................................-O..O....`.. ............:...(..........,N..T............................................ ............... ..H............text..../... ...0.................. ..`.rsrc... ....`.......2..............@..@.reloc...............8..............@..B................aO......H........%...'...................M.......................................-..(......s....z..(....,..-..s....z.r...ps....z...r/..p(....(....,&.~....%-.&~......$...s ...%.....o!...&.j.rG..p(....(....,..(.......~....%-.&~......%...s"...%.....(...+&.(...+&.(...+&v.rY..p(.....(%....o&...}....~.{....,.(%....{....o'...~(.....{....~re..ps.........ru..ps............0..,............().........(...-.(......s+...........0..........(,...o-.......*(.......3&r...p(/...(0...,.r.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_EG9264

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44808
Entropy (8bit):	6.38968749731858
Encrypted:	false
SSDEEP:	768:/0uMdRozKWWyAWxcnuHeHopdtU6LCxZF+dD/ic9zxz:/PMSeWWyZcnuHeIpdtUxZF+dTiUzR
MD5:	08AC1D14AD47498891953E40909FE293
SHA1:	996492040743CE3AF3734E07ED1610A6AB4FF375
SHA-256:	9F67076C79A953F5068C0792114F9722527CFA17ED7414C73FD14833BFE59918
SHA-512:	0A108F138DD52BB47892D836F0D54EEEAC00E9218ABC02964316E3BBFAD25D54B095E4C7D7D676922246AD42998CB37745C7CE9CF4A7E0C30F7742D37D89CB08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@f............" ..0..\|............... ........... ....................................`.................................W...O.......p................)..........H...T............................................ ............... ..H............text....z... ...\|.................. ..`.rsrc...p............~..............@..@.reloc..............................@..B........................H.......P;...V..........`...h...........................................-..(......s&...z..('...,..-..s&...z.r...ps(...z..~......0..........(....,....(.....o)......&................. ....0...........(.......(...-..,....(....,.r/..p......%...%...(+.....(,....(....,.r/..p......%...%...%...(+......(-....(....,!r/..p......%...%...%...%...(+.......(......,&(....,..r/..pr/..p.(+...(/.....(0.....(....,.r/..p......%...%...(+......(1....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_GGjb1Z

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.651296032355541
Encrypted:	false
SSDEEP:	12:2QGQ9jBHw1udAMaSccsQ9jupIGQ91zHwcsQ91k4:DF/5mmip+1zb1k4
MD5:	D7B714FE04552379398763489F1671A3
SHA1:	F79CCED480B997FB4740D73E3E94575D46C3B54D
SHA-256:	B6BDFBE75751480CBF8BBEFC0F70B9AEBC60173660AEB54B1BE50EBA8AD7B65B
SHA-512:	7170F40B6CF6506FA6F9E99629DAE6ACD4427B76A96D14BC023F13FBDB1ADA5C18BC56F5EF1EFC545E59EB462F1D5899F2BF1F58A82FCEFAE00EEB5566AFEE1B
Malicious:	false
Preview:	#!/bin/bash..sudo launchctl unload /Library/LaunchDaemons/com.atera.agent.plist &> /dev/null.sudo launchctl stop com.atera.agent &> /dev/null.sudo rm -rf "/Library/Application Support/com.atera.ateraagent" &> /dev/null.sudo rm -f "/Library/LaunchDaemons/com.atera.agent.plist" &> /dev/null.sudo pkgutil --forget com.atera.agent &> /dev/null.sudo launchctl unload /Library/LaunchDaemons/com.atera.agent.uninstall.plist &> /dev/null.sudo rm -f "/Library/LaunchDaemons/com.atera.agent.uninstall.plist" &> /dev/null

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_IJBzQD

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	258048
Entropy (8bit):	5.985936200789876
Encrypted:	false
SSDEEP:	6144:lA/WW316O2rkD3xTxVmLiJyTve+ewWotaDEimWkfzRVtyu5u:dW3ND3xT+LiJy7rewWZDtkfzR+A
MD5:	900BF2B7812788EFB97EB6B1B63814A0
SHA1:	F77F5A3F19F1EA332384517400684E5C2365E14A
SHA-256:	32EA2D0CE3512E74F1C7AD82591FE67E6B8939D76A8A4FF9C93EAD030131E71C
SHA-512:	35D93D9281AD8EB191217DC78B84418A4A4D862C4BA43F27EB5E89A1F9273F008CBEA08C87C72B3439EB7D9B51DBC8106A361B53D94EE7A877267CBB69678AD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............n.... ... ....... .......................`......&.....`.....................................O.... ..t....................@......8...T............................................ ............... ..H............text...0.... ...................... ..`.rsrc...t.... ......................@..@.reloc.......@......................@..B................M.......H.......D...t.............................................................(%..."..(&...&...('...&...((...2.r...p(...."..(....&...(....&...(....2.rE..p(...."..(....&...(....&...(....2.r...p(...."..(....&...(....&...(....J..r...p()...(....v....(.....(.....(...(.....0..].............(+......(,.....r...p(-......(,.....r...p(-.......(,.....r+..p(-......(,.....(....(......(....&...(....&...(........0..)........{.........(/...t......\|......(...+...3.....0..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_IZ39Jr

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	5.521300382116733
Encrypted:	false
SSDEEP:	768:oIe1ybJtobISqLnqhs6icPGlSkEuNxS9Hu:rIs6NG8kdNQ9H
MD5:	92641DE92C4288122D17163CD31B0B48
SHA1:	87DB0F34939FC505580CE4294645960A8E7DC528
SHA-256:	9797812419B0506569DE5BFD5A86B506BBAF7A0D2F2493DB0494D6E6EEE1AF0E
SHA-512:	16D3E0ECEF0DF620A308F48270F6CA14408595E0185BF2820A605FD5AE5FB7A64A5BA1F41110DC429105E774DB648F6C16E7BF54E79FD59CA0FFF2A8FD8503FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T............." ..0..j............... ........... ..............................:.....`.................................;...O...................................0...T............................................ ............... ..H............text....i... ...j.................. ..`.rsrc................l..............@..@.reloc...............r..............@..B................o.......H.......HG..h@..........................................................2.o....s<...6..s7...o......0..>.......sd......}......}......}.....-.r...ps....z....e...s....o....&....0..C.......sf......}.....-.r...ps....z.{....-.r...ps....z....g...s......(......0..Q.......sh......}......}......}.....-.r...ps....z.{....-.r...ps....z....i...s....o....&.*....0..........sr......}!.....}".....}#....-.r1..ps....z.{#...,.....s...s....(...+&+.....t...s....(...+&.{!...,...{!...(...+&..{!..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_KBmNT2

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	712464
Entropy (8bit):	5.960816598800232
Encrypted:	false
SSDEEP:	12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
MD5:	ADF3E3EECDE20B7C9661E9C47106A14A
SHA1:	F3130F7FD4B414B5AEC04EB87ED800EB84DD2154
SHA-256:	22C649F75FCE5BE7C7CCDA8880473B634EF69ECF33F5D1AB8AD892CAF47D5A07
SHA-512:	6A644BFD4544950ED2D39190393B716C8314F551488380EC8BD35B5062AA143342DFD145E92E3B6B81E80285CAC108D201B6BBD160CB768DC002C49F4C603C0B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)..........." ..0.............>.... ........... ....................... .......m....`.....................................O......................../..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............9............................................................(....^.(...........%...}....:.(......}....:.(......}.....(.............}.....(......{.....X.....}........0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..o....aX...X...o....2.....cY.....cY....cY..{......{...._..+&.{\|..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_KdfOv2

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.202402535375448
Encrypted:	false
SSDEEP:	3072:6G/MfUAMcCbPpKNQ6acJ8vG+L+ERbE9K/ShQvtpEI1aEvjc94OFS/Gi+XFEbliWb:6G/zAnUPpKO6acJ8n+Ez/5wECkliitf
MD5:	05C71FA3A6FC561D7A1F919437DBDDFD
SHA1:	5A8CD6B38EE5D63C60C7747DE6B5469BA5D1E6B2
SHA-256:	8A55501CD1A1590A4BD93A17C6FDD2C01A0ED5BFF1AEA9036BDC78D98C9A3FAD
SHA-512:	1AB183D67220C8B8999B6AC032AC304F57960FAF0E908404FFA3AA37C010D1A063D7734923A1576F18A69F7300B01FBBB395E3DCA971E1B125B1B3B67AB858D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..f..........r.... ........... ....................................`.....................................O...................................8...T............................................ ............... ..H............text...xe... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................R.......H.......dJ..T9............................................................{......{/...V.(0.....}......}/......0..A........u........4.,/(1....{.....{....o2...,.(3....{/....{/...o4...... a.(. )UU.Z(1....{....o5...X )UU.Z(3....{/...o6...X...0..b........r...p......%..{.......%q!....!...-.&.+...!...o7....%..{/......%q"...."...-.&.+..."...o7....(8.....{9.....{:...V.(0.....}9.....}:....0..A........u#.......4.,/(1....{9....{9...o2...,.(3....{:....{:...o4...... ..% )UU.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_MFWEV9

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	285184
Entropy (8bit):	6.189250838526299
Encrypted:	false
SSDEEP:	6144:CE8hhb1HVppBtl16Bispu+pDPF3T+jQiyrFOv:chhblN1spu+pDPF6jQiyAv
MD5:	E366240A13B9FF25230AF18E6076D81A
SHA1:	7B327A3928A358E7192FB64D26BB0F04A96D7A44
SHA-256:	D9531D30B8B6ECB061E49686C260D543F98C25E42A509370BAF9ACD5EC09D884
SHA-512:	F040FC60A80E3D3A057AAD389FA307BE5ADF0A8B533073EC2FB8120EB5DA8EB82314845F80A4B9CB05FFC851869D8D246BF60CAA8015E9369A2AC17E489A3561
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....t\..........." ..0..R...........o... ........... ....................................`..................................o..O...................................lo............................................... ............... ..H............text....P... ...R.................. ..`.rsrc................T..............@..@.reloc...............X..............@..B.................o......H...........l............X..`.............................................{A...:.(B.....}A.....0..)........u..........,.(C....{A....{A...oD.....v .... )UU.Z(C....{A...oE...X..0..:........r...p......%..{A......%q.........-.&.+.......oF....(G.....(B......0..D........(B.....}......}.......}.......}......}.......}.......}.......}.....0..7.........(H...}.......}.......}......\|......(...+..\|....(J.....0..7.........(K...}.......}.......}......\|......(...+..\|....(M...*..0..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_NRPQ4R

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34568
Entropy (8bit):	6.517852820627652
Encrypted:	false
SSDEEP:	384:pSupZ5W3lFhrJo6mz8z0TVHprQiWAIczKeG2bhjXK2701rXRNpvAW3gzUWFYA6VW:pSupZ5W1rFRoZXWNQdjOSzFClzUl9zL/
MD5:	88CCCAF8C1882C21963F5D4CBCF69A63
SHA1:	4234E32312441278653C2FBE28AC1C605E59DD88
SHA-256:	2C043EA968ECAEFD7B935255A8DB84D5666FB28A791C67D3555A611BC0C8B83C
SHA-512:	086B091CB88ED4144FCC5D48849246E26EE7D2713D84056B771D733BD96758E5B634478AB6609A07B51966115F57680C8D2D63F5F5EC7B2DE02F704916906A4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............" ..0..T..........&s... ........... ...............................Y....`..................................r..O....................^...)...........q..T............................................ ............... ..H............text...,S... ...T.................. ..`.rsrc................V..............@..@.reloc...............\..............@..B.................s......H......../..TA..................Hq.......................................-..(......s(...z..()...,..-..s(...z.r...ps...z.:.(+.....}......0..+........{....o9......+......o,....o-.....X....i2.:.(+.....}....2.{....o4.....{....v.r/..p(.....~....s....o.........0..M........r?..p(.....o/...~....(...+.o/...(...+(2....o/...(...+(2....o/...(...+(2......(+....~......(.....s..........~......(+.....s...........(+.....}......(......}......}.......}......{......{....*".

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_Nvks1x

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60984
Entropy (8bit):	6.260096204079049
Encrypted:	false
SSDEEP:	1536:Vu5rzIMys+F6uzTdRS6wUKeio0DqNDIP2WGfI5gQ:ItIMu6uzzbbio0DqNDIP2+5x
MD5:	FD36B2441343F1E26533C1C4092D3C6B
SHA1:	320BAB2C34024ACEE47F6571BDA5DBB7DC1EFFA4
SHA-256:	F817A99487AD58161B1A122E4235DD8646DA9EBAEC5153833D1A561E26907966
SHA-512:	2E7D64647DF8357DA90EF07785BE9B29C15DADB9F26F17C5CEB301181FCDB2C9DFD57FC29DDE8978DA97893DBEDCEDB33ED286449974F03A30C2FFAE6B762BA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'r"..........." ..0.................. ........... ....................... ......aL....`.................................^...O.......................8,..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......hc...q............................................................(....^.(.......V...%...}....:.(......}....:.(......}....:.(......}......(......%-.&r...ps....z}......}......{......{....v.(......%-.&r...ps....z}......{....V.(......}......}......{......{.......}.....(......%-.&r...ps....z}......{......{...."..}......{...."..}......{...."..}....J.(....}.....(....&..}.....&..}.........0..)........-.r'..ps....zs.......o......o....}.....*..{....-.r7

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_RbFfSO

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	153088
Entropy (8bit):	6.084295859718298
Encrypted:	false
SSDEEP:	3072:qCMB8etU5lH7HXpqgkZEw3O5WNYvmjpkZyFnbNFk97WoNKaiDOTbzdLn9fIMKQa:qCM/tUjH7HXpeJpX2fH99SQ
MD5:	2256D7E2235BD14F87E793104B1DC50F
SHA1:	4DF6E28766F826C92E4211C9AF0EA9C50D30B48A
SHA-256:	6245CCD930FB1956AA969217926B27E387DBF39867FDA24DF8B9176675451BC4
SHA-512:	AEC7CCCAA766E8345F53603F4A8EA50F139B6CFC3AFFF53E945AE7F7CBB5B2270717C7DCDD90DA3BDFA3A434BC9DDB86BE359DBDF48CAC9186ED0399041AFFA4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w2..........." ..0..L...........j... ........... ....................................`..................................i..O.......`............................h..T............................................ ............... ..H............text....J... ...L.................. ..`.rsrc...`............N..............@..@.reloc...............T..............@..B.................i......H.......L...............g..`...th........................................{;.....{<...V.(=.....};.....}<......0..A........u........4.,/(>....{;....{;...o?...,.(@....{<....{<...oA...... ... )UU.Z(>....{;...oB...X )UU.Z(@....{<...oC...X...0..b........r...p......%..{;......%q.........-.&.+.......oD....%..{<......%q.........-.&.+.......oD....(E.....{F.....{G...V.(=.....}F.....}G....0..A........u........4.,/(>....{F....{F...o?...,.(@....{G....{G...oA...... .T.2 )UU.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_RxsRfh

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	88856
Entropy (8bit):	6.156761178531121
Encrypted:	false
SSDEEP:	1536:STqBUaumtB8xThJyB8Hy1Uf1Kh13YpyEflX6oZH265m5JOSVWFIzK:Sb9xThRH7IX3YpyEfgoZH2YGTVF+
MD5:	901D83512E4744BC9604F404C95051A8
SHA1:	03B42BB1DDD42B63BF6E95162C478D03F8F493E0
SHA-256:	C1133578DAE376C51335CE9E0B800C666A06F5AAFE5B6B23A2706C7025B087A9
SHA-512:	8E4BDBD47E8848EB688BBED91FE0605C15692018749847AB6E5F87E499BA5B8E7BB64E4598BFA4515F68FDB18757D6A19A0BBF3036DC09532165E8561FE006B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z9..........." ..0..$...........B... ...`....... ..............................~Q....`..................................A..O....`..$............2...)...........@..T............................................ ............... ..H............text...."... ...$.................. ..`.rsrc...$....`.......&..............@..@.reloc...............0..............@..B.................A......H.......\p..............h:......H@.......................................-..(......s+...z..(,...,..-..s+...z.r...ps-...z..~......0..........(....,....(.....o.......&......................0...........(.......(/...-..,....(....,.r/..p......%...%...(0.....(1....(....,.r/..p......%...%...%...(0......(2....(....,!r/..p......%...%...%...%...(0.......(3.....,&(....,..r/..pr/..p.(0...(4.....(5.....(....,.r/..p......%...%...(0......(6...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_SbAGis

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	769024
Entropy (8bit):	5.775527780028626
Encrypted:	false
SSDEEP:	6144:RrLwz3zTEUQ9Hcq08BwLMc+qlIf/XAewU1pEw2N4vwGpNLRwMMvUi9xZTKZDeRMx:xqzTE19UEwLfyX9b1C25L/cZTkMFk
MD5:	D832817BC5B190535A69852F40A97D28
SHA1:	497FACF6FF1A97C0F5DC882BE99F5AA1F6F1E4C6
SHA-256:	B6A4CB701F37F0B2671D7946EEBDF24CAFA9D9CFED0D9482DEE1EB8D87825F02
SHA-512:	932BF540C2DD3E18B5E3410E8F184CB4C2F994F6D92AC9EE01FCADD992695C7C9D1E1047D52D75E613EA8D46F521DC7F2D447DECF7C47A356922ADCB8DA77EAB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0............" ..0.............Z.... ........... ....................... ......{.....`.....................................O...................................(...T............................................ ............... ..H............text...h.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................:.......H.......Lf..\k............................................................(....:.(......}....r.(......}......}......}.....0..,........-..{.....o...+.+..{.....{....s.....o...+..V.(......}......}....*...0...................-..+..o....sL........oN......oV....,..o....,...,....oR........,...or...,...o .....+.......9......o ...,..{......o ...o!...o......sB.........oP...8........{......o!....o....,..{......o!...o........9e.....o"....?X.....r...po#...9G.....r...po$...o%...r...p.(

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_Sl7yGl

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50976
Entropy (8bit):	6.364217691321339
Encrypted:	false
SSDEEP:	768:c4byNvwqX2LvG84aSBWZNSYv6VmTygGPSikiw64yw64pbdez7+Ts7XTfl3l37WqX:ctd2C9aC+EYYbgGB4pmOYlVLWqKzg
MD5:	973CBB386EEEAC6EC135977655F69D44
SHA1:	51EDCE77394F087E71ABB47FE86C6092488D13EE
SHA-256:	B2CFBA2E05EE89A91E9BC9CF112468A5F4FA05D1A77EA81C131EA656F3D133C2
SHA-512:	14B6CFED2082BD7184118EA4B519FD31B192A6D1B0BBF2D9796B7CF47D56CC9B4A4129E0D1CB15306F244352906A6DC14FFB748D1E745AC471E8D782C9B41515
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o..........." ..0.............^.... ........... ....................................`.....................................O.......,............... )..............T............................................ ............... ..H............text...d.... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B................=.......H.......lD..ti..........................................................-..(......s....z..(/...,..-..s....z.r...ps0...z..~......0..........(....,....(.....o1......&......................0...........(.......(2...-..,....(....,.r/..p......%...%...(3.....(4....(....,.r/..p......%...%...%...(3......(5....(....,!r/..p......%...%...%...%...(3.......(6.....,&(....,..r/..pr/..p.(3...(7.....(8.....(....,.r/..p......%...%...(3......(9...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_TFfNH3

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25384
Entropy (8bit):	6.504078205370435
Encrypted:	false
SSDEEP:	384:R/sfDn/NGfzRxL1iF0gzE1L/W9yVCWVYA6VFHRN76l9WR9zGt:8lGlxc8NhFCl6y9zi
MD5:	A01648A8751DD427461FA3FBD8096441
SHA1:	F34C91EB09ECD37F35145DEFBDD6D10A88699919
SHA-256:	206CAD6A76676E1FE74E12CEA23D92AA7AE3EB06217315617F6F267AF1383E58
SHA-512:	FC1CC0E36CA0B8364C5E06A8433A67BA219E2F52EDFEA74D104A39DE9AB5D50A2864FFEEBC53EE2803D799766314D05AC29DFEBE7E32A5DB030CF1B2E658F362
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.z..........." ..0..............M... ...`....... ..............................8.....`.................................mM..O....`...............:..()..........XL..T............................................ ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............8..............@..B.................M......H.......p%... ...........E..P....K.......................................-..(......s....z..(....,..-..s....z.r...ps....z..~......0..........(....,....(.....o ......&......................0...........(.......(!...-..,....(....,.r/..p......%...%...(".....(#....(....,.r/..p......%...%...%...("......($....(....,!r/..p......%...%...%...%...(".......(%.....,&(....,..r/..pr/..p.("...(&.....('.....(....,.r/..p......%...%...("......((...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_TNPRXy

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20248
Entropy (8bit):	6.608387792132858
Encrypted:	false
SSDEEP:	384:zVfk5CuC8P4mjWJIpVMWc/X6HRN7QNbZR9zdVR+2:zJECmg8AWQFT9zQ2
MD5:	7D6D6D756235E4047ED6056A74EA8247
SHA1:	75EE676251DDF351E5923198949B277E551F8D09
SHA-256:	3B1DC1ADA5BFEB19FE4BA5225DB9C9950DCA250FB2DAAAC259B537C5D0894A65
SHA-512:	2DED804C113765FE67F4BB161C52908349BED96E0E96AB228E0642E5BBEAAF4048D4814756D1DDE400C2BACA75C53345A486E47317B94912EABBC69ADD2F4D54
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...rd............" ..0..............9... ...@....... ...................................`.................................a9..O....@..,............&...)...`......d8..T............................................ ............... ..H............text........ ...................... ..`.rsrc...,....@......................@..@.reloc.......`.......$..............@..B.................9......H........!.......................7.......................................-..(......s....z..(....,..-..s....z.r...ps ...z...(......(....6.s....o!....J.o"...(...+($......(%....~......(.....s..........~......(%.....s.........:.(%.....}.....(....F(&...,............0............(....-...r/..p(.........o'.....((...,.....()......(...+..rC..p(+......(,.....(-......,..(....(......%-.&.+.o/...(0......{....(...."..(1.....s.......(%...*..BSJB............v4.0.303

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_TRqL6z

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.541766481433742
Encrypted:	false
SSDEEP:	384:8B4hjXP64yi1V9t0AavHoIm6rs44DTZYBbw14vxi8Q0LAbhyjNE9:8ah24/sHoyOYBbw1XHEA4jNo
MD5:	AC3A01CAFD3DE62CFEA1103D9A426F67
SHA1:	E42BDD9CE3C73EE7B25391683E4C84E91FDAAAF5
SHA-256:	04AC07C863591359073FE65B04E3EB4D86EF6146B850BB665B70A96A6A0DB851
SHA-512:	E1E7B220E14E101755E7504A5F74A8D0D5E2B8B308D0D68B2CC47D4CE99475F33DF0E9849836A9999B5215D3870743CB7638D1A085C7EABC94ACF9FC41F8F175
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.y..........."...0..V...........t... ........@.. ....................................`..................................s..O....................................s............................................... ............... ..H............text...$T... ...V.................. ..`.rsrc................X..............@..@.reloc...............^..............@..B.................t......H........3...@...........................................................0..[.........,....(....-..+....~....%-.&.......s....%.....~....%-.&.......s....%......(....o....(......0..y.......s:......}"....{"...(....~....%-.&~......6...s....%.....(....~....%-.&~......7...s....%.......( ......;...s!...("...(#.......0..y.......s<......}#....{#...(....~ ...%-.&~......8...s....%. ...(....~!...%-.&~......9...s....%.!.....( ......=...s!...("...($...V.(%.....}......}......0..G.......

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_UCoK5W

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22176
Entropy (8bit):	6.521828925730812
Encrypted:	false
SSDEEP:	384:ggH8Tv2So+MVV1CMHWs/hWuTb2HRN7TI+R9zJKhJ:ggcTvlGFtr/iMi9zEhJ
MD5:	504ACFD4F683B6F4859D240C1F6CD749
SHA1:	AE54915150997136F132BF61BDD9E7859F56D9BB
SHA-256:	F08B1F597ABB3647AB6E844282DED763E6078DBEF6DD54B9D956CA419FAC42FE
SHA-512:	A05F8507A8830AC33C45942BAE06C49A23242F35B4C01B3D677F8FEF0199C8CDBD956967BB73374BC52956D3BBFC82D422885800006C644D4C4AEA4717287239
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Pm..........." ..0.."..........JA... ...`....... ....................................`..................................@..O....`...................(...........?..T............................................ ............... ..H............text...P!... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............,..............@..B................+A......H.......T#.............. <..@...`?.......................................~......0..........(....,....(.....o.......&......................0...........(.......(....-..,....(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....( .....(!.....(....,.r...p......%...%...(.......("....(....,.r...p......%...%...%...(........(#....(....,"r...p......%...%...%...%..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_W4Wh56

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25760
Entropy (8bit):	6.52923478752906
Encrypted:	false
SSDEEP:	384:sK39j3mWjszWdsJdOBBgCV2VpUW2r4FWnYA6VFHRN7ic6R9zcLHHg/:s290Wd2EBQlKFCl929zb
MD5:	DAC813E8221D059D060E9927798FE6E8
SHA1:	AAC2BBB9B00F2E3ACDAEC8E4D6AEF2E682ADD68F
SHA-256:	4913C4D4D3837176BCB830A8A76402873ADA8C35050A3A93B29BE092EFDDB335
SHA-512:	87492ED57BC730C27AC4BAFF9B36A434043440122E8F9077B559D7AF23992FADFD52D448038B5BDF87914D1FA3369A5D3481F668DAB92134A7FA150CB9AFE7D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....B..........." ..0..2...........Q... ...`....... ..............................4.....`..................................P..O....`..d............<...(...........O..T............................................ ............... ..H............text....1... ...2.................. ..`.rsrc...d....`.......4..............@..@.reloc...............:..............@..B.................P......H........'...'..................<O.......................................-..(......s!...z..("...,..-..s!...z.r...ps#...z...r/..p(.....r?..p(......s....o$........0..+.......s5......}.....s+...%...6...s%...o'...(...."..(....v.rQ..p(.....o&...(...+((......rQ..p(.....r?..p(.....o&....s....(...+((......ra..p(.....(....&.o&....(...+&...(+....~......(.....s..........~......(+.....s..........0..x........(+....ru..p(.....r?..p(......}......}......}......o(...}......(

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_WC7aAX

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72488
Entropy (8bit):	6.257219154771484
Encrypted:	false
SSDEEP:	1536:Xxfx+lXPSWgC1Rp32bv6bbP75Sjhi09zS:BZ+p6AHlbbPcjh9m
MD5:	801C62D44095EAFB0243AE19A57FFE91
SHA1:	D6978DC2B7A3B4628D1D703CB9B365674DDCF0AB
SHA-256:	22CE5576ADEC386F12CC92DE15B38C85405995B4B0E6F610A00C918A72433F62
SHA-512:	273697F7B18CDF1FFE6786A381FF99043657055BD58FB9C971802EE3FCB4059985D2EB10B8BFC8DFFA223E5D43D16F9C63258A006BD191F17134FFA694312B86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............j.... ... ....... .......................`............`.....................................O.... ..................()...@......$...T............................................ ............... ..H............text...p.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................I.......H.......,_..............................................................-..(......s(...z..()...,..-..s(...z.r...ps...z..~......0..........(....,....(.....o+......&......................0...........(.......(,...-..,....(....,.r/..p......%...%...(-.....(.....(....,.r/..p......%...%...%...(-......(/....(....,!r/..p......%...%...%...%...(-.......(0.....,&(....,..r/..pr/..p.(-...(1.....(2.....(....,.r/..p......%...%...(-......(3....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_WDvLZo

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	6.274509810256932
Encrypted:	false
SSDEEP:	768:JrGlacqrCJ6PTbIQG0mVdrxzMBnW+e9z2:Jrf3CJ6fIQG0kxzMFW+az
MD5:	1900EFBF41F8BB57151CC942EF2A1222
SHA1:	8AFA01360292EFB640900A6CBCFAD40B7F815776
SHA-256:	BEAC12F7BBA4E22CDA2ACD9DDFE944A4ED56ABEC414E084EDD147BD5DAD3C032
SHA-512:	EECCB907965099846C684FE1584DAB1CBF74F0810AC89806827D85F0F456221FD42F0EC27197E9314A76E3980F3E2AD441D889A6D7AF042AC8258207BFEC46C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~5..........." ..0..p............... ........... ....................................`....................................O....................~.. )..............T............................................ ............... ..H............text... o... ...p.................. ..`.rsrc................r..............@..@.reloc...............\|..............@..B........................H........9...G..........d.......<........................................-..(......s!...z..("...,..-..s!...z.r...ps#...z..~......0..........(....,....(.....o$......&......................0...........(.......(%...-..,....(....,.r/..p......%...%...(&.....('....(....,.r/..p......%...%...%...(&......((....(....,!r/..p......%...%...%...%...(&.......().....,&(....,..r/..pr/..p.(&...(.....(+.....(....,.r/..p......%...%...(&......(,....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_WvwWyC

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.485675909360691
Encrypted:	false
SSDEEP:	384:O6MgYlHlPZlFlpWhS/LqbKabOHU3YdyNdvrvyTRDg/firUQ:O6MgYdvfCQzT03YQwdnYQ
MD5:	1BDFDC786ADCA7E17E0775C594CD7F76
SHA1:	341FFA7798BBAD7872E26088C8752EF2F216F7F1
SHA-256:	442502C2C2765BF2EAA491DAFEE9A0232E257EF0DCCF0E14628305B785173828
SHA-512:	7BDBD4638432AD562074B8CC4F0F5A47403F7D13D8C4BEFAE56DED53AB09F591AD80CC7C83054DFA5A4D0EBC63C30FE410DBC00CA81FF6285CDB6F1EADE3ED1B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...jU............" ..0..>...........]... ...`....... ..............................9A....@..................................\..O....`...............................\............................................... ............... ..H............text...<=... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H........F...................... \...........................................2#.r...po....&...........Yo....o....&.....2!..#o....&............Yo....o....&v...........Yo....(....o....&b...........Yo....o....&.....2 ..?o....&...........Yo....o....&.....2 ...........Yo....o....&..:o....&..0...........-......3..,....o.....("...+....-...,....o.....("...+......o.....s.....8......o........ ...._ ....3E..X./?...Xo.... ...._ ....3) ...... ...._..bX...Xo.... ...._X....X.+... ..

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_X50XDW

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45848
Entropy (8bit):	6.339251990513428
Encrypted:	false
SSDEEP:	768:m0PO7gRE3x5o7UP04wqgYtqPRw02KO7I9Yfwbhgv5NFcEn9zT8n3:m02GE3xOwP04wqgYtm2nQY4Ngv5NFT96
MD5:	470AD714B6CB486C3A64A918E72497A7
SHA1:	13583E2627FF47FA64C192D8F91E06C4472E6CDA
SHA-256:	ED0855B522F09B5A9DDBB85DE62042C25E07D10044086DA8620C845DE41E473C
SHA-512:	6237AF61B1F592FD10692906024FC970CD41F3DB971C2A869AED392AD686A904EDB19DAE81CC247B691A26A7E5E554AFFDF0853B1E29938D6CEA799E20343C77
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o$..........." ..0.................. ........... ....................................`.................................g...O.......H................)..........`...T............................................ ............... ..H............text....~... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H.......DD..TS..............H............................................-..(......s(...z..()...,..-..s(...z.r...ps...z..~......0..........(....,....(.....o+......&......................0...........(.......(,...-..,....(....,.r/..p......%...%...(-.....(.....(....,.r/..p......%...%...%...(-......(/....(....,!r/..p......%...%...%...%...(-.......(0.....,&(....,..r/..pr/..p.(-...(1.....(2.....(....,.r/..p......%...%...(-......(3....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_anzfZR

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24736
Entropy (8bit):	6.527142921797249
Encrypted:	false
SSDEEP:	384:4+6wnFbhCxwXaHsRJ0eDKfW9/nWCTb2HRN7jSR9zrZV:z6+FN04IcCSJ/i69zFV
MD5:	2EBDC0B72EAFB372036911DBF7EA1A9E
SHA1:	B4CE3F14DDBB8C0188C2F0B2F735512F3789DF8D
SHA-256:	688EF791D4BB2E84839CFB28EC83772D561D958F6D0B20CA28BE1C6EFC9EA5F7
SHA-512:	82AE8F62C6EA58EEB54E116E8258DB90DB55F6C376EF572F52B580194D5974AD66CF1C62B329A322D681A937A4214B67F9B4E273335A90DB662F3D7C55BD0517
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....+..........." ..0..,...........K... ...`....... ....................................`..................................J..O....`...............8...(...........I..T............................................ ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............6..............@..B.................J......H........%...............D.......I.......................................-..(......s....z..(....,..-..s....z.r...ps....z..~......0..........(....,....(.....o ......&......................0...........(.......(!...-..,....(....,.r/..p......%...%...(".....(#....(....,.r/..p......%...%...%...("......($....(....,!r/..p......%...%...%...%...(".......(%.....,&(....,..r/..pr/..p.("...(&.....('.....(....,.r/..p......%...%...("......((...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_ckmZFe

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35592
Entropy (8bit):	6.432954892385064
Encrypted:	false
SSDEEP:	768:BCuMWVBZb1mpK3/uTYBmJf4zFClZF9z8u:BC6Ip0XWwhiJzX
MD5:	85093D346F4610957B61EDE039E2B51F
SHA1:	870BF5320C82E509721F20B1AC541165A4A460ED
SHA-256:	31E08B4E0018EE136D65DFCCA8F655A1A74CF8841E6029044C99B2E75D5F59F0
SHA-512:	AB445D141E79D710A2598562217C1A9964404F765EAEE7D4788431BA96A24E772F25523FF3F6DD659119FEE4ED4B39FA5A7DA1D7980436BFF5A56C9F109738BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5..........." ..0..X...........v... ........... ..............................P+....`.................................}v..O....................b...)...........u..T............................................ ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................v......H........6..@;..........Lq.......u.......................................-..(......s....z..(....,..-..s....z.r...ps ...z..~......0..........(....,....(.....o!......&......................0...........(.......("...-..,....(....,.r/..p......%...%...(#.....($....(....,.r/..p......%...%...%...(#......(%....(....,!r/..p......%...%...%...%...(#.......(&.....,&(....,..r/..pr/..p.(#...('.....((.....(....,.r/..p......%...%...(#......()...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_f7W9g9

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51472
Entropy (8bit):	5.88513582609644
Encrypted:	false
SSDEEP:	768:75xwFYTqU7GjPb6viCMVOm4e+X9CzJ67Mo7tKoV2nwsyQYvZt164yCmi3FbQY9zn:AFmqU7GjPb6axWFvTbQY9hiwzN
MD5:	4AE388E85A11208237AC6BAFE218A321
SHA1:	3BF99D2F7EFA643BB4CD3B4E2D132539060B4878
SHA-256:	27F074952005F74BA37FC62756690255E5F743FF3F7426FCDEB65A0D6EC9FF77
SHA-512:	4B998257EFB7689090806F1741ADB8FD986E1BE424B91E8C9370FBD9586E234449B8F01B634813C083C50B342079C79F050F1183470E45CABF2BD42B182FD902
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p.]..........." ..0.............&.... ........... ....................................`....................................O.......<................).............T............................................ ............... ..H............text...,.... ...................... ..`.rsrc...<...........................@..@.reloc..............................@..B........................H.......P/..................H...H........................................-..(......s"...z..(#...,..-..s"...z.r...ps$...z..~m.....0..........(....,....(.....o%......&......................0...........(.......(&...-..,....(....,.r/..p......%...%...('.....((....(....,.r/..p......%...%...%...('......()....(....,!r/..p......%...%...%...%...('.......(.....,&(....,..r/..pr/..p.('...(+.....(,.....(....,.r/..p......%...%...('......(-....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_fds0qB

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43800
Entropy (8bit):	6.353852427600607
Encrypted:	false
SSDEEP:	768:MLJOZTEW1WTsTeVnrI/yqCtHUafO+ukucyOgn9zT8B:MLJOpEQzTp/AX2+uMyOg9zTc
MD5:	EBF181EF6F8CBFDD9149D9D609059051
SHA1:	05CD721A76C1AFB00DF1B6417E6B8B1A7F344E67
SHA-256:	B5CD9DA2C3364A5B201CECB0C80E25227D27BA44D96343D2894FF8EF3FD81550
SHA-512:	FA2F59833721FB50500D89AE5A3C8C7474E247A684440C01BD30D46A8962CBCBE8F216D41BBA9EBC075AC2E1EE19C37A46D0E1DB922DB23A3E261B5C68155877
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C............" ..0..x..........j.... ........... ....................................`.....................................O........................)..............T............................................ ............... ..H............text...pw... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B................I.......H........<...S...........................................................-..(......s+...z..(,...,..-..s+...z.r...ps-...z..~......0..........(....,....(.....o.......&......................0...........(.......(/...-..,....(....,.r/..p......%...%...(0.....(1....(....,.r/..p......%...%...%...(0......(2....(....,!r/..p......%...%...%...%...(0.......(3.....,&(....,..r/..pr/..p.(0...(4.....(5.....(....,.r/..p......%...%...(0......(6...*.(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_ha5W7b

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295936
Entropy (8bit):	5.94627895054931
Encrypted:	false
SSDEEP:	6144:yJlAZ3Jsrl1PKykvF4MwWTdOQbtAGElvEAz1+7EfcaN5/tt:yJlA3JWPKyk1lTdOQbtAGElvdV
MD5:	4E3228161AF8A77F104319CF66EFA754
SHA1:	F5D180421FB7E01918BA6CCB177751C1E4EC06D1
SHA-256:	F97ACD7A32006104A953BDA2FCF944D4B316D0236B30BA007CA8D38B21A0703F
SHA-512:	CF8B48D72C28B9109B664730FC66B2B6907F3991395D5CB8BEF368229FD71FCA88D17BE2362F404D8588D67D0E2B0E54F129AA04F02BC0385E08F915AC6582A1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..x............... ........... ...............................5....`.................................l...O.......h...........................P................................................ ............... ..H............text....v... ...x.................. ..`.rsrc...h............z..............@..@.reloc..............................@..B........................H........L...@...........................................................{......{.......{....%-.&.(....}.....{....(......(.........0...........o...../#r...p.o.......(....r...p(....s....z.,q.o.....1h..{....%-.&.(....}.....{.....o.....0...(....(.....{....o.....o.......o.....0...(....(......(....(.....o....,...o....(....(......{....%-.&.(....}.....{....o......o.......(......o.....1...(....(....(....n.{....-..{.....{....(......{....-..{....(.....{....s......0..q...

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_mY9F9q

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27912
Entropy (8bit):	6.495495235779423
Encrypted:	false
SSDEEP:	768:2ZiSrZ7HGMjbJbvAcU7dFClJrVXC4dC9zVj3:2pt7HGelzQviTC4dezF3
MD5:	01A8C2AB486E995EE7CA23D4F786C9F7
SHA1:	E6A68E5DC64C327EFAAF95C88E1C8BC60FC487CB
SHA-256:	372DCB44F6F9243346CB82DB99BB01F27A0F3C8019902481BD45D65C311A732D
SHA-512:	9E6A6DA4342FC1AB34AC748AD349A5A6A9F0E87C9A0246321E788CA69D9B4D0D29EE4397C998F66D6DEE60EAEEAB30E1E95EB02037A4127466B5ABC6DABA3B4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..:...........Y... ...`....... ....................................`..................................X..O....`..P............D...)...........W..T............................................ ............... ..H............text....9... ...:.................. ..`.rsrc...P....`.......<..............@..@.reloc...............B..............@..B.................X......H.......`'...,...........S..H...4W.......................................-..(......s!...z..("...,..-..s!...z.r...ps#...z..~......0..........(....,....(.....o$......&......................0...........(.......(%...-..,....(....,.r/..p......%...%...(&.....('....(....,.r/..p......%...%...%...(&......((....(....,!r/..p......%...%...%...%...(&.......().....,&(....,..r/..pr/..p.(&...(.....(+.....(....,.r/..p......%...%...(&......(,....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_o64caY

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26920
Entropy (8bit):	6.500024841260175
Encrypted:	false
SSDEEP:	384:z6J1o5QgFMvUo0e1l6QUWkWJ2WFYA6VFHRN7aU9WR9zGZzP:k1sFMYhudFClA9zqzP
MD5:	38EEB1691C133B414EA2061720C574E6
SHA1:	263001A6A631974CF87C908A058941AF79F5711C
SHA-256:	15E1262880F263806A2808D750688739662323B20CCD9835222FFF8C30899A4A
SHA-512:	550404CD20978D8607EFD5CCFDA035F77B48E40A272F95323FE60A39C029D71EFDF63999770AD221CADCF1ED5D9630762164533D66B9BD5E9F4146EAC35331EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7MW..........." ..0..4...........S... ...`....... ....................................`.................................GS..O....`..T............@..()..........@R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc...T....`.......6..............@..@.reloc...............>..............@..B................{S......H........'..P%...........L.......Q.......................................-..(......s....z..( ...,..-..s....z.r...ps!...z..~......0..........(....,....(.....o"......&.................!....0...........(.......(#...-..,....(....,.r/..p......%...%...($.....(%....(....,.r/..p......%...%...%...($......(&....(....,!r/..p......%...%...%...%...($.......('.....,&(....,..r/..pr/..p.($...((.....().....(....,.r/..p......%...%...($......(....(....,.r/..p......%...%...%.

/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/95B7A872-D4B1-4D95-9C99-9E8876D5ADB6.activeSandbox/Root/Library/Application Support/com.atera.ateraagent/Agent/.BC.T_oetLKo

Download File

Process:	/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	92952
Entropy (8bit):	6.242429664613066
Encrypted:	false
SSDEEP:	1536:HikoH+bvkw5ZSHZrt1xDtSN6A3vMZ+t5TvZdGpNeCWWo/Ep4zB:CHH+bkwU5rW3vJtvZdG6CWx/Xd
MD5:	EC9754049BB1B696F4FDDA765E55DC73

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/ThirdPartyNotices.txt

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/host/fxr/8.0.14/libhostfxr.dylib

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/.version

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.CSharp.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.deps.json

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.NETCore.App.runtimeconfig.json

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.Core.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.VisualBasic.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Primitives.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/Microsoft.Win32.Registry.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.AppContext.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Buffers.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Concurrent.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Immutable.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.NonGeneric.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.Specialized.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Collections.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Annotations.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.DataAnnotations.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.EventBasedAsync.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.Primitives.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.TypeConverter.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.ComponentModel.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Configuration.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Console.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Core.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.Common.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.DataSetExtensions.dll

/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/shared/Microsoft.NETCore.App/8.0.14/System.Data.dll

macOS Analysis Report
AteraAgent_xzZFJv3k-005lqqFBKy66Ehl79dMF+xnAE9HV0nREpQ=_Production_2_.pkg