Overview

overview

10

Static

static

10

8c684bf0b1...d6.msi

windows7-x64

10

8c684bf0b1...d6.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 02:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6.msi

  • Size

    2.9MB

  • MD5

    a232621b778a64163b77169820ad579e

  • SHA1

    252a8e0aa905aa1880161ab53aaeb54e345991a8

  • SHA256

    8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6

  • SHA512

    b6df966ed6f9d2e98e09300a01c6bc0e1c8641de3f4f28f462debe619560f002720fdfd5ae4247106e6deda1f67161f8f87c8f6db1ea45d73fa1a6b7a870b929

  • SSDEEP

    49152:J+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:J+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1000
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0C0DA1B3A1EA6096B31F3E89B7C97E21
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIDC37.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639265 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4368
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIDEA9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639750 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE8FA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240642343 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2748
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIF479.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240645265 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4544
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 92712CC659C4CDD36905502B5686DBD6 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:864
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000MmQV4IAN" /AgentId="b59940ab-7c7f-4a2d-a0ef-51707f450e8f"
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:2936
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A60971705CFCC59A54E31D15917C06E2 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7732E143-F6E1-4F53-9D46-8F35A36B6407}
        3⤵
        • Executes dropped EXE
        PID:4448
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C3DEBA4-7F2E-4B9F-BFF1-E29394A8BD0F}
        3⤵
        • Executes dropped EXE
        PID:2044
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3AF47CA-26BD-4DCA-87B6-D0C751B97EF0}
        3⤵
        • Executes dropped EXE
        PID:3348
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC5AD2EA-3BB0-456C-9F25-156C1FD0750F}
        3⤵
        • Executes dropped EXE
        PID:4504
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CB0E057-9994-4895-B165-86981D1DDF27}
        3⤵
        • Executes dropped EXE
        PID:1332
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D55493DD-1436-492C-87DF-7AC9614A1D77}
        3⤵
        • Executes dropped EXE
        PID:2292
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED797A08-4D4D-42BC-8143-A174E0992117}
        3⤵
        • Executes dropped EXE
        PID:4504
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0ADE5C05-1633-4F60-AB36-B3B2CB1E3F1D}
        3⤵
        • Executes dropped EXE
        PID:4800
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17C4BCF3-51E6-487F-AFE9-03F3867FE8C9}
        3⤵
        • Executes dropped EXE
        PID:2284
      • C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe
        C:\Windows\TEMP\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_is2F58.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55B24994-5342-43D2-AEFE-E62143880CD6}
        3⤵
        • Executes dropped EXE
        PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4504
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5124
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5152
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5204
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5232
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5280
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5308
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5356
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5384
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5440
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5480
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5524
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5556
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5604
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5632
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5684
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5712
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5760
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5788
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5840
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{967D4154-EC8C-43C3-A662-112D663A07E5}
        3⤵
        • Executes dropped EXE
        PID:5968
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{603E4597-9143-4BEC-BC26-86AED03A6939}
        3⤵
        • Executes dropped EXE
        PID:6004
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C197545B-D727-4EF5-B3D7-EDD3C41D3BDB}
        3⤵
        • Executes dropped EXE
        PID:6036
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{796292B4-EFDE-4316-9170-FEA32F994B6C}
        3⤵
        • Executes dropped EXE
        PID:6068
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{22280328-BBB8-4EE3-830F-56D148171D41}
        3⤵
        • Executes dropped EXE
        PID:6100
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{360A96F8-FD3B-426D-9D03-F5D2D785CF9A}
        3⤵
        • Executes dropped EXE
        PID:2752
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F3DFD57-F6DC-41FF-B7B2-16B303E38FC8}
        3⤵
        • Executes dropped EXE
        PID:5172
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4883F462-18B8-4F35-A394-1425735DEEC4}
        3⤵
        • Executes dropped EXE
        PID:5224
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16B3DBA0-0057-4AB6-8712-CE87D549DB68}
        3⤵
        • Executes dropped EXE
        PID:5188
      • C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
        C:\Windows\TEMP\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2DF27E29-8975-4AB2-88CA-3391A584221C}
        3⤵
        • Executes dropped EXE
        PID:5304
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6316F633-C934-49B8-9C85-F3DC7C93580D}
        3⤵
        • Executes dropped EXE
        PID:5252
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8E293AEF-FD5B-4199-BDB5-E0CC5AABD56A}
        3⤵
        • Executes dropped EXE
        PID:5276
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{979C624E-D8E0-4C33-9A23-CC37C692A459}
        3⤵
        • Executes dropped EXE
        PID:5240
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11B2A3DA-2762-4AE2-894F-F402D0226BD4}
        3⤵
        • Executes dropped EXE
        PID:2864
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{005B88F7-8466-4157-B903-90F888BFF89B}
        3⤵
        • Executes dropped EXE
        PID:5328
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D85D5927-7723-4CB7-AC3E-0AF1787CCBEE}
        3⤵
        • Executes dropped EXE
        PID:2284
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3F86B016-561B-4F1F-AC93-287E8BC3B64A}
        3⤵
        • Executes dropped EXE
        PID:5400
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D23EB0E1-C211-4933-83F6-74AD035DC951}
        3⤵
        • Executes dropped EXE
        PID:5928
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E7B2104B-0A1C-4A65-8735-CDD90CCEFD9F}
        3⤵
        • Executes dropped EXE
        PID:5420
      • C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe
        C:\Windows\TEMP\{EBB03283-5470-415E-BAFF-16F39115F2B9}\_is488F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0AED86FD-B30C-4FBF-AA72-95A82D6A1B99}
        3⤵
        • Executes dropped EXE
        PID:5536
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5752
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5832
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5956
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:5972
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:5724
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5300
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A483AB8F-7DFD-43C2-A3FF-F30A6B1AA9E8}
            3⤵
            • Executes dropped EXE
            PID:2864
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD413FC2-45AA-4174-BDCB-D9D789EC56B3}
            3⤵
            • Executes dropped EXE
            PID:5344
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73F6A352-4220-4A3B-8720-2AC461DE1D64}
            3⤵
            • Executes dropped EXE
            PID:5396
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57A79368-3344-411C-B4CA-3C63D96DA73A}
            3⤵
            • Executes dropped EXE
            PID:388
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3656A32-D5CE-409E-B73B-E98C7DA6FC42}
            3⤵
            • Executes dropped EXE
            PID:5412
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BE4924DC-C81A-4671-BC74-F55855C0E9FF}
            3⤵
            • Executes dropped EXE
            PID:5496
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F93DD71C-EB61-488F-956F-114A081C7206}
            3⤵
            • Executes dropped EXE
            PID:5624
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E81A92AE-8332-452E-B35B-56AFB3B851F8}
            3⤵
            • Executes dropped EXE
            PID:6132
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D201645-9F61-4967-BEF8-BAE65BE2390E}
            3⤵
            • Executes dropped EXE
            PID:5316
          • C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe
            C:\Windows\TEMP\{77C7712E-6E55-4976-BEC4-3A7FAC97C8E6}\_is5AF0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4BA7E7C4-117B-4C24-9ECF-2CBB2C7AAB54}
            3⤵
            • Executes dropped EXE
            PID:5800
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5828
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{642A8A30-3EB2-4F85-B7C6-70C1911B73A6}
            3⤵
            • Executes dropped EXE
            PID:5952
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9A6B440C-2BFC-4DC7-8E56-5A6A8B96A9A4}
            3⤵
            • Executes dropped EXE
            PID:6036
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99B9642C-ADCB-43AA-8DC7-D1D5A7765F97}
            3⤵
            • Executes dropped EXE
            PID:6012
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A76AEDC2-78A7-4C70-A59A-BB86A415CB31}
            3⤵
            • Executes dropped EXE
            PID:6096
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A8EAD25-3986-4B1B-BAF5-663FFC43C428}
            3⤵
            • Executes dropped EXE
            PID:2148
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{246368D4-9898-4E33-ACEC-6C822A9834C3}
            3⤵
            • Executes dropped EXE
            PID:5680
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E76187E-52BC-42E0-8141-AD284E47B3F7}
            3⤵
            • Executes dropped EXE
            PID:2468
          • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
            C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1B832F4-98A2-465D-B9A1-1BE36E0A8AF1}
            3⤵
              PID:5964
            • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
              C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9E07CEB-ECAD-44DE-A615-897FE1E92A09}
              3⤵
                PID:5200
              • C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe
                C:\Windows\TEMP\{A32D1859-AC46-4934-A836-6B0F86EDDA61}\_is5F66.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3BFBA443-4B62-4B3F-B626-659C31C69A5D}
                3⤵
                  PID:60
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2752
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 8754439995CAA62C06DF5FA96C8D587F E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1480
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI9865.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687296 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5932
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI9950.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687437 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4024
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI9BF1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240688109 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:684
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5176
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4644
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5300
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:5932
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3632
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4556
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:4644
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIBB1B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240696062 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5832
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                  2⤵
                  • Drops file in System32 directory
                  PID:1004
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="8cee7aec-2b26-4548-a755-f1c6e5af29c8"
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1336
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:540
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5068
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:2864
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "70f6f91a-bc3d-44c0-82b3-f23d4436c977" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MmQV4IAN
                  2⤵
                  • Executes dropped EXE
                  PID:2936
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "ba9ec5d0-3b39-4595-b723-e4a78d0f3031" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MmQV4IAN
                  2⤵
                  • Executes dropped EXE
                  PID:3640
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "3a6c5f26-26d2-44dd-8077-9833ad6b1848" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000MmQV4IAN
                  2⤵
                  • Executes dropped EXE
                  PID:60
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "400256c1-c0c8-486b-916d-1ea829241a00" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000MmQV4IAN
                  2⤵
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1332
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2272
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:920
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "fd0d2fc5-8ba3-461f-a57a-b800ad270bc8" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000MmQV4IAN
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3472
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1892
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:528
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4472
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1477cbef-278f-4dc2-b8b1-feb6a927f90e" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MmQV4IAN
                  2⤵
                  • Executes dropped EXE
                  PID:2876
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1996
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:3628
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1477cbef-278f-4dc2-b8b1-feb6a927f90e" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MmQV4IAN
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5576
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "2161e564-24fd-4105-88f5-7270b485898f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MmQV4IAN
                  2⤵
                    PID:5468
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      3⤵
                        PID:2288
                        • C:\Windows\system32\cscript.exe
                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          4⤵
                          • Modifies data under HKEY_USERS
                          PID:5312
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "f1ca437a-bc84-43de-b548-0287318e6813" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MmQV4IAN
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:876
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1c158d52-a6aa-424f-837e-01fc6227847a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MmQV4IAN
                      2⤵
                      • Drops file in System32 directory
                      PID:6040
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "ab8957cc-a0e0-4d37-b73e-cff56e0f07bd" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MmQV4IAN
                      2⤵
                      • Modifies registry class
                      PID:2240
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "b513d1fe-b8a1-4f6e-b463-4dc4e28359a5" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MmQV4IAN
                      2⤵
                      • Drops file in System32 directory
                      PID:5160
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "306bd0ac-c428-47a1-b74b-b3f3b2064b3b" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MmQV4IAN
                      2⤵
                      • Drops file in System32 directory
                      PID:1316
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                          PID:1420
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "11e99985-4ede-4faf-8590-756c37ffcc96" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MmQV4IAN
                        2⤵
                        • Drops file in System32 directory
                        PID:5048
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "ce8138af-602a-4b41-8246-c57f9be53ee2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MmQV4IAN
                        2⤵
                          PID:5496
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1d0c9a67-d4e6-4c73-935c-7448069d9df5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MmQV4IAN
                          2⤵
                            PID:6048
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "a3121720-780e-4d6e-8d4a-e1b1f4e0c64d" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MmQV4IAN
                            2⤵
                              PID:2812
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=67ca63118740b01874ccd117bf2f008a&rmm_session_pwd_ttl=86400"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5488
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "1d09fb61-b105-4884-bbb4-9a2c7f24526f" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MmQV4IAN
                              2⤵
                              • Drops file in System32 directory
                              PID:5792
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "7e6445b2-1f34-429f-910e-11896d9d1f2f" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MmQV4IAN
                              2⤵
                              • Drops file in System32 directory
                              • Drops file in Program Files directory
                              PID:5464
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "69b1bf06-b996-409d-af08-e67c07d1d7f2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MmQV4IAN
                              2⤵
                              • Drops file in System32 directory
                              PID:4384
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                3⤵
                                • System Time Discovery
                                PID:1544
                                • C:\Program Files\dotnet\dotnet.exe
                                  dotnet --list-runtimes
                                  4⤵
                                  • System Time Discovery
                                  PID:424
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "a7013313-8b36-4257-98a1-48c80b1367ae" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MmQV4IAN
                              2⤵
                              • Drops file in System32 directory
                              PID:5252
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                            1⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5240
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                              2⤵
                              • Drops file in System32 directory
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2864
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                -h
                                3⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SetWindowsHookEx
                                PID:5164
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                3⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:5804
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                  4⤵
                                    PID:4148
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5288
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5924
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                    SRUtility.exe -r
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6112
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5956
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                    4⤵
                                      PID:5432
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ver
                                        5⤵
                                          PID:2060
                                        • C:\Windows\system32\sc.exe
                                          sc query ddmgr
                                          5⤵
                                          • Launches sc.exe
                                          PID:5068
                                        • C:\Windows\system32\sc.exe
                                          sc query lci_proxykmd
                                          5⤵
                                          • Launches sc.exe
                                          PID:4192
                                        • C:\Windows\system32\rundll32.exe
                                          rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                          5⤵
                                          • Drops file in System32 directory
                                          • Drops file in Windows directory
                                          • Checks SCSI registry key(s)
                                          • Modifies data under HKEY_USERS
                                          PID:852
                                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                  1⤵
                                  • Drops file in Program Files directory
                                  • Modifies data under HKEY_USERS
                                  PID:5004
                                  • C:\Windows\System32\sc.exe
                                    "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                    2⤵
                                    • Launches sc.exe
                                    PID:2132
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "88b402e7-59cb-4f10-aaaf-01748ea11830" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MmQV4IAN
                                    2⤵
                                      PID:4252
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                        3⤵
                                          PID:5296
                                          • C:\Windows\system32\cscript.exe
                                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                            4⤵
                                            • Modifies data under HKEY_USERS
                                            PID:6172
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "f54a3c21-cd42-4356-9018-de4d25037e60" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MmQV4IAN
                                        2⤵
                                          PID:5388
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "84d87fa8-b979-463b-9eac-292daa06899a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MmQV4IAN
                                          2⤵
                                            PID:5632
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "cea94c6c-e403-4665-b1e4-c1b363f8c3f0" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MmQV4IAN
                                            2⤵
                                              PID:5612
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "b4c029d4-b0c0-4457-bff2-85f6d30ca72c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MmQV4IAN
                                              2⤵
                                                PID:4948
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "5cd88882-4ddb-496f-9d41-3ded8c05abae" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MmQV4IAN
                                                2⤵
                                                  PID:3104
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "cb6647fa-11ee-49f7-ac4c-427adb6a6ccc" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MmQV4IAN
                                                  2⤵
                                                    PID:6040
                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=67ca63118740b01874ccd117bf2f008a&rmm_session_pwd_ttl=86400"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:6892
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "0a6a74f9-3466-402f-a4ba-a3b7329d677e" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MmQV4IAN
                                                    2⤵
                                                      PID:3292
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "272c4a61-4a74-43dc-a732-48598a6685ab" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MmQV4IAN
                                                      2⤵
                                                        PID:6580
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "7615d1a8-b4a2-4c6a-a86d-7d56708214dd" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MmQV4IAN
                                                        2⤵
                                                          PID:6632
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                            3⤵
                                                            • System Time Discovery
                                                            PID:5264
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              dotnet --list-runtimes
                                                              4⤵
                                                              • System Time Discovery
                                                              PID:6524
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "92193504-96c3-45ad-87ce-340be7a62eaa" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MmQV4IAN
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:6752
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "27eac3ad-143c-4971-b511-1485e7ff02f2" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MmQV4IAN
                                                          2⤵
                                                          • Writes to the Master Boot Record (MBR)
                                                          • Modifies data under HKEY_USERS
                                                          PID:6812
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "815ef568-f4e2-4389-a9cc-23908ec81e31" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MmQV4IAN
                                                          2⤵
                                                            PID:6384
                                                            • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                              "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "b59940ab-7c7f-4a2d-a0ef-51707f450e8f" "815ef568-f4e2-4389-a9cc-23908ec81e31" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000MmQV4IAN"
                                                              3⤵
                                                                PID:4304
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" b59940ab-7c7f-4a2d-a0ef-51707f450e8f "f54a3c21-cd42-4356-9018-de4d25037e60" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MmQV4IAN
                                                              2⤵
                                                                PID:5952
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                              1⤵
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              PID:5428
                                                              • C:\Windows\system32\DrvInst.exe
                                                                DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                • Modifies data under HKEY_USERS
                                                                PID:5792
                                                              • C:\Windows\system32\DrvInst.exe
                                                                DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000015C" "WinSta0\Default" "0000000000000174" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                2⤵
                                                                • Drops file in System32 directory
                                                                • Checks SCSI registry key(s)
                                                                PID:4676
                                                              • C:\Windows\system32\DrvInst.exe
                                                                DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000170"
                                                                2⤵
                                                                • Drops file in Drivers directory
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                PID:5152
                                                              • C:\Windows\system32\DrvInst.exe
                                                                DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                2⤵
                                                                • Drops file in Drivers directory
                                                                • Drops file in Windows directory
                                                                • Checks SCSI registry key(s)
                                                                PID:3616

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Event Triggered Execution

                                                            2
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Installer Packages

                                                            1
                                                            T1546.016

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Privilege Escalation

                                                            Event Triggered Execution

                                                            2
                                                            T1546

                                                            Component Object Model Hijacking

                                                            1
                                                            T1546.015

                                                            Installer Packages

                                                            1
                                                            T1546.016

                                                            Defense Evasion

                                                            Modify Registry

                                                            1
                                                            T1112

                                                            Pre-OS Boot

                                                            1
                                                            T1542

                                                            Bootkit

                                                            1
                                                            T1542.003

                                                            Subvert Trust Controls

                                                            1
                                                            T1553

                                                            Install Root Certificate

                                                            1
                                                            T1553.004

                                                            System Binary Proxy Execution

                                                            1
                                                            T1218

                                                            Msiexec

                                                            1
                                                            T1218.007

                                                            Credential Access

                                                            Discovery

                                                            Peripheral Device Discovery

                                                            2
                                                            T1120

                                                            Query Registry

                                                            4
                                                            T1012

                                                            System Information Discovery

                                                            3
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Config.Msi\e57db9c.rbs
                                                              Filesize

                                                              8KB

                                                              MD5

                                                              937a8cff7cd80fe59824c5f8f4b3be0d

                                                              SHA1

                                                              31c91a37fba05ff504b92f39d5688e7912149b55

                                                              SHA256

                                                              01c5906c5b2867faa24c377783f21c758cbf11c835f5aac4c2f5633961d62d92

                                                              SHA512

                                                              985c438cf81a62ec2c772a741f6dfc7fb8b957accc24c88865829b76f3cf1d5e344cacdb8b68f37a496671fac49207c8de8e36b14139812f6d9ee6f9aabadfa7

                                                              Download Submit

                                                            • C:\Config.Msi\e57dba1.rbs
                                                              Filesize

                                                              74KB

                                                              MD5

                                                              3201baf0fc8374f4192aba116999d40b

                                                              SHA1

                                                              39208ee328da9821fd9b4f5a616b29f62d3e0135

                                                              SHA256

                                                              40f751ae56c94a78ad9220905b644726f18b11dd9d30e20b958824e9ad96c069

                                                              SHA512

                                                              d7a111e7b8c55c587e0ecc30ff97c1d821caaabce97b4db62c4cd41c61f615ff475feb4564c4ae0391c77ef77778c57c2fad46370c1cc38c93aa1321c872c0ce

                                                              Download Submit

                                                            • C:\Config.Msi\e57dba3.rbs
                                                              Filesize

                                                              464B

                                                              MD5

                                                              ab27c3399573c0f14feddd5c13c5ec15

                                                              SHA1

                                                              fb505486974ba667490101dff4ccb2cea6a4ee25

                                                              SHA256

                                                              9e42d273e03bda876ec8a8af3c27468db647d97a6c7cc297041e2a6a9f62f903

                                                              SHA512

                                                              d0ab96a86c7277522e05ae436f68d0126ce97e835255bd3c5a0438479e6e7ef83e55815c2abf52dc367aab2029ece0f37b3ab3a803a5589aa5efbc32bf76d6c5

                                                              Download Submit

                                                            • C:\Config.Msi\e57dba9.rbs
                                                              Filesize

                                                              9KB

                                                              MD5

                                                              ac7fbfbb444e6f70c742c7b9a280cd03

                                                              SHA1

                                                              0d460e1b8cf9a88b62e83c59a6c5e2dd25b4adaa

                                                              SHA256

                                                              6b243f06390f29e963de8671a6240e8e4c3fbe0b49601b09bdf2b42c9c0c52a9

                                                              SHA512

                                                              874d9aa2ad6ba7b6f3247e1ed3207eb38487daabbe8d312e25c8cdcf71605cefe2fc81025246540d5dc2089540cf1646aafd8230e0a145a8dcdfb95839d3f967

                                                              Download Submit

                                                            • C:\Config.Msi\e57dbb1.rbs
                                                              Filesize

                                                              8KB

                                                              MD5

                                                              de5b2229d0520e58bb5caa42ec642dba

                                                              SHA1

                                                              2bfbafe94d59fd41c9736289475f9e3f376c5a68

                                                              SHA256

                                                              82417e10f8362f153334504f92f321d6beb9c678ed0d1c8119863d87ede74209

                                                              SHA512

                                                              98e2e091cc55b2fc7e3b41920267a583f30fe9e37be0b1ec8123e4abed2ed9b3496582b9767937eae67548a8ca1d922ff3eae297dca05899907478ab7486729f

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                              Filesize

                                                              753B

                                                              MD5

                                                              8298451e4dee214334dd2e22b8996bdc

                                                              SHA1

                                                              bc429029cc6b42c59c417773ea5df8ae54dbb971

                                                              SHA256

                                                              6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

                                                              SHA512

                                                              cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              337079222a6f6c6edf58f3f981ff20ae

                                                              SHA1

                                                              1f705fc0faa84c69e1fe936b34783b301323e255

                                                              SHA256

                                                              ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                              SHA512

                                                              ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                              Filesize

                                                              142KB

                                                              MD5

                                                              477293f80461713d51a98a24023d45e8

                                                              SHA1

                                                              e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                              SHA256

                                                              a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                              SHA512

                                                              23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              b3bb71f9bb4de4236c26578a8fae2dcd

                                                              SHA1

                                                              1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                              SHA256

                                                              e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                              SHA512

                                                              fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                              Filesize

                                                              210KB

                                                              MD5

                                                              c106df1b5b43af3b937ace19d92b42f3

                                                              SHA1

                                                              7670fc4b6369e3fb705200050618acaa5213637f

                                                              SHA256

                                                              2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                              SHA512

                                                              616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                              Filesize

                                                              693KB

                                                              MD5

                                                              2c4d25b7fbd1adfd4471052fa482af72

                                                              SHA1

                                                              fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                              SHA256

                                                              2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                              SHA512

                                                              f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                              Filesize

                                                              156KB

                                                              MD5

                                                              0b7534a49a757d7525f7fc966d6caf5f

                                                              SHA1

                                                              2548a8d4bfe81d194a42a6df1761ab910deccbca

                                                              SHA256

                                                              312755b522a3cb212a2d5e0df2888699c35de233a2dc198c37475e2bf414b0a1

                                                              SHA512

                                                              4d3105e7669093df8364543571d839d0fd573153eed27d82860984797fb30853c3f5fb7707bf97442d4ab71783012fbbb3d9ab1a2d6acbea335f06b756fd4796

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                              Filesize

                                                              51KB

                                                              MD5

                                                              3180c705182447f4bcc7ce8e2820b25d

                                                              SHA1

                                                              ad6486557819a33d3f29b18d92b43b11707aae6e

                                                              SHA256

                                                              5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                              SHA512

                                                              228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                              Filesize

                                                              12B

                                                              MD5

                                                              dc63026e80d2bb04f71e41916f807e33

                                                              SHA1

                                                              6cda386d2c365f94ea3de41e2390fd916622eb51

                                                              SHA256

                                                              3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                              SHA512

                                                              61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                              Filesize

                                                              173KB

                                                              MD5

                                                              31def444e6135301ea3c38a985341837

                                                              SHA1

                                                              f135be75c721af2d5291cb463cbc22a32467084a

                                                              SHA256

                                                              36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                              SHA512

                                                              bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                              Filesize

                                                              546B

                                                              MD5

                                                              158fb7d9323c6ce69d4fce11486a40a1

                                                              SHA1

                                                              29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                              SHA256

                                                              5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                              SHA512

                                                              7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                              Filesize

                                                              688KB

                                                              MD5

                                                              ba66874c510645c1fb5fe74f85b32e98

                                                              SHA1

                                                              e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                              SHA256

                                                              12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                              SHA512

                                                              44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                              Filesize

                                                              27KB

                                                              MD5

                                                              797c9554ec56fd72ebb3f6f6bef67fb5

                                                              SHA1

                                                              40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                              SHA256

                                                              7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                              SHA512

                                                              4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                              Filesize

                                                              214KB

                                                              MD5

                                                              01807774f043028ec29982a62fa75941

                                                              SHA1

                                                              afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                              SHA256

                                                              9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                              SHA512

                                                              33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                              Filesize

                                                              37KB

                                                              MD5

                                                              efb4712c8713cb05eb7fe7d87a83a55a

                                                              SHA1

                                                              c94d106bba77aecf88540807da89349b50ea5ae7

                                                              SHA256

                                                              30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                              SHA512

                                                              3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                              Filesize

                                                              3.4MB

                                                              MD5

                                                              e010d1f614b1a830482d3df4ba056f24

                                                              SHA1

                                                              5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                              SHA256

                                                              98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                              SHA512

                                                              727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                              Filesize

                                                              389KB

                                                              MD5

                                                              5e3252e0248b484e76fcdbf8b42a645d

                                                              SHA1

                                                              11ae92fd16ac87f6ab755911e85e263253c16516

                                                              SHA256

                                                              01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                              SHA512

                                                              540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                              Filesize

                                                              48KB

                                                              MD5

                                                              ed926a42049bf2b31dde86412c31cda7

                                                              SHA1

                                                              5dd69f50cd7f41f42d07c76c2ae3ba03f65c1fab

                                                              SHA256

                                                              4fdba92165b4b4301ce5e59f061aa0796e418913981d5cd0685ce67af528bc04

                                                              SHA512

                                                              bc7bf6318b166c2c0851510c743c654898a41a96074397c0b70db7982903962151c28719ff619d32d4ee7f4eaa25a2daf3ce93af09af8de40b67cbdf90bed42b

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                              Filesize

                                                              195KB

                                                              MD5

                                                              84cb0cf784734c3ee8c151bc54f77b6e

                                                              SHA1

                                                              6f300359be48f38ca18ea54d744566635fd13e6f

                                                              SHA256

                                                              adacab8ac34991a5b4908aafb21a9d0eef3a24b4a44ac6b48a1ac745623eb2a9

                                                              SHA512

                                                              0c628ebab1720a02b2d2dee52c805f17b986f3c46a8c91bac6c67d7a7faf155dcb1c0a46e208d5b1b7d913f26e81b037e2b9e83d25e65c86cbca249b26866e34

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                              Filesize

                                                              55KB

                                                              MD5

                                                              fe9412e42084a3d34a774ef639a21e58

                                                              SHA1

                                                              f5ba2c838358c7a644761488030d16603d08bab0

                                                              SHA256

                                                              b59840da02f870dc5d6d8dfd83e0c5f56c77610f75acfa6dbcede92877fb6447

                                                              SHA512

                                                              b493966084906a75aca175445fbe1f1917922cf7d3c0487d14d3ba48d790250810fd4a35db6de5cb4d23f834341c3fde03d4792efbc73a9a81a3bfbbc8bf7fda

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                              Filesize

                                                              9KB

                                                              MD5

                                                              9d1528a2ce17522f6de064ae2c2b608e

                                                              SHA1

                                                              2f1ce8b589e57ab300bb93dde176689689f75114

                                                              SHA256

                                                              11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                              SHA512

                                                              a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5464.update
                                                              Filesize

                                                              9KB

                                                              MD5

                                                              14ffcf07375b3952bd3f2fe52bb63c14

                                                              SHA1

                                                              ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                              SHA256

                                                              6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                              SHA512

                                                              14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                              Filesize

                                                              8KB

                                                              MD5

                                                              f7d366320b5a4045cc13667dfe5e45ab

                                                              SHA1

                                                              c4d0df0a074a2f53b34960c6a3b4b86a74da9118

                                                              SHA256

                                                              e7d5db99cf0ecd0a922dd2ae04e2f9fc1f77817eaa078d74a0d2d82f7a429f64

                                                              SHA512

                                                              cbe832edd71a592020cf7d42b6c0247bd6c6225c92f7762dc2460f04927e5e0124975110efe5f8dfb7f996e93f8b263f2834d65cdc8ab7b683251f9474965904

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                              Filesize

                                                              2B

                                                              MD5

                                                              81051bcc2cf1bedf378224b0a93e2877

                                                              SHA1

                                                              ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                              SHA256

                                                              7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                              SHA512

                                                              1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                              Filesize

                                                              54KB

                                                              MD5

                                                              77c613ffadf1f4b2f50d31eeec83af30

                                                              SHA1

                                                              76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                              SHA256

                                                              2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                              SHA512

                                                              29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                              Filesize

                                                              334KB

                                                              MD5

                                                              b3e14504a48bed32c53ec7aab2cb2c8f

                                                              SHA1

                                                              0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                              SHA256

                                                              adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                              SHA512

                                                              e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                              Filesize

                                                              72KB

                                                              MD5

                                                              749c51599fbf82422791e0df1c1e841c

                                                              SHA1

                                                              bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                              SHA256

                                                              c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                              SHA512

                                                              f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                              Filesize

                                                              50KB

                                                              MD5

                                                              875fd285089ab5431c460c5d245b934c

                                                              SHA1

                                                              c6a3532f4f68f1a7eb052cf78af795edff455d0c

                                                              SHA256

                                                              30ed5771981efa69ad082e003d9ae90552a9c6d3233707f7ed5f152a1469c9de

                                                              SHA512

                                                              a989fdbbbf74f831bf2dd9a167cb9a274bd8720cfb7aa6bd724bd628080c61e1f869759377825f60283a4e608d1ed31c0e63e484eef9899d5ba0023006b01177

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                              Filesize

                                                              32KB

                                                              MD5

                                                              0758b7576e5ec85ed4cbdbc32400024e

                                                              SHA1

                                                              c9ba0d8078212a93a674182a33de792e25fa8a7e

                                                              SHA256

                                                              81c5eebe833cab7b1eec71aefdc06e4d7c187802219f923fc38e98bd5bfeb801

                                                              SHA512

                                                              4cb73d191b645449b91576679c4d544a46a1ff7fa5374f9eab947204d857827ab95c94973c37b8b01368e877f62617489f075fdedf64514d2b881e63f447b7b1

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                              Filesize

                                                              54KB

                                                              MD5

                                                              d11b2139d29e79d795054c3866898b7f

                                                              SHA1

                                                              020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                              SHA256

                                                              11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                              SHA512

                                                              de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                              Filesize

                                                              588KB

                                                              MD5

                                                              17d74c03b6bcbcd88b46fcc58fc79a0d

                                                              SHA1

                                                              bc0316e11c119806907c058d62513eb8ce32288c

                                                              SHA256

                                                              13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                              SHA512

                                                              f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                              Download Submit

                                                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                              Filesize

                                                              215B

                                                              MD5

                                                              99d1a707f71da7da64e762fef3a840bd

                                                              SHA1

                                                              b06be509ba314e48abffb3a972a550afd67d7b54

                                                              SHA256

                                                              0aaf98e8b5659705c2bb99b7455b709aa686d1528ed42804d7a9a0a96a463113

                                                              SHA512

                                                              e867f1862feaf2ef4aabf893ada44c0bfc503e0032bf2d089c09fad5dc4524cebede463763a29154c0a998e382cd5c79395cd3d93fa78bcbf717829e02206cb6

                                                              Download Submit

                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                              Filesize

                                                              9KB

                                                              MD5

                                                              1ef7574bc4d8b6034935d99ad884f15b

                                                              SHA1

                                                              110709ab33f893737f4b0567f9495ac60c37667c

                                                              SHA256

                                                              0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                              SHA512

                                                              947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                              Download Submit

                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                              Filesize

                                                              10KB

                                                              MD5

                                                              f512536173e386121b3ebd22aac41a4e

                                                              SHA1

                                                              74ae133215345beaebb7a95f969f34a40dda922a

                                                              SHA256

                                                              a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                              SHA512

                                                              1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                              Download Submit

                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                              Filesize

                                                              76KB

                                                              MD5

                                                              b40fe65431b18a52e6452279b88954af

                                                              SHA1

                                                              c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                              SHA256

                                                              800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                              SHA512

                                                              e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                              Download Submit

                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                              Filesize

                                                              80KB

                                                              MD5

                                                              3904d0698962e09da946046020cbcb17

                                                              SHA1

                                                              edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                              SHA256

                                                              a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                              SHA512

                                                              c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                              Download Submit

                                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                              Filesize

                                                              88KB

                                                              MD5

                                                              e3c7bc6c5f870598cd94ae4f0902c086

                                                              SHA1

                                                              5c115ec83911cec034ebaf937c98d1b48ab19467

                                                              SHA256

                                                              b8a2acaf7ec828a8c3bf1dd73a3f2ed4091be42e2f178f508731383d077f91c9

                                                              SHA512

                                                              dbbc1933ff4f47f5a094ee6e4003201ecc85bdef5b9a6a5103af998b8893d37c19db52ac0f3213b72ec4ffdc84cfb18eb4b0a2e446df56ad8ca674026b78a718

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                              Filesize

                                                              433B

                                                              MD5

                                                              cf5f69533151675ab4f248fbc8cdedeb

                                                              SHA1

                                                              eb736e17118ac79e341b49eb29ea04433e65e66f

                                                              SHA256

                                                              e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                              SHA512

                                                              e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                              Filesize

                                                              717B

                                                              MD5

                                                              ef0a07aec4367a64c16c581da2657aa9

                                                              SHA1

                                                              13011a5abcbadb3424fb6ecee560665556bb1d24

                                                              SHA256

                                                              f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                              SHA512

                                                              35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                              Filesize

                                                              7KB

                                                              MD5

                                                              362ce475f5d1e84641bad999c16727a0

                                                              SHA1

                                                              6b613c73acb58d259c6379bd820cca6f785cc812

                                                              SHA256

                                                              1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                              SHA512

                                                              7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                              Filesize

                                                              1.9MB

                                                              MD5

                                                              b110ba42ca8d339b18293ac3f1e94f03

                                                              SHA1

                                                              e21ac41d052159076b34823d2653db0decdf7f8c

                                                              SHA256

                                                              c860712a06a55cdddfed7a9f86f0df36da1e475b9901148d07d5b02331ba0f77

                                                              SHA512

                                                              d81efa032f3ff5edc247440cff1e911a82230b757c02534209fead7ecf630fe5308f9a32a78cc229f175cb447735d539eb61039bfb4ff9f8e77b8dbccda2b0ba

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                              Filesize

                                                              1.1MB

                                                              MD5

                                                              9a9b1fd85b5f1dcd568a521399a0d057

                                                              SHA1

                                                              34ed149b290a3a94260d889ba50cb286f1795fa6

                                                              SHA256

                                                              88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                              SHA512

                                                              7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                              Filesize

                                                              375KB

                                                              MD5

                                                              3c93b399b417b0d6a232d386e65a8b46

                                                              SHA1

                                                              bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                              SHA256

                                                              29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                              SHA512

                                                              a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                              Filesize

                                                              321KB

                                                              MD5

                                                              d3901e62166e9c42864fe3062cb4d8d5

                                                              SHA1

                                                              c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                              SHA256

                                                              dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                              SHA512

                                                              ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                              Filesize

                                                              814KB

                                                              MD5

                                                              9b1f97a41bfb95f148868b49460d9d04

                                                              SHA1

                                                              768031d5e877e347a249dfdeab7c725df941324b

                                                              SHA256

                                                              09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                              SHA512

                                                              9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                              Filesize

                                                              1.2MB

                                                              MD5

                                                              e74d2a16da1ddb7f9c54f72b8a25897c

                                                              SHA1

                                                              32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                              SHA256

                                                              a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                              SHA512

                                                              52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                              Filesize

                                                              11B

                                                              MD5

                                                              5eda46a55c61b07029e7202f8cf1781c

                                                              SHA1

                                                              862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                              SHA256

                                                              12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                              SHA512

                                                              4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                              Filesize

                                                              12B

                                                              MD5

                                                              5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                              SHA1

                                                              93012724e6cc0a298838aede678806e6c0c6517d

                                                              SHA256

                                                              a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                              SHA512

                                                              890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                              Filesize

                                                              48KB

                                                              MD5

                                                              1de36e30b49387d159c9b3a0076997ab

                                                              SHA1

                                                              4d189b63c159413715af7cd89fb2e9a7a802090c

                                                              SHA256

                                                              45e4d8ab5922ec210cde416e352de52734e902b14c125056ca64c3439f979990

                                                              SHA512

                                                              11eab8c85ca903216490b645e5f263b64c6031f50183c11f3915b65a507c2245a54024b4313382d5fcc22225ecc56250784e79f6b76695baabfd429d21b8f193

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                              Filesize

                                                              48KB

                                                              MD5

                                                              7fd460b1c7b9f1cb2147a60fb2dc9c21

                                                              SHA1

                                                              cc668900e09db9291c056372e0214dc8f3e9e573

                                                              SHA256

                                                              064b68bb71e48c60275ce08344b3f36662d3411f5c776103d16a3208e938293a

                                                              SHA512

                                                              fe53bf7e97e15b8e01e7a98ebc74a729314ae022366f776bba5c7cc9ebe9555f95d258522933f23c7d5c685c246992ae02f1f25c90f4601d6aaec8cc1386a282

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                              Filesize

                                                              2.8MB

                                                              MD5

                                                              05974ad24d0fc5005fd90ca96941beaa

                                                              SHA1

                                                              7ccf99236729a614ca0d15b7e5a18ece0dd14242

                                                              SHA256

                                                              30215a902c746227df0d5fed400eaf74a5c1e827d50eec7c21cd37ea1b299aa5

                                                              SHA512

                                                              c9426d56833d61a1763f93ce5388a4c2b5af3c0ae9a71b200a0a3bab1937381220d9a981077c2bd286a53faebde764ffe1608729e4d3895a69b2318403b89ca9

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                              Filesize

                                                              2.6MB

                                                              MD5

                                                              b255b465a565130ddd717d87c0429c49

                                                              SHA1

                                                              8c1a6c1e2d61a4382e5690d9edab17916b62dbc4

                                                              SHA256

                                                              71aee953e0cad03b838f1929789cf251ae2c2f1a2f7d84e6855866a7096ddf82

                                                              SHA512

                                                              83dbdba4d41b7558d2afbdc6d8d0efbf66ff24d796f56793a9a5d11d82afca4502107f7742931f8c2446183df6e67894fcb2f7d1ae1ea5f93d40d83682c4a83d

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                              Filesize

                                                              1.1MB

                                                              MD5

                                                              6c6f85e896655a6eb726482f04c49086

                                                              SHA1

                                                              2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                              SHA256

                                                              e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                              SHA512

                                                              b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                              Filesize

                                                              541B

                                                              MD5

                                                              d0efb0a6d260dbe5d8c91d94b77d7acd

                                                              SHA1

                                                              e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                              SHA256

                                                              7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                              SHA512

                                                              a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                              Filesize

                                                              12B

                                                              MD5

                                                              3d66ae5ed06891e8ce75a39a24070844

                                                              SHA1

                                                              368064119835d4376727a14706c41384446183e8

                                                              SHA256

                                                              73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                              SHA512

                                                              c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                              Filesize

                                                              644KB

                                                              MD5

                                                              842f933bd194a1156d309a8c62e9c187

                                                              SHA1

                                                              02d0d6499f8cf39a886376733a0d4de912a8fc1d

                                                              SHA256

                                                              f56ad437aff22da5fc3c1b2cf0ea503929848c959ae162ca25bc5d658a859227

                                                              SHA512

                                                              a33bc0df02c38bb65e3f166044b158534dca30253a0d95c5efb6d747c81808b2dc98488c656e9633716d289eaca883482949384f8f8e16d7a43ba8b74ed39059

                                                              Download Submit

                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                              Filesize

                                                              569KB

                                                              MD5

                                                              9614d1da18956de06747c03068208d66

                                                              SHA1

                                                              fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                              SHA256

                                                              dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                              SHA512

                                                              d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                              Download Submit

                                                            • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\92596d5516abf586d14eef8c5a58b427
                                                              Filesize

                                                              16KB

                                                              MD5

                                                              b2e89027a140a89b6e3eb4e504e93d96

                                                              SHA1

                                                              f3b1b34874b73ae3032decb97ef96a53a654228f

                                                              SHA256

                                                              5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                              SHA512

                                                              93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                              Download Submit

                                                            • C:\ProgramData\chocolatey\config\chocolatey.config
                                                              Filesize

                                                              809B

                                                              MD5

                                                              8b6737800745d3b99886d013b3392ac3

                                                              SHA1

                                                              bb94da3f294922d9e8d31879f2d145586a182e19

                                                              SHA256

                                                              86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                              SHA512

                                                              654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                              Download Submit

                                                            • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                              Filesize

                                                              12KB

                                                              MD5

                                                              87f8f3617cbf0bd91d811e4d9acccc46

                                                              SHA1

                                                              313af95d95f1135c9d6aa11479f36b6a2ee9d346

                                                              SHA256

                                                              3a1f4023dcbe7a2ddf9f4845bbe2efbc4117e7bfdc4afeb9b5dc7fe1815af282

                                                              SHA512

                                                              9c51a04007ba6d636bdd4b8d31e09fb60002108c3b054475eb5cf9141e4f414c6898dcf6675e8c7847277b2e94f908f06f19b13cc87fb80d7067e38700d2d140

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                              Filesize

                                                              471B

                                                              MD5

                                                              ffbcd1a642773b6966b3fb592a31a060

                                                              SHA1

                                                              4f11f9f769868a8cace14d992475bd19b111cd4b

                                                              SHA256

                                                              48d55b5241b0a6fd59a32a49a51b8f853b9acb41e824cf9c32741b785f19dad7

                                                              SHA512

                                                              f837ed9c71b3e453999bf5e962221cc933bce1a5b955d1fce23de627d88ff3f7a5c92c0b0b80b013ac7f00a2380fa2bedb43d89dd214f682b0ea1e2474ca8bef

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                              Filesize

                                                              727B

                                                              MD5

                                                              c09feb246a12b3c371735239b403e286

                                                              SHA1

                                                              7cce0dda148b0de1d7acff032e7f8331f2916736

                                                              SHA256

                                                              1883ff514ff8a1002407a2ee3f537d4fdfc6b26a677b10c981e0eef4e4e60be7

                                                              SHA512

                                                              c69e044a8cb4134279ec526ee28fe7bdb85fc4cbd279f9012b46b4d76c0d059478e3e7da3aa1bc5033d65eed7d2841caca589c99f90e08de8eae9d12c4f797ba

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                              Filesize

                                                              727B

                                                              MD5

                                                              5374a99237df7a9042905d7867d9d9de

                                                              SHA1

                                                              b53700bb4068cfefae2b4aff8207ae68e429d9da

                                                              SHA256

                                                              735c4c40a3fcda17583561b6250c49e457428e72befc53f14047d69f931528f6

                                                              SHA512

                                                              9accd40a2a307f51cf290df8b156445f5789fefe7f24d898fc49fd3449db47bd1b60d41cf4358f49725c18328844e7b8ba41606f5fdd8ff418902b486c1000bc

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                              Filesize

                                                              400B

                                                              MD5

                                                              32fce5e2573c9763253deb7a593e7275

                                                              SHA1

                                                              a210ecb18d9e189ecc043e2ec31076dbf947ebeb

                                                              SHA256

                                                              9d1b21be754bc44621b1a4c282d5437a732a7c8cc4a7971dcf77dd7ea3988af5

                                                              SHA512

                                                              87419b0bed40e707a441f3443a820bf497f0f39b69842d45092605397753966adbc30591071fdb277f8ef904f4cfecee735a16297adfe26fda0beccabb73e3fb

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                              Filesize

                                                              404B

                                                              MD5

                                                              934734b23be44b5628486ee0a0e39461

                                                              SHA1

                                                              d9acc335d4fa79528aa14d13d143208b954448b3

                                                              SHA256

                                                              af8d493f31b6fcae8b6daf0b9c0d8f550cee039413cd181a009e5d6db79c57b7

                                                              SHA512

                                                              56359f69c67cf00c6a9b5d178eb6df8328762cb37cc0c1f8fdbb129420659316f38fa149d81516fa64a2b00afd7464b3b9151c8fd0bf8c7b3d323900da0d3ec6

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                              Filesize

                                                              412B

                                                              MD5

                                                              236609fd4db4ee768e22c00695cb565e

                                                              SHA1

                                                              9e264142ac9efd9c3446f93af91e046b43cfcde9

                                                              SHA256

                                                              21c4d8568d4ff67408993320b1f4183361a8acb56b47d1f565b4e71e11e3e7f0

                                                              SHA512

                                                              1cd5b1adf078c9761f532d383b420024be8f20b28931f18f1b9999a38673a67d3db0a83d4ba2721295259087b90cd6b71a1502797f95bab8f8aea0095469f184

                                                              Download Submit

                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                              Filesize

                                                              651B

                                                              MD5

                                                              9bbfe11735bac43a2ed1be18d0655fe2

                                                              SHA1

                                                              61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                              SHA256

                                                              549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                              SHA512

                                                              a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                              Download Submit

                                                            • C:\Windows\Installer\MSI483D.tmp
                                                              Filesize

                                                              4.5MB

                                                              MD5

                                                              25a0aa722268b17888b4e159a9f82f18

                                                              SHA1

                                                              68ccb5adae9095056a9d5592f6a850f30715a86b

                                                              SHA256

                                                              72896d8abeeeb40360596927c0feade8f0bc28f9937d35f646b9ba2a47f1edca

                                                              SHA512

                                                              79a574f95dbb5ff11e35f2938fcd6a9e22a3f1a35d7e032aceb099dd69ad45dcdf006d92aeb7d1086e3d0615241f6669e510d5dee6f7d262e0e3d4179822365d

                                                              Download Submit

                                                            • C:\Windows\Installer\MSI9865.tmp-\System.Management.dll
                                                              Filesize

                                                              60KB

                                                              MD5

                                                              878e361c41c05c0519bfc72c7d6e141c

                                                              SHA1

                                                              432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                              SHA256

                                                              24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                              SHA512

                                                              59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                              Download Submit

                                                            • C:\Windows\Installer\MSIDC37.tmp
                                                              Filesize

                                                              509KB

                                                              MD5

                                                              88d29734f37bdcffd202eafcdd082f9d

                                                              SHA1

                                                              823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                              SHA256

                                                              87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                              SHA512

                                                              1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                              Download Submit

                                                            • C:\Windows\Installer\MSIDC37.tmp-\AlphaControlAgentInstallation.dll
                                                              Filesize

                                                              25KB

                                                              MD5

                                                              aa1b9c5c685173fad2dabebeb3171f01

                                                              SHA1

                                                              ed756b1760e563ce888276ff248c734b7dd851fb

                                                              SHA256

                                                              e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                              SHA512

                                                              d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                              Download Submit

                                                            • C:\Windows\Installer\MSIDC37.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                              Filesize

                                                              179KB

                                                              MD5

                                                              1a5caea6734fdd07caa514c3f3fb75da

                                                              SHA1

                                                              f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                              SHA256

                                                              cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                              SHA512

                                                              a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                              Download Submit

                                                            • C:\Windows\Installer\MSIDEA9.tmp-\CustomAction.config
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              bc17e956cde8dd5425f2b2a68ed919f8

                                                              SHA1

                                                              5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                              SHA256

                                                              e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                              SHA512

                                                              02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                              Download Submit

                                                            • C:\Windows\Installer\MSIDEA9.tmp-\Newtonsoft.Json.dll
                                                              Filesize

                                                              695KB

                                                              MD5

                                                              715a1fbee4665e99e859eda667fe8034

                                                              SHA1

                                                              e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                              SHA256

                                                              c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                              SHA512

                                                              bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                              Download Submit

                                                            • C:\Windows\Installer\MSIEAB2.tmp
                                                              Filesize

                                                              211KB

                                                              MD5

                                                              a3ae5d86ecf38db9427359ea37a5f646

                                                              SHA1

                                                              eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                              SHA256

                                                              c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                              SHA512

                                                              96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                              Download Submit

                                                            • C:\Windows\Installer\e57db9b.msi
                                                              Filesize

                                                              2.9MB

                                                              MD5

                                                              a232621b778a64163b77169820ad579e

                                                              SHA1

                                                              252a8e0aa905aa1880161ab53aaeb54e345991a8

                                                              SHA256

                                                              8c684bf0b13e4bc010d63490bd53593cd627be43e8178117c80e4b836881dad6

                                                              SHA512

                                                              b6df966ed6f9d2e98e09300a01c6bc0e1c8641de3f4f28f462debe619560f002720fdfd5ae4247106e6deda1f67161f8f87c8f6db1ea45d73fa1a6b7a870b929

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\lci_proxywddm.cat
                                                              Filesize

                                                              12KB

                                                              MD5

                                                              8e16d54f986dbe98812fd5ec04d434e8

                                                              SHA1

                                                              8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                              SHA256

                                                              7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                              SHA512

                                                              e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\lci_proxywddm.inf
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              0315a579f5afe989154cb7c6a6376b05

                                                              SHA1

                                                              e352ff670358cf71e0194918dfe47981e9ccbb88

                                                              SHA256

                                                              d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                              SHA512

                                                              c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\lci_proxyumd.dll
                                                              Filesize

                                                              179KB

                                                              MD5

                                                              4dc11547a5fc28ca8f6965fa21573481

                                                              SHA1

                                                              d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                              SHA256

                                                              e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                              SHA512

                                                              bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\lci_proxyumd32.dll
                                                              Filesize

                                                              135KB

                                                              MD5

                                                              67ae7b2c36c9c70086b9d41b4515b0a8

                                                              SHA1

                                                              ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                              SHA256

                                                              79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                              SHA512

                                                              4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{5c5703ed-e09e-1446-8ae2-8b614a099a80}\x64\lci_proxywddm.sys
                                                              Filesize

                                                              119KB

                                                              MD5

                                                              b9b0e9b4d93b18b99ece31a819d71d00

                                                              SHA1

                                                              2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                              SHA256

                                                              0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                              SHA512

                                                              465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\lci_iddcx.cat
                                                              Filesize

                                                              10KB

                                                              MD5

                                                              62458e58313475c9a3642a392363e359

                                                              SHA1

                                                              e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                              SHA256

                                                              85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                              SHA512

                                                              49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\lci_iddcx.inf
                                                              Filesize

                                                              4KB

                                                              MD5

                                                              1cec22ca85e1b5a8615774fca59a420b

                                                              SHA1

                                                              049a651751ef38321a1088af6a47c4380f9293fc

                                                              SHA256

                                                              60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                              SHA512

                                                              0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                              Download Submit

                                                            • C:\Windows\System32\DriverStore\Temp\{93294410-74c1-a645-847a-5e32ca691d66}\x64\lci_iddcx.dll
                                                              Filesize

                                                              52KB

                                                              MD5

                                                              01e8bc64139d6b74467330b11331858d

                                                              SHA1

                                                              b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                              SHA256

                                                              148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                              SHA512

                                                              4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                              Download Submit

                                                            • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-02-13-03.dat
                                                              Filesize

                                                              602B

                                                              MD5

                                                              2b103ff9b4f0cce10340fe556d2ea3ff

                                                              SHA1

                                                              da7c4b893512a66d030075e0a9eae46e7856ab84

                                                              SHA256

                                                              84b4852a2333c532e54054aa71da574815ebe095279fbf9824c3fb1bab3128bc

                                                              SHA512

                                                              2d09697fb44d224e422a9486f5955d61a61cd2facd4245278509498102e8e841026af7fc383c85bd8bb902958d87330e5d24ea3991e1231e18ebb225f9f79169

                                                              Download Submit

                                                            • C:\Windows\Temp\InstallUtil.log
                                                              Filesize

                                                              4KB

                                                              MD5

                                                              5d543e584d71819e9a2785bd761e235e

                                                              SHA1

                                                              1a7f256615609b555b95ef7cb58e7eacdae44b9b

                                                              SHA256

                                                              9c77c25c6d878da71c9aedd891525787660bba47f667bf4eedf036f9b832c11f

                                                              SHA512

                                                              085bfe9b63c17636ca92e102c17fb3025cd44e3ddd783d2818f812677bfdfb6f0885ab02d36a18d1932b2ad6ba9c5cebc90e3970ab22e1241eeaadf6c583cc2c

                                                              Download Submit

                                                            • C:\Windows\Temp\InstallUtil.log
                                                              Filesize

                                                              850B

                                                              MD5

                                                              6831b35a2eda09ab3b4a1b03ed58c257

                                                              SHA1

                                                              9f585ffe527a1daf7b13465f8247671a5e95db27

                                                              SHA256

                                                              d35a519426d384a747227d681f7c9dfd752d4348773f1889cd5aa8a82bc8780b

                                                              SHA512

                                                              c06a77af7a62be232de78f6f1dad56001714bd4f5e6dc79d014b1bf80b01848fb7dfa65f1dc92c5079f3dc94f0167d45ae1d956db7578403973c63713ce971bf

                                                              Download Submit

                                                            • C:\Windows\Temp\InstallUtil.log
                                                              Filesize

                                                              1KB

                                                              MD5

                                                              b2abc5ffe2b01e3b299f59ccd4fcffb9

                                                              SHA1

                                                              eda141697b7351fec4d12d021c921e08aea442e1

                                                              SHA256

                                                              b77d90f23bb73b0dc94e7548347ae8edb9b5f72b2062782052c1a77fd1369562

                                                              SHA512

                                                              993e3e2e0cfe2e052b06d7e5a3e88b313b351075f7482ae343d6011e895c8164945a6eb449ddb52d129321df9b54c168296205cc8aa4c68019c117c0e0456a24

                                                              Download Submit

                                                            • C:\Windows\Temp\PreVer.log
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              e19ac0e29ec06ba91933f667bb8dd8d5

                                                              SHA1

                                                              62c39778f8ddfeafc92abb4e51bcdd7743e177bd

                                                              SHA256

                                                              a45a54354b6241db6ac6340190fa49f3c07691d03b576aac792a757dd3bd86dc

                                                              SHA512

                                                              7f45acf1b97bb2e105b14ea03736329c5a7dcf65bc67988301b279f795fa1b495334d7fb626a532cb66d641263ca657f9c7be65131f065aba50fddc822fed23a

                                                              Download Submit

                                                            • C:\Windows\Temp\unpack.log
                                                              Filesize

                                                              2KB

                                                              MD5

                                                              668e3c53a691ef481c3bd749012d42ca

                                                              SHA1

                                                              db3b62032f15cbaab7059984525883bfbb5816b7

                                                              SHA256

                                                              04745075b0e25f1a54c7412f271d2853e0923b543053db976bcd3de5f67646d9

                                                              SHA512

                                                              5315a5fd8909ac93ed67eb7afbc417d9a87415a3021c6ff633ef2243a239bbc1a5d016c9876dcf099eca694f50735ba875ded7f37925385c243373a0b4850514

                                                              Download Submit

                                                            • C:\Windows\Temp\unpack.log
                                                              Filesize

                                                              4KB

                                                              MD5

                                                              6663f2e2b7c31bd084c389e56b3cb0dd

                                                              SHA1

                                                              85aa4ae21dd0a1178914eb3eec4e871544e8a38b

                                                              SHA256

                                                              e127dc1f58d59a51f53b9fc24096493d341705843eb39a60a1f347d44ff3b99d

                                                              SHA512

                                                              780900bd368406d6f9f6a0c690c0e180c445cc59fa26b1ba749b085c999c6724db3b80bdbaa6647f6fbeab97d5e8f350734acf35d67c57315c145bc9b76c24aa

                                                              Download Submit

                                                            • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                              Filesize

                                                              2.7MB

                                                              MD5

                                                              df5eb1af99091a902effa52463eda084

                                                              SHA1

                                                              b04578b36490a4ec0092e9a44ae6b2679670450a

                                                              SHA256

                                                              83ef8e362af27279b63ef28379675a087984791e5eaf4a9272a5cb4e52dd059c

                                                              SHA512

                                                              663e11667ec5c6c7969ce61f90d869f3723cbd007236150478ef6dbd861ddc75cf5f96b0345319bd178cd87045daa39a0d6ca4af83cf8dcdb4ebe7462d3eeabd

                                                              Download Submit

                                                            • C:\Windows\Temp\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\IsConfig.ini
                                                              Filesize

                                                              571B

                                                              MD5

                                                              de10be3435fbcab7eeccaa67e2431619

                                                              SHA1

                                                              7afdb3c4c042692ea3f19f2d2275bada7cacfbfd

                                                              SHA256

                                                              d193eda99410268676293d315164ff29cd263ca0251a0238592a23a9d78476b0

                                                              SHA512

                                                              bda2f23885d4bb07c328622d7f637379f63f08b57eb54c4a665fb56d5f68e61d36ff4b4e3cc2b8b2b3d3c5f2e0d3dbb581770eec4fddf9a8c0f4b6555ad3c1af

                                                              Download Submit

                                                            • C:\Windows\Temp\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\String1033.txt
                                                              Filesize

                                                              182KB

                                                              MD5

                                                              1d4329601bef6492cd3227df5bcd5125

                                                              SHA1

                                                              d03a3c50ba7663b52c13b54b08b9284f40e4f848

                                                              SHA256

                                                              bd703470b2f35e3c4d917d3038bf806fcc7c155142d300806c95500274951efd

                                                              SHA512

                                                              b0cfc1aef000d428d1ff4f2df41539284a048571e26a2c1a217093e593e546f5af79bbc61be8458021a9829a7d79f68cb8728bf942475096b53c81a66094dd7b

                                                              Download Submit

                                                            • C:\Windows\Temp\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\_is3B30.exe
                                                              Filesize

                                                              179KB

                                                              MD5

                                                              7a1c100df8065815dc34c05abc0c13de

                                                              SHA1

                                                              3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                              SHA256

                                                              e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                              SHA512

                                                              bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                              Download Submit

                                                            • C:\Windows\Temp\{46AB6E38-00DE-4670-B843-D12E7BF4EE0F}\setup.inx
                                                              Filesize

                                                              345KB

                                                              MD5

                                                              0376dd5b7e37985ea50e693dc212094c

                                                              SHA1

                                                              02859394164c33924907b85ab0aaddc628c31bf1

                                                              SHA256

                                                              c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                              SHA512

                                                              69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                              Download Submit

                                                            • C:\Windows\Temp\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\ISRT.dll
                                                              Filesize

                                                              427KB

                                                              MD5

                                                              85315ad538fa5af8162f1cd2fce1c99d

                                                              SHA1

                                                              31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                              SHA256

                                                              70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                              SHA512

                                                              877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                              Download Submit

                                                            • C:\Windows\Temp\{A0D8F55F-1A69-4421-A42B-0D7D18BABDA8}\_isres_0x0409.dll
                                                              Filesize

                                                              1.8MB

                                                              MD5

                                                              befe2ef369d12f83c72c5f2f7069dd87

                                                              SHA1

                                                              b89c7f6da1241ed98015dc347e70322832bcbe50

                                                              SHA256

                                                              9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                              SHA512

                                                              760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                              Download Submit

                                                            • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                              Filesize

                                                              404B

                                                              MD5

                                                              7f12003d0b00927dd57a80a47eef0977

                                                              SHA1

                                                              0dd07d2d8220c192f2427268f7aa9329ba8db0b6

                                                              SHA256

                                                              83b1b9807d662acc4320386493825f37d78c35ae97f66579bf0e0f7b593b6497

                                                              SHA512

                                                              0fe2c75756c1b1dfbc14511c994976b031dd3d0a3c262e6295c3921965034bf6e0326efd750bd5d0a9cba11d54985c75cb658dc28690974d24cec643e60ae330

                                                              Download Submit

                                                            • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                              Filesize

                                                              412B

                                                              MD5

                                                              564af0fb304236f9cfef610354dc4f79

                                                              SHA1

                                                              9814442285b986b68fb9f63c4d82e2ace0b2127c

                                                              SHA256

                                                              6d8565a9492c009133e03e01ec783153bf5b7ad57186128f4b41c8820d488adc

                                                              SHA512

                                                              31618172e10c9c492a9813e7063e6517e83f9f9f3297ac108b06a3f9d72d46ac08dfa98374f038731cd80c8329a393009c6d46fa809fadd05789aeb73927b6ab

                                                              Download Submit

                                                            • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                              Filesize

                                                              24.1MB

                                                              MD5

                                                              c4b9e78915c708e2d460b44ea0f08282

                                                              SHA1

                                                              be1746aac0018a2438ccf19d51d3f73272bdecfd

                                                              SHA256

                                                              dfc59be69aad6bbdfca9b5761122e013a4c5a4004b2e3114a708a445c1827350

                                                              SHA512

                                                              4b4e95890347654b1088d87a35980ff0966522ee4d5b42cdb0c80ed856ef353b0ad2d0a236e7963b5ea8166d2856b125288d4cfd17c68b7725e3d06b3c602166

                                                              Download Submit

                                                            • \??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{55288381-2d84-41b1-8d37-6a732a460169}_OnDiskSnapshotProp
                                                              Filesize

                                                              6KB

                                                              MD5

                                                              927d1ba801c7e7496e364ce9b783fe05

                                                              SHA1

                                                              f5fd44fa7da78cc7804e347da640828958cee8c4

                                                              SHA256

                                                              596828f66c1e42863963219e7c5d44dab0c8e2d7ab85b78a53f8423dbef4606d

                                                              SHA512

                                                              841152adaa036c1b701d936549229dd0f121b095a6daa8600fcaddfa080e87e2e6b437e903b3d989e07eca41e5725ec571e2bef7a4a9a56b95ffaba321a2c2b8

                                                              Download Submit

                                                            • memory/876-1679-0x000001F0A16A0000-0x000001F0A16C6000-memory.dmp

                                                              Filesize

                                                              152KB

                                                              Download

                                                            • memory/876-2300-0x000001F0A25C0000-0x000001F0A25F0000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/876-2178-0x000001F0A25C0000-0x000001F0A25F0000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/1316-1664-0x000001BCA6F90000-0x000001BCA6FA2000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/1316-1669-0x000001BCA77E0000-0x000001BCA77FC000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/1316-1707-0x000001BCC0120000-0x000001BCC01D2000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/1996-441-0x0000023C37180000-0x0000023C371B0000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/2240-1615-0x00000234155F0000-0x000002341560C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/2240-1578-0x00000234155D0000-0x00000234155E8000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/2240-1579-0x000002342DF40000-0x000002342DFF2000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/2240-1556-0x0000023414D80000-0x0000023414D8C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                              Download

                                                            • memory/2748-112-0x0000000004E70000-0x0000000004ED6000-memory.dmp

                                                              Filesize

                                                              408KB

                                                              Download

                                                            • memory/2864-1175-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/2864-1808-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/2864-1810-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/2864-2181-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/2864-1174-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/2864-1809-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/2864-1257-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/2864-1256-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/2864-1255-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/2864-2180-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/2864-1173-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/2864-2182-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/2876-345-0x00000296B6B00000-0x00000296B6B1C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/2876-343-0x00000296B66C0000-0x00000296B6724000-memory.dmp

                                                              Filesize

                                                              400KB

                                                              Download

                                                            • memory/2876-344-0x00000296CF7D0000-0x00000296CF81A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/2936-275-0x000002ECFEBF0000-0x000002ECFEC20000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/2936-166-0x000001B1F6490000-0x000001B1F64A2000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/2936-278-0x000002ECFFDC0000-0x000002ECFFE70000-memory.dmp

                                                              Filesize

                                                              704KB

                                                              Download

                                                            • memory/2936-279-0x000002ECFF470000-0x000002ECFF48C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/2936-193-0x000001B1F86F0000-0x000001B1F8720000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/2936-150-0x000001B1F6080000-0x000001B1F60A8000-memory.dmp

                                                              Filesize

                                                              160KB

                                                              Download

                                                            • memory/2936-162-0x000001B1F85A0000-0x000001B1F8638000-memory.dmp

                                                              Filesize

                                                              608KB

                                                              Download

                                                            • memory/2936-167-0x000001B1F8640000-0x000001B1F867C000-memory.dmp

                                                              Filesize

                                                              240KB

                                                              Download

                                                            • memory/2992-81-0x0000000004C40000-0x0000000004C62000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/2992-82-0x0000000004DC0000-0x0000000005114000-memory.dmp

                                                              Filesize

                                                              3.3MB

                                                              Download

                                                            • memory/2992-78-0x0000000004D00000-0x0000000004DB2000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/3472-301-0x000002AEF84A0000-0x000002AEF84B6000-memory.dmp

                                                              Filesize

                                                              88KB

                                                              Download

                                                            • memory/3472-303-0x000002AEF8E20000-0x000002AEF8E3C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/3472-302-0x000002AEF9650000-0x000002AEF9702000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/4368-43-0x0000000004DE0000-0x0000000004DEC000-memory.dmp

                                                              Filesize

                                                              48KB

                                                              Download

                                                            • memory/4368-39-0x0000000004DF0000-0x0000000004E1E000-memory.dmp

                                                              Filesize

                                                              184KB

                                                              Download

                                                            • memory/4384-1794-0x000001FD89320000-0x000001FD89332000-memory.dmp

                                                              Filesize

                                                              72KB

                                                              Download

                                                            • memory/4384-1795-0x000001FD89BC0000-0x000001FD89C0A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/4384-1796-0x000001FD896F0000-0x000001FD8970C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/4656-941-0x0000000010000000-0x0000000010114000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/4656-1048-0x0000000010000000-0x0000000010114000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/4656-1121-0x0000000010000000-0x0000000010114000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/4656-944-0x0000000003200000-0x00000000033C7000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/4656-436-0x00000000031C0000-0x0000000003387000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                              Download

                                                            • memory/4656-433-0x0000000010000000-0x0000000010114000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/5004-2407-0x000002188C400000-0x000002188C430000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/5048-1799-0x000001FEF41E0000-0x000001FEF4292000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5048-1676-0x000001FEF40C0000-0x000001FEF410A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/5048-1643-0x000001FEF3F20000-0x000001FEF3F6A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/5048-1644-0x000001FEF3250000-0x000001FEF326C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/5048-1801-0x000001FEF4380000-0x000001FEF445C000-memory.dmp

                                                              Filesize

                                                              880KB

                                                              Download

                                                            • memory/5048-1671-0x000001FEF3270000-0x000001FEF327A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/5048-1670-0x000001FEF3830000-0x000001FEF3848000-memory.dmp

                                                              Filesize

                                                              96KB

                                                              Download

                                                            • memory/5048-1641-0x000001FEF2E50000-0x000001FEF2E84000-memory.dmp

                                                              Filesize

                                                              208KB

                                                              Download

                                                            • memory/5068-195-0x000001866C4C0000-0x000001866C572000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5068-205-0x000001866C400000-0x000001866C422000-memory.dmp

                                                              Filesize

                                                              136KB

                                                              Download

                                                            • memory/5068-244-0x000001866CA00000-0x000001866CA38000-memory.dmp

                                                              Filesize

                                                              224KB

                                                              Download

                                                            • memory/5068-346-0x000001866C2B0000-0x000001866C2E0000-memory.dmp

                                                              Filesize

                                                              192KB

                                                              Download

                                                            • memory/5160-1646-0x000001E719350000-0x000001E719402000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5160-1640-0x000001E700170000-0x000001E700180000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/5160-1642-0x000001E7009B0000-0x000001E7009CE000-memory.dmp

                                                              Filesize

                                                              120KB

                                                              Download

                                                            • memory/5160-1666-0x000001E7009D0000-0x000001E7009E4000-memory.dmp

                                                              Filesize

                                                              80KB

                                                              Download

                                                            • memory/5160-1665-0x000001E719290000-0x000001E7192F6000-memory.dmp

                                                              Filesize

                                                              408KB

                                                              Download

                                                            • memory/5164-1191-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/5164-1274-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/5164-1273-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/5164-1272-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/5164-2334-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/5164-1192-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/5164-2336-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/5164-2335-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/5252-1791-0x0000025D74AF0000-0x0000025D74AFC000-memory.dmp

                                                              Filesize

                                                              48KB

                                                              Download

                                                            • memory/5252-1797-0x0000025D753B0000-0x0000025D753FA000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/5252-1804-0x0000025D75330000-0x0000025D7534C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/5464-1800-0x000001DCAE240000-0x000001DCAE2F2000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5464-1793-0x000001DC958F0000-0x000001DC95900000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/5464-1792-0x000001DC950C0000-0x000001DC950D0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/5464-1803-0x000001DC95920000-0x000001DC9593C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/5496-1673-0x000001BD6BC70000-0x000001BD6BCBA000-memory.dmp

                                                              Filesize

                                                              296KB

                                                              Download

                                                            • memory/5496-1798-0x000001BD6BFA0000-0x000001BD6C052000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5496-1789-0x000001BD6BEC0000-0x000001BD6BF9C000-memory.dmp

                                                              Filesize

                                                              880KB

                                                              Download

                                                            • memory/5496-1668-0x000001BD52B90000-0x000001BD52BA0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                              Download

                                                            • memory/5496-1674-0x000001BD533D0000-0x000001BD533EC000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/5576-631-0x000001B2E9B40000-0x000001B2E9B7A000-memory.dmp

                                                              Filesize

                                                              232KB

                                                              Download

                                                            • memory/5576-563-0x000001B2E9670000-0x000001B2E96B8000-memory.dmp

                                                              Filesize

                                                              288KB

                                                              Download

                                                            • memory/5576-562-0x000001B2E9620000-0x000001B2E966C000-memory.dmp

                                                              Filesize

                                                              304KB

                                                              Download

                                                            • memory/5576-565-0x000001B2E8D70000-0x000001B2E8D7A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/5576-564-0x000001B2E8D60000-0x000001B2E8D68000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/5576-575-0x000001B2E9920000-0x000001B2E99FC000-memory.dmp

                                                              Filesize

                                                              880KB

                                                              Download

                                                            • memory/5576-597-0x000001B2E9A00000-0x000001B2E9AB2000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5576-599-0x000001B2E96F0000-0x000001B2E96F8000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/5576-633-0x000001B2E9840000-0x000001B2E9866000-memory.dmp

                                                              Filesize

                                                              152KB

                                                              Download

                                                            • memory/5576-600-0x000001B2E9700000-0x000001B2E9708000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/5576-616-0x000001B2E9870000-0x000001B2E989A000-memory.dmp

                                                              Filesize

                                                              168KB

                                                              Download

                                                            • memory/5576-614-0x000001B2E98B0000-0x000001B2E9918000-memory.dmp

                                                              Filesize

                                                              416KB

                                                              Download

                                                            • memory/5576-613-0x000001B2E9710000-0x000001B2E9718000-memory.dmp

                                                              Filesize

                                                              32KB

                                                              Download

                                                            • memory/5792-1788-0x000001BBE7C70000-0x000001BBE7C8A000-memory.dmp

                                                              Filesize

                                                              104KB

                                                              Download

                                                            • memory/5792-1790-0x000001BC00000000-0x000001BC000B2000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download

                                                            • memory/5792-1787-0x000001BBE7430000-0x000001BBE743A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                              Download

                                                            • memory/5804-1680-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/5804-1194-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/5804-1196-0x0000000072780000-0x0000000072B44000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                              Download

                                                            • memory/5804-1195-0x0000000072B50000-0x0000000072C6C000-memory.dmp

                                                              Filesize

                                                              1.1MB

                                                              Download

                                                            • memory/5804-1826-0x0000000072C70000-0x0000000072D6D000-memory.dmp

                                                              Filesize

                                                              1012KB

                                                              Download

                                                            • memory/6040-1706-0x00000248A2EC0000-0x00000248A2F08000-memory.dmp

                                                              Filesize

                                                              288KB

                                                              Download

                                                            • memory/6040-1675-0x000002488A620000-0x000002488A63C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                              Download

                                                            • memory/6040-1539-0x0000024889D10000-0x0000024889D4A000-memory.dmp

                                                              Filesize

                                                              232KB

                                                              Download

                                                            • memory/6040-1672-0x00000248A2F80000-0x00000248A3032000-memory.dmp

                                                              Filesize

                                                              712KB

                                                              Download