Overview

overview

10

Static

static

10

Arquivo_9126034.msi

windows7-x64

10

Arquivo_9126034.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 16:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Arquivo_9126034.msi

  • Size

    2.9MB

  • MD5

    64585a798dd0bea132febaa7cda9ab86

  • SHA1

    45b16e677e32a61fab1ec0c7c229b37134dac718

  • SHA256

    9d69ae8da13e65fc49ce5a7a5936a3b2441e78fbe6e134315fab2cd1e820f731

  • SHA512

    a048308fbe3f4687799db105d3c7bb1abbc65f4811c685393f9bee105c81e22e25b1dc2e73968ae32523a159ecc40a476b3f46791cbd156ea81a09e2b658bbb9

  • SSDEEP

    49152:3+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:3+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Arquivo_9126034.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3472
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:548
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 39848B16E0EC9F1676095D75C454CFCE
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2676
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI328.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240649406 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4988
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI80B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240650296 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1160
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIEB3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651984 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1468
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI1E19.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240655968 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4812
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3AF5A7AF1083C3399EAC37D8FE247387 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4652
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3992
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1356
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000LlkxmIAB" /AgentId="fe4a5221-b155-4ec6-92dc-916bf0fd84e3"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4176
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7BF980FEC4C201D03F69BB4523DC2857 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:5584
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{639DB4D3-44A6-4B06-B07C-882172C2C10F}
          3⤵
          • Executes dropped EXE
          PID:6004
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0BD304AA-569F-4BCF-978C-01E6DCD3E45A}
          3⤵
          • Executes dropped EXE
          PID:6040
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{19AEC294-BBA9-4A00-A932-89F7EE1C55B7}
          3⤵
          • Executes dropped EXE
          PID:6072
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1EE860B6-DF59-4644-85B5-7FD284C00F19}
          3⤵
          • Executes dropped EXE
          PID:6104
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92D5AF8D-1E98-4B75-B591-0F905E8B8FF1}
          3⤵
          • Executes dropped EXE
          PID:6136
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{88DD5F80-FABA-4F77-8630-E4007A7409F4}
          3⤵
          • Executes dropped EXE
          PID:5224
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B645BBC3-8284-431B-9885-C0DACDF2EC26}
          3⤵
          • Executes dropped EXE
          PID:4436
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C78B247-A802-4F84-B799-089A75FC66A3}
          3⤵
          • Executes dropped EXE
          PID:5228
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61450A00-4336-4A91-A294-E0B397357EAE}
          3⤵
          • Executes dropped EXE
          PID:5256
        • C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe
          C:\Windows\TEMP\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_is5D3E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C9F65445-45BD-4BE8-B5DE-6E7C4BF9824B}
          3⤵
          • Executes dropped EXE
          PID:5296
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:432
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1584
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5376
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5452
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5472
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5632
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5416
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4828
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5320
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5552
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5728
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5788
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5820
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5900
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5992
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6004
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:6048
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6116
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1480
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2776
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{406CEDCB-B3D5-4BDA-9901-CF18EE15CFBF}
          3⤵
          • Executes dropped EXE
          PID:1580
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A6DE9B99-BF47-4E01-B0F4-BB80D3BC675E}
          3⤵
          • Executes dropped EXE
          PID:5848
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D2E79B6-1246-4437-842E-9C7CC3C0656E}
          3⤵
          • Executes dropped EXE
          PID:5840
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35F38A56-D854-471B-A511-608F99C80370}
          3⤵
          • Executes dropped EXE
          PID:5356
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D07A87B3-C1BB-4867-B6A9-7BFF8451F97A}
          3⤵
          • Executes dropped EXE
          PID:2160
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE1D1C3D-39B1-429A-839E-B59339011FD7}
          3⤵
          • Executes dropped EXE
          PID:5400
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6CDCA86-6A9B-4372-9B0F-3DAFB78431C3}
          3⤵
          • Executes dropped EXE
          PID:5548
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB6F4E11-1E08-46D2-8950-2E1BE1C14C22}
          3⤵
          • Executes dropped EXE
          PID:5620
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B2B96863-C397-4247-9FE0-31978C208A16}
          3⤵
          • Executes dropped EXE
          PID:4684
        • C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
          C:\Windows\TEMP\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{466A9456-2F83-4E01-BE0E-CEC41A6E6A42}
          3⤵
          • Executes dropped EXE
          PID:4064
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{10AF2AA5-A029-43B2-884A-74970F86CCEE}
          3⤵
          • Executes dropped EXE
          PID:4520
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4209A7A9-6A18-47DD-9E26-66E522DB5B91}
          3⤵
          • Executes dropped EXE
          PID:3544
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4017171-AA38-499C-8243-7EE8C2894633}
          3⤵
          • Executes dropped EXE
          PID:1028
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8E14CFDC-68B1-4320-BB9F-0AE14AC9644F}
          3⤵
          • Executes dropped EXE
          PID:4436
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41D4016F-1FFD-41F4-8006-843C333E3039}
          3⤵
          • Executes dropped EXE
          PID:5672
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{279F945A-B232-45AA-AFB9-1FC9C23827C6}
          3⤵
          • Executes dropped EXE
          PID:5844
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{93D7CCD0-08C7-4E76-BA77-186D344DEF17}
          3⤵
          • Executes dropped EXE
          PID:2852
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CE2EA92-D0CB-478A-97C4-5EB6FB6024A1}
          3⤵
          • Executes dropped EXE
          PID:5704
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{581FA7C1-60CD-48DB-A6F3-1AB615F920FD}
          3⤵
          • Executes dropped EXE
          PID:5368
        • C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe
          C:\Windows\TEMP\{2FCEAC73-07A5-400D-AB1F-FDE75A101443}\_is8896.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF6491E6-A284-44F9-BEBD-40BACD029FC3}
          3⤵
          • Executes dropped EXE
          PID:1304
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3740
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4040
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:4296
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:1300
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:5892
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5180
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5AFC24A3-B327-4952-B6CD-A43261D5E60C}
              3⤵
              • Executes dropped EXE
              PID:5264
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4E9A320-AA8D-406B-83C7-7AAC3DD7A6FE}
              3⤵
              • Executes dropped EXE
              PID:5256
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF348D7D-DA77-4218-AACC-3E838A07D35A}
              3⤵
              • Executes dropped EXE
              PID:1892
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E7B2B14-155F-4F8D-9EA4-D71B666B1CD4}
              3⤵
              • Executes dropped EXE
              PID:4780
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{23381F43-B75B-4AD1-AFE8-43DD8717527B}
              3⤵
              • Executes dropped EXE
              PID:3596
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8475667-EF67-4B19-90EB-736D95EEF472}
              3⤵
              • Executes dropped EXE
              PID:4768
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1BDC40C-F2C6-4570-B578-D1255A205E3B}
              3⤵
              • Executes dropped EXE
              PID:5616
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{252A4722-588B-46D8-B323-CA0250D4E418}
              3⤵
              • Executes dropped EXE
              PID:2676
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7527E8D5-E9D3-4FA6-A418-B8DE25C1920B}
              3⤵
              • Executes dropped EXE
              PID:2736
            • C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe
              C:\Windows\TEMP\{385ABED4-59E5-4D54-8369-5752373B6291}\_is9D87.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8476128-A836-4DB3-986A-A0A64545009D}
              3⤵
              • Executes dropped EXE
              PID:4064
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3244
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D807B27B-6818-4E51-AC63-9CE800FAF150}
              3⤵
              • Executes dropped EXE
              PID:5800
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BE3EC793-0F6A-4E90-A4E9-16CF57446AB1}
              3⤵
              • Executes dropped EXE
              PID:5012
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{905534F5-6D56-4F2A-A7CD-3FDDA0EAA958}
              3⤵
              • Executes dropped EXE
              PID:3192
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{851AF861-6DBA-4F14-9136-BFD2444A23D0}
              3⤵
              • Executes dropped EXE
              PID:1424
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95D391A5-0B76-49BA-8F2A-7D781D32B4FD}
              3⤵
              • Executes dropped EXE
              PID:5736
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{386067BB-EED3-4D27-B963-CF1D0178193D}
              3⤵
              • Executes dropped EXE
              PID:5852
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5C5C161D-0BC9-438D-92A8-AE76DE3AF2B9}
              3⤵
              • Executes dropped EXE
              PID:3468
            • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
              C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3B395C2C-94F7-4602-AD57-ED7249D5505A}
              3⤵
                PID:4992
              • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
                C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B53095CE-E3A1-44EE-9959-B0D57FDC0364}
                3⤵
                  PID:2932
                • C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe
                  C:\Windows\TEMP\{316E77E2-2C9D-4150-A7EF-7819385CFA6C}\_isA1ED.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B92C9E3-8BCE-4970-9D17-D50893A79058}
                  3⤵
                    PID:5252
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3900
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding AD8530C4FE3353F2DDF75E82F301F65C E Global\MSI0000
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1304
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIDACD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240704484 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                    3⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4148
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIDE39.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240705078 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:4364
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIE34B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240706375 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5944
                  • C:\Windows\SysWOW64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3192
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2564
                  • C:\Windows\SysWOW64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:4148
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:748
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4148
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:1936
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSIE1D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240717328 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5244
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                  2⤵
                  • Drops file in System32 directory
                  PID:1480
                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                  "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="c538a870-7b12-4f21-95f8-e9451ea98e3c"
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:4252
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:5092
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4644
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:2484
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "04bf48a3-de50-4884-9dc1-8af1e75e23e4" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in System32 directory
                  • Executes dropped EXE
                  PID:2484
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "07a8a16a-86b2-4aee-8282-f4f936c84ab4" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  PID:1868
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "49ab856e-1a5e-4f1b-b5ed-5739a6157543" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  PID:3900
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "0bf0a628-cf64-4645-b1a0-aeaedbbaffb9" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3244
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1120
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:2676
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "9f2c187e-aeaf-46d2-a688-ee7f9ee78080" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4888
                  • C:\Windows\TEMP\SplashtopStreamer.exe
                    "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:5132
                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                      "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:5384
                      • C:\Windows\SysWOW64\msiexec.exe
                        msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:5488
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "34500e62-181e-44c0-bed8-fdf386b7bf8d" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3588
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                1⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3292
                • C:\Windows\System32\sc.exe
                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                  2⤵
                  • Launches sc.exe
                  PID:1304
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "34500e62-181e-44c0-bed8-fdf386b7bf8d" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000LlkxmIAB
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5904
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "c355f2ad-df6f-47f7-a226-c8dca0cda180" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000LlkxmIAB
                  2⤵
                  • Drops file in Program Files directory
                  • Modifies data under HKEY_USERS
                  PID:1088
                  • C:\Windows\SYSTEM32\msiexec.exe
                    "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:5320
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "dbbcb777-b498-4f05-ae2b-e3fdc784942f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000LlkxmIAB
                  2⤵
                    PID:4584
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      3⤵
                        PID:5412
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          4⤵
                            PID:3900
                          • C:\Windows\system32\cscript.exe
                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            4⤵
                            • Modifies data under HKEY_USERS
                            PID:4600
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "828ca999-1f0e-42dc-91b6-4543d74e9a44" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000LlkxmIAB
                        2⤵
                        • Writes to the Master Boot Record (MBR)
                        • Modifies data under HKEY_USERS
                        PID:5756
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "3f9ccd66-9dbd-4346-8472-5bf896b54b0a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000LlkxmIAB
                        2⤵
                          PID:5456
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "8414714c-9423-4b1b-9782-118b2191805a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000LlkxmIAB
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          PID:5420
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "f3299d17-0eb3-48b2-8c16-4b2a2076f1f4" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000LlkxmIAB
                          2⤵
                            PID:5640
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "bf67dc1d-5150-442d-a690-4bca12ba3cda" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000LlkxmIAB
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            PID:5792
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "bae66366-8d1a-4617-a3fe-00481219a243" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000LlkxmIAB
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            PID:3192
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:432
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:2776
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "5732e81d-a015-40c2-8de1-902270a79562" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000LlkxmIAB
                            2⤵
                              PID:5360
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "34f871e7-2367-4236-88e6-05a6e0d9b440" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000LlkxmIAB
                              2⤵
                                PID:2592
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "fafc65c1-5d61-41bd-960b-a729dd810c13" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000LlkxmIAB
                                2⤵
                                  PID:2368
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=3aa892469ce1d37e6d867ab1ffe3d894&rmm_session_pwd_ttl=86400"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6112
                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "fa36f470-49f7-4575-980c-ee4e2dee78a9" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000LlkxmIAB
                                  2⤵
                                    PID:1888
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "021b3eef-94a8-4135-99de-71bd42a8fabb" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000LlkxmIAB
                                    2⤵
                                    • Drops file in System32 directory
                                    PID:504
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "77d929f0-65b0-43b8-bb67-78b58dc58999" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000LlkxmIAB
                                    2⤵
                                    • Drops file in System32 directory
                                    • Drops file in Program Files directory
                                    • Modifies registry class
                                    PID:6072
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                  1⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3404
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                    2⤵
                                    • Drops file in System32 directory
                                    • Drops file in Program Files directory
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Modifies data under HKEY_USERS
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4400
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                      -h -t
                                      3⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5684
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                      3⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3568
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                        4⤵
                                          PID:5404
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4064
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5980
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                          SRUtility.exe -r
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5648
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2572
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                          4⤵
                                            PID:2936
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ver
                                              5⤵
                                                PID:5912
                                              • C:\Windows\system32\sc.exe
                                                sc query ddmgr
                                                5⤵
                                                • Launches sc.exe
                                                PID:5792
                                              • C:\Windows\system32\sc.exe
                                                sc query lci_proxykmd
                                                5⤵
                                                • Launches sc.exe
                                                PID:5168
                                              • C:\Windows\system32\rundll32.exe
                                                rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                                5⤵
                                                • Drops file in Windows directory
                                                • Checks SCSI registry key(s)
                                                • Modifies data under HKEY_USERS
                                                PID:4364
                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                        1⤵
                                        • Drops file in Program Files directory
                                        • Modifies data under HKEY_USERS
                                        PID:1376
                                        • C:\Windows\System32\sc.exe
                                          "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                          2⤵
                                          • Launches sc.exe
                                          PID:5236
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "4f397166-56cb-456d-a87a-e1d8698e1d49" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000LlkxmIAB
                                          2⤵
                                            PID:820
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "13947b97-a0cd-4032-bd6a-33e8fb3ca1b2" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000LlkxmIAB
                                            2⤵
                                              PID:1064
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                3⤵
                                                  PID:6964
                                                  • C:\Windows\system32\cscript.exe
                                                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                    4⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:7132
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "e08976a6-d56b-47ac-b1be-99b6f8a44f32" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000LlkxmIAB
                                                2⤵
                                                  PID:4864
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "e29a0767-4e27-40fd-adbe-28959719fcfb" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000LlkxmIAB
                                                  2⤵
                                                    PID:5532
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "1715dd25-044b-464a-bff5-5110ee87a501" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000LlkxmIAB
                                                    2⤵
                                                      PID:2248
                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=3aa892469ce1d37e6d867ab1ffe3d894&rmm_session_pwd_ttl=86400"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5408
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "59e2be28-4812-4e21-83e9-c812c67065d1" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000LlkxmIAB
                                                      2⤵
                                                        PID:6212
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                          3⤵
                                                          • System Time Discovery
                                                          PID:7036
                                                          • C:\Program Files\dotnet\dotnet.exe
                                                            dotnet --list-runtimes
                                                            4⤵
                                                            • System Time Discovery
                                                            PID:5528
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "7430c793-f029-486d-8f95-88ec9ab37044" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000LlkxmIAB
                                                        2⤵
                                                          PID:6228
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "0113ffcd-4d7c-4377-af8e-690c5ef6bfbe" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000LlkxmIAB
                                                          2⤵
                                                            PID:6648
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "e673dcc2-3462-4370-ac8b-ad41e993ec49" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000LlkxmIAB
                                                            2⤵
                                                              PID:6916
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "bb23783a-03c4-458c-a01d-dacd73821b4d" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000LlkxmIAB
                                                              2⤵
                                                                PID:5740
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "68b6dba8-c56f-4f44-a7e9-ac563aa7c593" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000LlkxmIAB
                                                                2⤵
                                                                  PID:4452
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "84c84bda-c23f-495b-b3a7-8eb42539a43c" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000LlkxmIAB
                                                                  2⤵
                                                                  • Writes to the Master Boot Record (MBR)
                                                                  PID:2260
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" fe4a5221-b155-4ec6-92dc-916bf0fd84e3 "95da37cb-df53-4a0d-b744-537dcf1f356f" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000LlkxmIAB
                                                                  2⤵
                                                                  • Modifies registry class
                                                                  PID:6192
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                PID:5524
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:1940
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:5340
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000170"
                                                                  2⤵
                                                                  • Drops file in Drivers directory
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:4676
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                  2⤵
                                                                  • Drops file in Drivers directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:4960

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Installer Packages

                                                              1
                                                              T1546.016

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Privilege Escalation

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Installer Packages

                                                              1
                                                              T1546.016

                                                              Defense Evasion

                                                              Modify Registry

                                                              1
                                                              T1112

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Subvert Trust Controls

                                                              1
                                                              T1553

                                                              Install Root Certificate

                                                              1
                                                              T1553.004

                                                              System Binary Proxy Execution

                                                              1
                                                              T1218

                                                              Msiexec

                                                              1
                                                              T1218.007

                                                              Credential Access

                                                              Discovery

                                                              Peripheral Device Discovery

                                                              2
                                                              T1120

                                                              Query Registry

                                                              4
                                                              T1012

                                                              System Information Discovery

                                                              3
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Config.Msi\e58026d.rbs
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                30d91914785d1ba3d0f8c92da556d4f1

                                                                SHA1

                                                                6c7c2c82c33eaeca7be52ec6a9992b2f806638cb

                                                                SHA256

                                                                c479ea19bb3a66d6a4e82e72a7d0c81a61862a17a20e553e5bedf8756ba865f0

                                                                SHA512

                                                                47fdddfbef47cd955122a5d105a0f8c413204cfe5d383511eaf8840ac7f796b078c5cded01051bb636a5889136e1b571d873d9bfd610056bed1f7fdac07d10b0

                                                                Download Submit

                                                              • C:\Config.Msi\e580272.rbs
                                                                Filesize

                                                                74KB

                                                                MD5

                                                                c56fd3303eac82bf72d02b412a7f23cd

                                                                SHA1

                                                                909145059b6e4265ef452cd9c2979176f05e5000

                                                                SHA256

                                                                4b1a2d0fd6d0b3da8089a3ca8dd46b253664d65a77b8cd19aea9593e17289b37

                                                                SHA512

                                                                ef9dc5ed94a24acb416e465429115db6fd8a6daf197d8d0c8295f0b8de05ab19e590bdb7d23bc9a775089089bab8beb49253c26745a96d547d4a4ec4d26ab9c3

                                                                Download Submit

                                                              • C:\Config.Msi\e580274.rbs
                                                                Filesize

                                                                464B

                                                                MD5

                                                                6f730106610761d66b437d2643fc9caa

                                                                SHA1

                                                                833ab4a3c9d8f28bfaa8d94c5c3b5cd913d839d2

                                                                SHA256

                                                                19b623de303a410aaa57187a534336b3a7b746906cb4ef3a06559fd559a28d7f

                                                                SHA512

                                                                a7b5b48271b084856b959736629be25ba0f7e6baeee4882f89e0a107cfd69fc2b6a5c8603dd7e9516f83b8faf952e6bb3f84e5b5638faa9cb2c11e958f7cf669

                                                                Download Submit

                                                              • C:\Config.Msi\e58027a.rbs
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                b3356a53c95d0069857cfa59923f835f

                                                                SHA1

                                                                f860bbddbda3523ddb412d9dabefa4421f08035b

                                                                SHA256

                                                                af5be0c3cd901f711ace8958233925451add576567f40b118afdbf8670a2f96a

                                                                SHA512

                                                                b76998fc39f1c8d748baa67616db5cb5ea5f57b1c9c193d46d83fdad35e8d1e68d7567d5aa2cd7f65f594e04f90c851ffee8eed123af275e663f2b37fb55cd7e

                                                                Download Submit

                                                              • C:\Config.Msi\e580282.rbs
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                db66024f68c06d65228895c7ffecd8fd

                                                                SHA1

                                                                9c03fa4aca10c73ff551675679f6e68f46fbe15a

                                                                SHA256

                                                                6ef47d8100510640e34f76136ac6b610a5f1be4890f7b5348521eaaed36da96f

                                                                SHA512

                                                                02c818492bc52b74f8bff5c5bad73c54cdc843285627da7729c27116db874683ee1c9344753378ddb3b3c50651d8d76589c58b940cacb34c10f4981020380223

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                3840b31c383fdf49bfd6740d945c9032

                                                                SHA1

                                                                a6f50164a69718bcef4664d7c47534f0d721866a

                                                                SHA256

                                                                1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                                SHA512

                                                                f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                Filesize

                                                                142KB

                                                                MD5

                                                                477293f80461713d51a98a24023d45e8

                                                                SHA1

                                                                e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                SHA256

                                                                a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                SHA512

                                                                23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                b3bb71f9bb4de4236c26578a8fae2dcd

                                                                SHA1

                                                                1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                SHA256

                                                                e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                SHA512

                                                                fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                Filesize

                                                                210KB

                                                                MD5

                                                                c106df1b5b43af3b937ace19d92b42f3

                                                                SHA1

                                                                7670fc4b6369e3fb705200050618acaa5213637f

                                                                SHA256

                                                                2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                SHA512

                                                                616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                Filesize

                                                                693KB

                                                                MD5

                                                                2c4d25b7fbd1adfd4471052fa482af72

                                                                SHA1

                                                                fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                SHA256

                                                                2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                SHA512

                                                                f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                Filesize

                                                                157KB

                                                                MD5

                                                                57130702f8ea46ed0437ea893c95f7e4

                                                                SHA1

                                                                0e26c3ef0ec0be063aacd7321ee550e321bad17f

                                                                SHA256

                                                                9338c8080cb7be1ee73f1cd706e5e230a0c3b8690305cd9de451fad20b2d0b7b

                                                                SHA512

                                                                10951c367ac35dba9d644fb1cc07043fc238f4cad5ab2280cc1102e860676e1bc4b3a88054f252e26aa9b9e2b52c8941c2d47e1e79d153b4ee3780151c73a02c

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                Filesize

                                                                51KB

                                                                MD5

                                                                3180c705182447f4bcc7ce8e2820b25d

                                                                SHA1

                                                                ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                SHA256

                                                                5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                SHA512

                                                                228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                Filesize

                                                                12B

                                                                MD5

                                                                dc63026e80d2bb04f71e41916f807e33

                                                                SHA1

                                                                6cda386d2c365f94ea3de41e2390fd916622eb51

                                                                SHA256

                                                                3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                                SHA512

                                                                61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                Filesize

                                                                173KB

                                                                MD5

                                                                31def444e6135301ea3c38a985341837

                                                                SHA1

                                                                f135be75c721af2d5291cb463cbc22a32467084a

                                                                SHA256

                                                                36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                                SHA512

                                                                bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                Filesize

                                                                546B

                                                                MD5

                                                                158fb7d9323c6ce69d4fce11486a40a1

                                                                SHA1

                                                                29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                SHA256

                                                                5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                SHA512

                                                                7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                Filesize

                                                                688KB

                                                                MD5

                                                                ba66874c510645c1fb5fe74f85b32e98

                                                                SHA1

                                                                e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                                SHA256

                                                                12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                                SHA512

                                                                44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                Filesize

                                                                27KB

                                                                MD5

                                                                797c9554ec56fd72ebb3f6f6bef67fb5

                                                                SHA1

                                                                40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                SHA256

                                                                7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                SHA512

                                                                4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                Filesize

                                                                214KB

                                                                MD5

                                                                01807774f043028ec29982a62fa75941

                                                                SHA1

                                                                afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                SHA256

                                                                9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                SHA512

                                                                33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                Filesize

                                                                37KB

                                                                MD5

                                                                efb4712c8713cb05eb7fe7d87a83a55a

                                                                SHA1

                                                                c94d106bba77aecf88540807da89349b50ea5ae7

                                                                SHA256

                                                                30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                SHA512

                                                                3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                Filesize

                                                                3.4MB

                                                                MD5

                                                                e010d1f614b1a830482d3df4ba056f24

                                                                SHA1

                                                                5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                SHA256

                                                                98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                SHA512

                                                                727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                Filesize

                                                                389KB

                                                                MD5

                                                                5e3252e0248b484e76fcdbf8b42a645d

                                                                SHA1

                                                                11ae92fd16ac87f6ab755911e85e263253c16516

                                                                SHA256

                                                                01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                SHA512

                                                                540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                56KB

                                                                MD5

                                                                543ff4d1bcfc30414278319695939d60

                                                                SHA1

                                                                f495e12a6434165f235b5ee76705f01660fcd2f7

                                                                SHA256

                                                                1a1571d0e616074389dc0e6c459bcd00ce552b8a6140133cf42db1fb37656e02

                                                                SHA512

                                                                4c4b2df84026f77a6af7a36740cdc62dcbf6a15594c84b289dc46201b4fedad955f8e682090c7f4ac4c410e6e33b779a0c7153b843a651a638f9cb5d00ec3218

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                Filesize

                                                                195KB

                                                                MD5

                                                                84cb0cf784734c3ee8c151bc54f77b6e

                                                                SHA1

                                                                6f300359be48f38ca18ea54d744566635fd13e6f

                                                                SHA256

                                                                adacab8ac34991a5b4908aafb21a9d0eef3a24b4a44ac6b48a1ac745623eb2a9

                                                                SHA512

                                                                0c628ebab1720a02b2d2dee52c805f17b986f3c46a8c91bac6c67d7a7faf155dcb1c0a46e208d5b1b7d913f26e81b037e2b9e83d25e65c86cbca249b26866e34

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                Filesize

                                                                55KB

                                                                MD5

                                                                782c1cd802fda2a3b2269a2f79dd28a7

                                                                SHA1

                                                                af3188fe28c00c1d7a61f55b1ea8abea0b5f285d

                                                                SHA256

                                                                1e9e75811d36db0346bef3ddf0263a6c303b5c9447e746f5a0e6a03b6b328ef8

                                                                SHA512

                                                                bebb2e8f3af641c726652b659cf14928916aa13c6fc10400b6f473640e65bdc46aee44b116cd82bc9f5840b2786ffc6b5761691c4457d0899cb53992d749b273

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                9d1528a2ce17522f6de064ae2c2b608e

                                                                SHA1

                                                                2f1ce8b589e57ab300bb93dde176689689f75114

                                                                SHA256

                                                                11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                SHA512

                                                                a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5792.update
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                14ffcf07375b3952bd3f2fe52bb63c14

                                                                SHA1

                                                                ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                SHA256

                                                                6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                SHA512

                                                                14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                Filesize

                                                                7KB

                                                                MD5

                                                                16c55a97106f72dfece38fd70791981c

                                                                SHA1

                                                                50d0a4a38a10d0ea4bac85a76bddb2205c82d1ed

                                                                SHA256

                                                                40b2a2ffc9a62ab65fafa444a70d2e41d6f0c1e01129b71218c403b77544e3af

                                                                SHA512

                                                                0573e597d65ab35f5470b143b2292709c715eedaa09dae4ec6d29ad9f7046e57fda3633f5b59100e1169ebac0b0a261039ec1af15bf9f7dd379004d2aaf517da

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                Filesize

                                                                2B

                                                                MD5

                                                                81051bcc2cf1bedf378224b0a93e2877

                                                                SHA1

                                                                ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                SHA256

                                                                7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                SHA512

                                                                1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                Filesize

                                                                54KB

                                                                MD5

                                                                77c613ffadf1f4b2f50d31eeec83af30

                                                                SHA1

                                                                76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                SHA256

                                                                2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                SHA512

                                                                29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                Filesize

                                                                334KB

                                                                MD5

                                                                b3e14504a48bed32c53ec7aab2cb2c8f

                                                                SHA1

                                                                0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                                SHA256

                                                                adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                                SHA512

                                                                e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                Filesize

                                                                72KB

                                                                MD5

                                                                749c51599fbf82422791e0df1c1e841c

                                                                SHA1

                                                                bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                                SHA256

                                                                c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                                SHA512

                                                                f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                Filesize

                                                                50KB

                                                                MD5

                                                                c0f02eaa3eb28659d8f1bcba8de48479

                                                                SHA1

                                                                5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                                SHA256

                                                                6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                                SHA512

                                                                47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                Filesize

                                                                32KB

                                                                MD5

                                                                097726da90e126fcc3202f1e386cf2f4

                                                                SHA1

                                                                e1f8e7b0d399ec568ac2a47e41bb004d1dd2f2e0

                                                                SHA256

                                                                8f95244aee9389ad0eee52a25f6a9ed67561f504d7eaca085bea5be94e12b724

                                                                SHA512

                                                                547b6f21e6b8767af1f4437cc806f5388538c55f9f9269dd7880ee63d1c98785a23ee8361ae46133937d715e5f3499b073a5c0fe7aa6594aa4289c4792abcff5

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                Filesize

                                                                54KB

                                                                MD5

                                                                d11b2139d29e79d795054c3866898b7f

                                                                SHA1

                                                                020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                                SHA256

                                                                11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                                SHA512

                                                                de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                Filesize

                                                                588KB

                                                                MD5

                                                                17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                SHA1

                                                                bc0316e11c119806907c058d62513eb8ce32288c

                                                                SHA256

                                                                13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                SHA512

                                                                f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                Download Submit

                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                Filesize

                                                                238B

                                                                MD5

                                                                51fc37a51517474c959d5d94a7771d0c

                                                                SHA1

                                                                90e6f275504fa1e18ba0a813bfd0823ef29b9128

                                                                SHA256

                                                                7f8048345b19b4c7ce70f9d4e365a4d7a6fedbac173df7750aa1ef6141d6fee0

                                                                SHA512

                                                                f025644ff741332d4e0c7d00eb26de7ecb6f86409c70b8c08b9b1737d0653f32b8c05c9844b3b40dd284ecfb37bbd6fdd35e62c49488b7f629233ed95133da20

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                1ef7574bc4d8b6034935d99ad884f15b

                                                                SHA1

                                                                110709ab33f893737f4b0567f9495ac60c37667c

                                                                SHA256

                                                                0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                SHA512

                                                                947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                f512536173e386121b3ebd22aac41a4e

                                                                SHA1

                                                                74ae133215345beaebb7a95f969f34a40dda922a

                                                                SHA256

                                                                a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                SHA512

                                                                1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                Filesize

                                                                76KB

                                                                MD5

                                                                b40fe65431b18a52e6452279b88954af

                                                                SHA1

                                                                c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                SHA256

                                                                800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                SHA512

                                                                e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                Filesize

                                                                80KB

                                                                MD5

                                                                3904d0698962e09da946046020cbcb17

                                                                SHA1

                                                                edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                SHA256

                                                                a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                SHA512

                                                                c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                Download Submit

                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                Filesize

                                                                88KB

                                                                MD5

                                                                ab93c81243b718773b76968ec8ff67f0

                                                                SHA1

                                                                aaf7d80b464c97b472d4b3f90679a9dcadb8a533

                                                                SHA256

                                                                3464f0e45e8b07266343b828b301566aaf65e8dac0abd8d5eaeb916ca711e4f3

                                                                SHA512

                                                                e478ab349dca7ca72d29db09d9349b3553077ccc67503a155fe6b711b917445a8a5803945fd34f548e485a7d021df23de747895f9911c6e7d34bed9027015b5d

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                Filesize

                                                                287B

                                                                MD5

                                                                fcad4da5d24f95ebf38031673ddbcdb8

                                                                SHA1

                                                                3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                                SHA256

                                                                7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                                SHA512

                                                                1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                Filesize

                                                                7KB

                                                                MD5

                                                                362ce475f5d1e84641bad999c16727a0

                                                                SHA1

                                                                6b613c73acb58d259c6379bd820cca6f785cc812

                                                                SHA256

                                                                1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                SHA512

                                                                7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                e0b94ce5d948f332b6bcb4661b73611b

                                                                SHA1

                                                                a9272bd639ff5f25f44b3a31c5cb919f0d40c4d3

                                                                SHA256

                                                                a27b758c00eab6777ac9571ef4fcdb80abaccbc4eb6fa5ff8e5ec33c08ffbc37

                                                                SHA512

                                                                17b5df8ea6ccbb64839e5d223ed388a3bb54c0a7974e05e285361e36489d63f9e4a5f0da21cdf86c58dbe80903e8cb288817291dce4c7e98e8e8ce8a0b912b46

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                9a9b1fd85b5f1dcd568a521399a0d057

                                                                SHA1

                                                                34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                SHA256

                                                                88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                SHA512

                                                                7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                Filesize

                                                                375KB

                                                                MD5

                                                                3c93b399b417b0d6a232d386e65a8b46

                                                                SHA1

                                                                bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                                SHA256

                                                                29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                                SHA512

                                                                a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                Filesize

                                                                321KB

                                                                MD5

                                                                d3901e62166e9c42864fe3062cb4d8d5

                                                                SHA1

                                                                c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                SHA256

                                                                dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                SHA512

                                                                ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                Filesize

                                                                814KB

                                                                MD5

                                                                9b1f97a41bfb95f148868b49460d9d04

                                                                SHA1

                                                                768031d5e877e347a249dfdeab7c725df941324b

                                                                SHA256

                                                                09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                SHA512

                                                                9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                e74d2a16da1ddb7f9c54f72b8a25897c

                                                                SHA1

                                                                32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                SHA256

                                                                a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                SHA512

                                                                52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                Filesize

                                                                12B

                                                                MD5

                                                                5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                                SHA1

                                                                93012724e6cc0a298838aede678806e6c0c6517d

                                                                SHA256

                                                                a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                                SHA512

                                                                890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                14a7011be9c1306303cf6aec7e327165

                                                                SHA1

                                                                94104217327cb78fb52bd93b3b9967f47de15454

                                                                SHA256

                                                                4763d35228ea74156b96544313c39c483524813b8f631ce845b8416e950c47f8

                                                                SHA512

                                                                3e49f9f171862a4af2702f7f91ed45a60b3bf07d52be46b3d310e0a097ecd3cc2aa09c6f617194c720f414fb40b7083c16955c19f888d7aea5b75e258351e438

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                Filesize

                                                                48KB

                                                                MD5

                                                                a684b47d95596cd6e06ee119fd54f7a3

                                                                SHA1

                                                                ea21e51e0e3226e2acaf86d67dc8bd067d02069a

                                                                SHA256

                                                                3d81343f4bf62a4f59587cfaa1164e9618e465c437c8b2a67045578d5aa06189

                                                                SHA512

                                                                299e8fe68c22efc50d2abac0e216f78619fb03e21f4e7b72fa837b5e8314c923dab93f93bca6ae3b66a84a539360a9bc3d204f1597aa5ee7ac1bded649264db7

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                Filesize

                                                                2.8MB

                                                                MD5

                                                                05974ad24d0fc5005fd90ca96941beaa

                                                                SHA1

                                                                7ccf99236729a614ca0d15b7e5a18ece0dd14242

                                                                SHA256

                                                                30215a902c746227df0d5fed400eaf74a5c1e827d50eec7c21cd37ea1b299aa5

                                                                SHA512

                                                                c9426d56833d61a1763f93ce5388a4c2b5af3c0ae9a71b200a0a3bab1937381220d9a981077c2bd286a53faebde764ffe1608729e4d3895a69b2318403b89ca9

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                fe2fefd14ea8f08f1f66a2be570691ac

                                                                SHA1

                                                                931d562a509765a60420ba84e32b8e19c1224f29

                                                                SHA256

                                                                8f9de4cb1268b2baefabca14ba51d899c56a1f20be079c1f44c1c5c343d72a92

                                                                SHA512

                                                                a380d8f17061543eb58db383e5ec15d838a3306838e7fe54ceebda8c4130257892fb092d300b24e4fedb57afc29c8b2810bdce0d82e2df25453772ef596fbdb0

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                6c6f85e896655a6eb726482f04c49086

                                                                SHA1

                                                                2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                SHA256

                                                                e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                SHA512

                                                                b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.ini
                                                                Filesize

                                                                11B

                                                                MD5

                                                                5eda46a55c61b07029e7202f8cf1781c

                                                                SHA1

                                                                862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                SHA256

                                                                12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                SHA512

                                                                4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                Filesize

                                                                541B

                                                                MD5

                                                                d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                SHA1

                                                                e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                SHA256

                                                                7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                SHA512

                                                                a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                Filesize

                                                                12B

                                                                MD5

                                                                3d66ae5ed06891e8ce75a39a24070844

                                                                SHA1

                                                                368064119835d4376727a14706c41384446183e8

                                                                SHA256

                                                                73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                                SHA512

                                                                c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                Filesize

                                                                646KB

                                                                MD5

                                                                7895698867d1ad33934a8553b4806dc5

                                                                SHA1

                                                                32704df55deaff9bf0b4ee0b887541856578938b

                                                                SHA256

                                                                ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                                SHA512

                                                                20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                                Download Submit

                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                Filesize

                                                                3.1MB

                                                                MD5

                                                                1f6bd7c304c2dd82e98770a1cc016079

                                                                SHA1

                                                                6de8817529684d89a13d489a4abcbb5c43efcf54

                                                                SHA256

                                                                363e92b1472c84182a11eac15da2a9fb7ad84f827b3f0908fd427b1f13d3f044

                                                                SHA512

                                                                828545952ae610221edcd90f3b8a584ba0833b2acda3a2b89da6f3a1db7d5a2eba0efe407964257f144081da544806d12305908356b4aba3f6e1adee1b22e4f5

                                                                Download Submit

                                                              • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\566c5ea85c7b2e9f5b46b9ba7d4b26cf
                                                                Filesize

                                                                16KB

                                                                MD5

                                                                b2e89027a140a89b6e3eb4e504e93d96

                                                                SHA1

                                                                f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                SHA256

                                                                5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                SHA512

                                                                93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                Download Submit

                                                              • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                Filesize

                                                                809B

                                                                MD5

                                                                8b6737800745d3b99886d013b3392ac3

                                                                SHA1

                                                                bb94da3f294922d9e8d31879f2d145586a182e19

                                                                SHA256

                                                                86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                SHA512

                                                                654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                Download Submit

                                                              • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                Filesize

                                                                12KB

                                                                MD5

                                                                f3e35e5cf8ca09eaa5d49fc5ed8271f9

                                                                SHA1

                                                                11d7da285c790d34cef12d4bfb4258a58c7bd7fb

                                                                SHA256

                                                                50835b4a60ffd2823bf34402dc96d066e1d06e9d07a32b0a91a9a179d8175956

                                                                SHA512

                                                                fcacb84c8c6620f91a2cdabe2111df311e9818b676c3a59678067b8b3bd654e2371b7a7161914f4d63eccf5ce2ac27eaaf21fd24ae7bf2dbd4e723ce0ed281bd

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                Filesize

                                                                471B

                                                                MD5

                                                                213d08513e32bb6741bec453fd3759aa

                                                                SHA1

                                                                f7df0a9a4bcd1c840e5459102672921d7912fabb

                                                                SHA256

                                                                8e95d9099eebd14015e359e21a16a7b28fe2e3a206189c7e0dc7b5bd71d0744f

                                                                SHA512

                                                                c75a4f233621bab3306e3f6509ada296f2891c8999e8fe8fa0c48a3ebf45626b5b52b1e52af1b914b4c6e0ff881ee64405779c717adeae6973f7106446d678d7

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                Filesize

                                                                727B

                                                                MD5

                                                                edb4e3317b95e16a448b0cd9282ae23a

                                                                SHA1

                                                                0f6e826bd5c7c642334855aa206da5038f29eeef

                                                                SHA256

                                                                bb75eeb18bda565003475de62ef5c37ca005d2809c0da6fdcdeb82c07b6a71ff

                                                                SHA512

                                                                4e353ab569b7a5177f776584ebd28e70cba33acb6589fc4bc1f698fcd9b4c5edc16ab0e770c3c3e98833928ff5f407c953e9609176c3cc0b16b10cf0fae1557f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                Filesize

                                                                727B

                                                                MD5

                                                                bcfd43b53a47b2dcf107efdcbd0b59a4

                                                                SHA1

                                                                75b548df2aecb2dec9a995c9ff974be78959411a

                                                                SHA256

                                                                b0fa8ff8516c233400ff93675d5091c6747a19287d70c92c470fb30978868fa6

                                                                SHA512

                                                                f473cfef0228f41b471e67ad3dbfe5715ba9aab9eb541f27445da87b8944bcd6a3560ab3e5e57a440f8a626b9137fdcd85aa2a50366f67ec61f478b4c7cea634

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                Filesize

                                                                400B

                                                                MD5

                                                                326b84ddd8be59fa0daceee9fb868125

                                                                SHA1

                                                                c9fdad6c93bd3023009a6543daac5520560d2933

                                                                SHA256

                                                                79c3fc71a184735b8b27abbcc7139737aee390976398b03fdc3d3dee5e8d12cd

                                                                SHA512

                                                                836b47cc0452ecad8f8f42ef1d9192e2338b107e4b8df15a5a186a36bbf0007d7961ef2492661c32af318bd2838c89de69ce920935f5f0a7604602bafcff322f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                Filesize

                                                                404B

                                                                MD5

                                                                59da2c86a72d54dd6896ad88acf7c6b1

                                                                SHA1

                                                                ae3949e695dabb6cf2895ade2d1680b72269bc48

                                                                SHA256

                                                                3e57370efaf4050f8b293063760755c301cfb29d1632dc95d4533b88c29840ad

                                                                SHA512

                                                                a27358839619e443c1fc141a03b2b71b47daf86a11388178e10c447d6b91918485e7051a775ba872bb75398efa6140ec0d49f60e13e190fc434f11ccf8658415

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                Filesize

                                                                412B

                                                                MD5

                                                                e7b0d0f87ffc914adcb789f9e67b33c8

                                                                SHA1

                                                                ca9627e7c5c9dfb9aef1a84e7cdb90e91daf072b

                                                                SHA256

                                                                e621fb0ec4a8c48be438ab78ba0a319e3492e924ce9fb0bffed70db1fd4ea96e

                                                                SHA512

                                                                542757aabd6d0bdf014c20fd014a53d058850cbe83db946d2a07ccc5e4580fb9d132a00dea952d9a135f2044a01c7c2e748401af40da6e5b8d9af9acaca3cca6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                Filesize

                                                                651B

                                                                MD5

                                                                9bbfe11735bac43a2ed1be18d0655fe2

                                                                SHA1

                                                                61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                SHA256

                                                                549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                SHA512

                                                                a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI10E7.tmp
                                                                Filesize

                                                                211KB

                                                                MD5

                                                                a3ae5d86ecf38db9427359ea37a5f646

                                                                SHA1

                                                                eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                SHA256

                                                                c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                SHA512

                                                                96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI328.tmp
                                                                Filesize

                                                                509KB

                                                                MD5

                                                                88d29734f37bdcffd202eafcdd082f9d

                                                                SHA1

                                                                823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                SHA256

                                                                87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                SHA512

                                                                1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI328.tmp-\AlphaControlAgentInstallation.dll
                                                                Filesize

                                                                25KB

                                                                MD5

                                                                aa1b9c5c685173fad2dabebeb3171f01

                                                                SHA1

                                                                ed756b1760e563ce888276ff248c734b7dd851fb

                                                                SHA256

                                                                e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                SHA512

                                                                d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI328.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                Filesize

                                                                179KB

                                                                MD5

                                                                1a5caea6734fdd07caa514c3f3fb75da

                                                                SHA1

                                                                f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                SHA256

                                                                cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                SHA512

                                                                a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI80B.tmp-\CustomAction.config
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                bc17e956cde8dd5425f2b2a68ed919f8

                                                                SHA1

                                                                5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                SHA256

                                                                e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                SHA512

                                                                02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI80B.tmp-\Newtonsoft.Json.dll
                                                                Filesize

                                                                695KB

                                                                MD5

                                                                715a1fbee4665e99e859eda667fe8034

                                                                SHA1

                                                                e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                SHA256

                                                                c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                SHA512

                                                                bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                Download Submit

                                                              • C:\Windows\Installer\MSI8825.tmp
                                                                Filesize

                                                                4.5MB

                                                                MD5

                                                                25a0aa722268b17888b4e159a9f82f18

                                                                SHA1

                                                                68ccb5adae9095056a9d5592f6a850f30715a86b

                                                                SHA256

                                                                72896d8abeeeb40360596927c0feade8f0bc28f9937d35f646b9ba2a47f1edca

                                                                SHA512

                                                                79a574f95dbb5ff11e35f2938fcd6a9e22a3f1a35d7e032aceb099dd69ad45dcdf006d92aeb7d1086e3d0615241f6669e510d5dee6f7d262e0e3d4179822365d

                                                                Download Submit

                                                              • C:\Windows\Installer\MSIDACD.tmp-\System.Management.dll
                                                                Filesize

                                                                60KB

                                                                MD5

                                                                878e361c41c05c0519bfc72c7d6e141c

                                                                SHA1

                                                                432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                SHA256

                                                                24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                SHA512

                                                                59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                Download Submit

                                                              • C:\Windows\Installer\e58026c.msi
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                64585a798dd0bea132febaa7cda9ab86

                                                                SHA1

                                                                45b16e677e32a61fab1ec0c7c229b37134dac718

                                                                SHA256

                                                                9d69ae8da13e65fc49ce5a7a5936a3b2441e78fbe6e134315fab2cd1e820f731

                                                                SHA512

                                                                a048308fbe3f4687799db105d3c7bb1abbc65f4811c685393f9bee105c81e22e25b1dc2e73968ae32523a159ecc40a476b3f46791cbd156ea81a09e2b658bbb9

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{79459edf-8178-064c-94e3-333568c7c2cc}\lci_iddcx.cat
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                62458e58313475c9a3642a392363e359

                                                                SHA1

                                                                e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                SHA256

                                                                85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                SHA512

                                                                49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{79459edf-8178-064c-94e3-333568c7c2cc}\lci_iddcx.inf
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                1cec22ca85e1b5a8615774fca59a420b

                                                                SHA1

                                                                049a651751ef38321a1088af6a47c4380f9293fc

                                                                SHA256

                                                                60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                SHA512

                                                                0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{79459edf-8178-064c-94e3-333568c7c2cc}\x64\lci_iddcx.dll
                                                                Filesize

                                                                52KB

                                                                MD5

                                                                01e8bc64139d6b74467330b11331858d

                                                                SHA1

                                                                b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                SHA256

                                                                148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                SHA512

                                                                4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9edd44-3a29-e247-bae4-de148283a588}\lci_proxywddm.cat
                                                                Filesize

                                                                12KB

                                                                MD5

                                                                8e16d54f986dbe98812fd5ec04d434e8

                                                                SHA1

                                                                8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                SHA256

                                                                7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                SHA512

                                                                e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9edd44-3a29-e247-bae4-de148283a588}\lci_proxywddm.inf
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                0315a579f5afe989154cb7c6a6376b05

                                                                SHA1

                                                                e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                SHA256

                                                                d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                SHA512

                                                                c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9edd44-3a29-e247-bae4-de148283a588}\x64\lci_proxyumd.dll
                                                                Filesize

                                                                179KB

                                                                MD5

                                                                4dc11547a5fc28ca8f6965fa21573481

                                                                SHA1

                                                                d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                SHA256

                                                                e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                SHA512

                                                                bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9edd44-3a29-e247-bae4-de148283a588}\x64\lci_proxyumd32.dll
                                                                Filesize

                                                                135KB

                                                                MD5

                                                                67ae7b2c36c9c70086b9d41b4515b0a8

                                                                SHA1

                                                                ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                SHA256

                                                                79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                SHA512

                                                                4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                Download Submit

                                                              • C:\Windows\System32\DriverStore\Temp\{cb9edd44-3a29-e247-bae4-de148283a588}\x64\lci_proxywddm.sys
                                                                Filesize

                                                                119KB

                                                                MD5

                                                                b9b0e9b4d93b18b99ece31a819d71d00

                                                                SHA1

                                                                2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                SHA256

                                                                0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                SHA512

                                                                465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                Download Submit

                                                              • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-16-32-48.dat
                                                                Filesize

                                                                602B

                                                                MD5

                                                                df7032abe65a5af2e68f4f170461b0fa

                                                                SHA1

                                                                3c323daa125b72a7cc47bcc3dfe0a78a9c204778

                                                                SHA256

                                                                b97ba0fe482a0eee27fe408b1a3a1cf3bc7f1c0f3d92555a6359915ad37787a1

                                                                SHA512

                                                                1c10b7e2da6e0996e32072bfbf4c770b879aba87af5578d3ea537c510ca762fd5a8055fabe827af294c403e3ec966d6ab70532d711685782fba80636574cde36

                                                                Download Submit

                                                              • C:\Windows\Temp\InstallUtil.log
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                c54fc294b9b4bd76f135f06da09bf71b

                                                                SHA1

                                                                3d8afd1282324ec1b02e9a2713d3b6f975225d62

                                                                SHA256

                                                                6c14b9ab3ffd0e7737bc714dc0211d65b76529f04db08cbe8d4ea249ad53ba09

                                                                SHA512

                                                                d757c9553d128baad217f782f70901ae931535dfae58fad90f443771abd517200bb52afe990349f63fc96d50615ec7cc179ae8f151526fb2ce7841785353eafb

                                                                Download Submit

                                                              • C:\Windows\Temp\PreVer.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                3b3da62c91b423b3b1f7f462316d0b13

                                                                SHA1

                                                                35e7fb9e5561240970fe5fc0793bc2d2cd4ab182

                                                                SHA256

                                                                ea6be9dfbd0b5c5410e529c07be0b145666197afe532afb6a442e82ee6bd8449

                                                                SHA512

                                                                dcf5464186860238a4629c8a3c6b5f7ad17fe17a2c4760b24a676c7cd570dc871be57b584c7de7c95205e445731ea4d22dbb741c9a1c07b8fa1ad3971be52c33

                                                                Download Submit

                                                              • C:\Windows\Temp\unpack.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                58258f5b8e834f8e47db288d6b0f23fe

                                                                SHA1

                                                                cf00df8bca8df52dfe3d39b30a9638effe1a872e

                                                                SHA256

                                                                f4d379ef388eade2603e46b8195b46f1baf87ca1f121363f0bf3843e22576eb9

                                                                SHA512

                                                                e0a45e2b0d1147ee0668083311a244b824542b56a015d06de702367a63988b1b1a613990bf80be487dbb1a2bb1f6118328e9094f8f51cf8fdda94d58e0b00e8c

                                                                Download Submit

                                                              • C:\Windows\Temp\unpack.log
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                6234cd2215f1c51116444a56c7b7eca0

                                                                SHA1

                                                                1f4596a465918a9014fde8b520df56047af6b7c8

                                                                SHA256

                                                                54ad120cb7b06e166814c1a09c72b171831df3172d6cb9cb54e6a8c59ee78c34

                                                                SHA512

                                                                ecafa3eec2b486f54865bc558c898eb1624206bb9e3ef1ab298ded32dc83be8f93f921ac4bfe35a0de7f1eec996fa8ac4db71f2edb6415f0f348e74efff0615b

                                                                Download Submit

                                                              • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                Filesize

                                                                2.7MB

                                                                MD5

                                                                df5eb1af99091a902effa52463eda084

                                                                SHA1

                                                                b04578b36490a4ec0092e9a44ae6b2679670450a

                                                                SHA256

                                                                83ef8e362af27279b63ef28379675a087984791e5eaf4a9272a5cb4e52dd059c

                                                                SHA512

                                                                663e11667ec5c6c7969ce61f90d869f3723cbd007236150478ef6dbd861ddc75cf5f96b0345319bd178cd87045daa39a0d6ca4af83cf8dcdb4ebe7462d3eeabd

                                                                Download Submit

                                                              • C:\Windows\Temp\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\ISRT.dll
                                                                Filesize

                                                                427KB

                                                                MD5

                                                                85315ad538fa5af8162f1cd2fce1c99d

                                                                SHA1

                                                                31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                SHA256

                                                                70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                SHA512

                                                                877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                Download Submit

                                                              • C:\Windows\Temp\{B3A1F232-83D5-4EDD-9C65-D9D8CA5CD7A8}\_isres_0x0409.dll
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                befe2ef369d12f83c72c5f2f7069dd87

                                                                SHA1

                                                                b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                SHA256

                                                                9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                SHA512

                                                                760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                Download Submit

                                                              • C:\Windows\Temp\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\IsConfig.ini
                                                                Filesize

                                                                571B

                                                                MD5

                                                                de10be3435fbcab7eeccaa67e2431619

                                                                SHA1

                                                                7afdb3c4c042692ea3f19f2d2275bada7cacfbfd

                                                                SHA256

                                                                d193eda99410268676293d315164ff29cd263ca0251a0238592a23a9d78476b0

                                                                SHA512

                                                                bda2f23885d4bb07c328622d7f637379f63f08b57eb54c4a665fb56d5f68e61d36ff4b4e3cc2b8b2b3d3c5f2e0d3dbb581770eec4fddf9a8c0f4b6555ad3c1af

                                                                Download Submit

                                                              • C:\Windows\Temp\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\String1033.txt
                                                                Filesize

                                                                182KB

                                                                MD5

                                                                1d4329601bef6492cd3227df5bcd5125

                                                                SHA1

                                                                d03a3c50ba7663b52c13b54b08b9284f40e4f848

                                                                SHA256

                                                                bd703470b2f35e3c4d917d3038bf806fcc7c155142d300806c95500274951efd

                                                                SHA512

                                                                b0cfc1aef000d428d1ff4f2df41539284a048571e26a2c1a217093e593e546f5af79bbc61be8458021a9829a7d79f68cb8728bf942475096b53c81a66094dd7b

                                                                Download Submit

                                                              • C:\Windows\Temp\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\_is6C72.exe
                                                                Filesize

                                                                179KB

                                                                MD5

                                                                7a1c100df8065815dc34c05abc0c13de

                                                                SHA1

                                                                3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                SHA256

                                                                e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                SHA512

                                                                bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                Download Submit

                                                              • C:\Windows\Temp\{C446C4C1-5B95-4FF2-A3D5-DDB3C3C75DFB}\setup.inx
                                                                Filesize

                                                                345KB

                                                                MD5

                                                                0376dd5b7e37985ea50e693dc212094c

                                                                SHA1

                                                                02859394164c33924907b85ab0aaddc628c31bf1

                                                                SHA256

                                                                c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                SHA512

                                                                69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                Download Submit

                                                              • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                Filesize

                                                                404B

                                                                MD5

                                                                afd4ad8e37bc350b4965d4818089a22f

                                                                SHA1

                                                                d6bb806a7b0766cb1d485d2f16441469d8250c91

                                                                SHA256

                                                                392fb77c67757f7f817e35ba0c6e8722a47903e44a6a5be63625bb70c0b10141

                                                                SHA512

                                                                f4497f95a97f3dce55420d94ef1f4daf3707aa2e400fa90fee4298e87f0227dd9de4cdd888c3179cd5e689af0739bb048d29d68d23c6c282305df175fcb7459b

                                                                Download Submit

                                                              • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                Filesize

                                                                412B

                                                                MD5

                                                                19699e23282010f9b7fc8d52a4fef1ee

                                                                SHA1

                                                                b3bf3f8cec5316bd981ce6ad9e7405c33dffedab

                                                                SHA256

                                                                869b8faf1a684bb4c0c735baa4413918997b36394c1dd7a8d7c0a78d49f01fa0

                                                                SHA512

                                                                ffd223800824428710e74b18edd0c3d6dd4b48c8e0ac6fad8d39f28b0432e260eca04c5306a259064233c966f0c03a54988e1e27f66821fc5ae04d77044756de

                                                                Download Submit

                                                              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                Filesize

                                                                24.1MB

                                                                MD5

                                                                5fbd044d02d8ddeb27c1606ec57cd01e

                                                                SHA1

                                                                f69f6c725c04534abf660d66a2e9bc8b351b6cd9

                                                                SHA256

                                                                6ff9a03283f149f4a49294d9f8efdc3ac7a99b04b36d1307df568e7828057ba3

                                                                SHA512

                                                                9a7b49274e1b717e824e158894f407f9671f0dbd408d757e2c2c5b0ba091e34f3f6d8f7051736efbb85b44413c753bfa6fed37890833ac2c8b582f3d5957d55e

                                                                Download Submit

                                                              • \??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bd97df1b-8b4b-4ad5-9908-db887cb33908}_OnDiskSnapshotProp
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                af864e71718c860b205c76ec2303038b

                                                                SHA1

                                                                feb9ea9ef5166b63cd980d7d39c8da67fabe8abc

                                                                SHA256

                                                                e34007a3671bede2c5cf309b9305cdcdce5c2242424c21572f0d221262e8feca

                                                                SHA512

                                                                4a94295b94478e3b732ac06f1e2a6b75948fdf41fa451c8436583fff1d1c42d9d4707d9fc78d666c9c11c70f3bf043ba1fc42c8c01386c58adac9fa2f1fdd5cc

                                                                Download Submit

                                                              • memory/504-1793-0x0000027A2DF20000-0x0000027A2DF3C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/504-1787-0x0000027A2DF50000-0x0000027A2DF9A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/504-1783-0x0000027A2D6E0000-0x0000027A2D6EC000-memory.dmp

                                                                Filesize

                                                                48KB

                                                                Download

                                                              • memory/1088-1752-0x00000292C6AD0000-0x00000292C6B24000-memory.dmp

                                                                Filesize

                                                                336KB

                                                                Download

                                                              • memory/1088-1311-0x00000292AE1E0000-0x00000292AE1FC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/1088-1293-0x00000292AD990000-0x00000292AD9A2000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/1088-1448-0x00000292C6B90000-0x00000292C6C42000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/1160-80-0x0000000004CF0000-0x0000000005044000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/1160-76-0x0000000004BD0000-0x0000000004C82000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/1160-79-0x0000000004B40000-0x0000000004B62000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/1468-110-0x0000000003130000-0x0000000003196000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/1888-1779-0x00000239B2F20000-0x00000239B2F2A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/1888-1780-0x00000239B3870000-0x00000239B388A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/1888-1792-0x00000239B3980000-0x00000239B3A32000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/2484-274-0x00000290365B0000-0x00000290365E0000-memory.dmp

                                                                Filesize

                                                                192KB

                                                                Download

                                                              • memory/2484-277-0x0000029036FF0000-0x00000290370A0000-memory.dmp

                                                                Filesize

                                                                704KB

                                                                Download

                                                              • memory/2484-278-0x0000029036F40000-0x0000029036F5C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/3192-1645-0x000001CA42AE0000-0x000001CA42B2A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/3192-1791-0x000001CA5B5C0000-0x000001CA5B672000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/3192-1636-0x000001CA42240000-0x000001CA42252000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/3192-1715-0x000001CA42AB0000-0x000001CA42ACC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/3568-2186-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/3568-1984-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/3568-1983-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3568-1982-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/3568-1196-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3568-1197-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/3568-1195-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/3568-2184-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/3568-2185-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3588-352-0x00000205E9950000-0x00000205E9958000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/3588-353-0x00000205E9960000-0x00000205E9968000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/3588-345-0x00000205E98B0000-0x00000205E98FC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/3588-357-0x00000205EA980000-0x00000205EA9BA000-memory.dmp

                                                                Filesize

                                                                232KB

                                                                Download

                                                              • memory/3588-358-0x00000205E9970000-0x00000205E9996000-memory.dmp

                                                                Filesize

                                                                152KB

                                                                Download

                                                              • memory/3588-346-0x00000205E9900000-0x00000205E9948000-memory.dmp

                                                                Filesize

                                                                288KB

                                                                Download

                                                              • memory/3588-342-0x00000205D06F0000-0x00000205D0754000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/3588-343-0x00000205D0FE0000-0x00000205D102A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/3588-348-0x00000205D0B40000-0x00000205D0B4A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/3588-349-0x00000205E9C10000-0x00000205E9CEC000-memory.dmp

                                                                Filesize

                                                                880KB

                                                                Download

                                                              • memory/3588-347-0x00000205D0B30000-0x00000205D0B38000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/3588-354-0x00000205E9CF0000-0x00000205E9D58000-memory.dmp

                                                                Filesize

                                                                416KB

                                                                Download

                                                              • memory/3588-355-0x00000205E99A0000-0x00000205E99CA000-memory.dmp

                                                                Filesize

                                                                168KB

                                                                Download

                                                              • memory/3588-344-0x00000205D0B10000-0x00000205D0B2C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/3588-351-0x00000205D10C0000-0x00000205D10C8000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/3588-350-0x00000205E9B30000-0x00000205E9BE2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/4176-165-0x0000021DD96A0000-0x0000021DD96DC000-memory.dmp

                                                                Filesize

                                                                240KB

                                                                Download

                                                              • memory/4176-164-0x0000021DD9630000-0x0000021DD9642000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/4176-160-0x0000021DF37E0000-0x0000021DF3878000-memory.dmp

                                                                Filesize

                                                                608KB

                                                                Download

                                                              • memory/4176-148-0x0000021DD9220000-0x0000021DD9248000-memory.dmp

                                                                Filesize

                                                                160KB

                                                                Download

                                                              • memory/4400-1185-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4400-1750-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/4400-2340-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/4400-2339-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4400-2338-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/4400-2129-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/4400-2128-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4400-2127-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/4400-1186-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/4400-1184-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/4400-1749-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4400-1748-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/4400-1965-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4400-1964-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/4400-1966-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/4644-193-0x00000186D4D90000-0x00000186D4E42000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/4644-241-0x00000186D52F0000-0x00000186D5328000-memory.dmp

                                                                Filesize

                                                                224KB

                                                                Download

                                                              • memory/4644-201-0x00000186D4D00000-0x00000186D4D22000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/4888-300-0x0000026A34F60000-0x0000026A34F76000-memory.dmp

                                                                Filesize

                                                                88KB

                                                                Download

                                                              • memory/4888-301-0x0000026A4E110000-0x0000026A4E1C2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/4888-302-0x0000026A357D0000-0x0000026A357EC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/4988-43-0x00000000049D0000-0x00000000049DC000-memory.dmp

                                                                Filesize

                                                                48KB

                                                                Download

                                                              • memory/4988-39-0x0000000004980000-0x00000000049AE000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/5360-1778-0x0000018EEED40000-0x0000018EEED8A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5360-1773-0x0000018ED6440000-0x0000018ED6458000-memory.dmp

                                                                Filesize

                                                                96KB

                                                                Download

                                                              • memory/5360-1771-0x0000018ED5FB0000-0x0000018ED5FCC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5360-1770-0x0000018ED6490000-0x0000018ED64DA000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5360-1774-0x0000018ED5F80000-0x0000018ED5F8A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/5360-1767-0x0000018ED5B90000-0x0000018ED5BC4000-memory.dmp

                                                                Filesize

                                                                208KB

                                                                Download

                                                              • memory/5420-1606-0x0000029239B80000-0x0000029239BBA000-memory.dmp

                                                                Filesize

                                                                232KB

                                                                Download

                                                              • memory/5420-1785-0x0000029252E10000-0x0000029252EC2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5420-1794-0x0000029253950000-0x0000029253998000-memory.dmp

                                                                Filesize

                                                                288KB

                                                                Download

                                                              • memory/5420-1788-0x000002923A480000-0x000002923A49C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5456-1768-0x0000019BDB930000-0x0000019BDBA0C000-memory.dmp

                                                                Filesize

                                                                880KB

                                                                Download

                                                              • memory/5456-1638-0x0000019BDB700000-0x0000019BDB74A000-memory.dmp

                                                                Filesize

                                                                296KB

                                                                Download

                                                              • memory/5456-1697-0x0000019BDB6B0000-0x0000019BDB6CC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/5456-1610-0x0000019BC2660000-0x0000019BC2670000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/5456-1784-0x0000019BDBA10000-0x0000019BDBAC2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5584-555-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5584-943-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5584-519-0x0000000003A50000-0x0000000003C17000-memory.dmp

                                                                Filesize

                                                                1.8MB

                                                                Download

                                                              • memory/5584-946-0x0000000003A90000-0x0000000003C57000-memory.dmp

                                                                Filesize

                                                                1.8MB

                                                                Download

                                                              • memory/5584-1087-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5584-1124-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5584-516-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5640-1609-0x00000195477D0000-0x00000195477E0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/5640-1696-0x00000195609A0000-0x0000019560A52000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5640-1753-0x0000019548050000-0x0000019548064000-memory.dmp

                                                                Filesize

                                                                80KB

                                                                Download

                                                              • memory/5640-1637-0x0000019548010000-0x0000019548030000-memory.dmp

                                                                Filesize

                                                                128KB

                                                                Download

                                                              • memory/5640-1747-0x00000195480E0000-0x0000019548146000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/5684-1204-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/5684-2341-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/5684-1213-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/5684-1981-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/5684-3032-0x0000000073BA0000-0x0000000073C9D000-memory.dmp

                                                                Filesize

                                                                1012KB

                                                                Download

                                                              • memory/5684-3033-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5684-3034-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/5684-2342-0x00000000738D0000-0x00000000739EC000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/5684-2343-0x0000000073500000-0x00000000738C4000-memory.dmp

                                                                Filesize

                                                                3.8MB

                                                                Download

                                                              • memory/5792-1782-0x00000190EFF30000-0x00000190F058C000-memory.dmp

                                                                Filesize

                                                                6.4MB

                                                                Download

                                                              • memory/5792-1620-0x00000190D5B10000-0x00000190D5B20000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/5792-1629-0x00000190D5ED0000-0x00000190D5EE0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/5792-1698-0x00000190D6380000-0x00000190D63A0000-memory.dmp

                                                                Filesize

                                                                128KB

                                                                Download

                                                              • memory/5792-1795-0x00000190EF8D0000-0x00000190EF916000-memory.dmp

                                                                Filesize

                                                                280KB

                                                                Download

                                                              • memory/5792-1649-0x00000190EEC90000-0x00000190EED42000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5904-524-0x00000247BCB60000-0x00000247BCB86000-memory.dmp

                                                                Filesize

                                                                152KB

                                                                Download

                                                              • memory/6072-1786-0x00000239E5DF0000-0x00000239E5E10000-memory.dmp

                                                                Filesize

                                                                128KB

                                                                Download

                                                              • memory/6072-1772-0x00000239E5580000-0x00000239E558C000-memory.dmp

                                                                Filesize

                                                                48KB

                                                                Download

                                                              • memory/6072-1777-0x00000239E5DD0000-0x00000239E5DE8000-memory.dmp

                                                                Filesize

                                                                96KB

                                                                Download

                                                              • memory/6072-1781-0x00000239FE710000-0x00000239FE7C2000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download