Overview

overview

10

Static

static

10

e6d41a5c8b...07.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    397s
  • max time network
    394s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e6d41a5c8b4ee4d298da209f75f5ff678bfec84d8ac4a4dbf11d17e6b6aa7007.msi

  • Size

    2.9MB

  • MD5

    c5d6f1dbaaa149c1037f2e88d824a759

  • SHA1

    46facb96e7a2332c44e412cc8aca7d2b9aca497a

  • SHA256

    e6d41a5c8b4ee4d298da209f75f5ff678bfec84d8ac4a4dbf11d17e6b6aa7007

  • SHA512

    5edf7f578c5cedd6cbd12f8904019a52a85ac819b2d87eb47e2300a0e95fd891a220b32790587eec6c93b4a0c88a0f554301e17bca2c78801fbb55381ad3c7e0

  • SSDEEP

    49152:g+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:g+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 44 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e6d41a5c8b4ee4d298da209f75f5ff678bfec84d8ac4a4dbf11d17e6b6aa7007.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1728
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4080
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 94D0FDC634A1A822ACBECCC1CB1A767B
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID84F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638281 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4388
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIDB2E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638812 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:464
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIDFA4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639968 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3340
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIEBAF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240643015 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3836
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 55D08A76C1B1913F54144D23E479D44C E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4744
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:212
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:724
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="2" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000MVDpAIAX" /AgentId="94ae291a-8739-4b3b-a9b7-54dade11c279"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:3960
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 631928C0E59E7E407D0AA307A7FD924F E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:788
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE334B27-6CD8-482F-8B2A-A1D1B236A2E4}
          3⤵
          • Executes dropped EXE
          PID:1808
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FDD5547-7874-4AEC-A99F-C5587D6AAD4B}
          3⤵
          • Executes dropped EXE
          PID:5100
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DF4FE0E-BF0F-450B-94F6-F624FD4B39FD}
          3⤵
          • Executes dropped EXE
          PID:3960
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41EBE5CC-8CA8-4DF1-934B-FD2918E6DC80}
          3⤵
          • Executes dropped EXE
          PID:2472
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7FE1A4F-B1E1-4D53-BEB9-6A2576959E94}
          3⤵
          • Executes dropped EXE
          PID:1876
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{02432933-8B3E-4BD2-9B96-348FFC5DBA32}
          3⤵
          • Executes dropped EXE
          PID:2676
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF47258C-7169-4C1D-9616-3462D2901745}
          3⤵
          • Executes dropped EXE
          PID:1816
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5F45E8C-E356-4AF8-831A-0DD6A61A59CA}
          3⤵
          • Executes dropped EXE
          PID:3052
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD28CD93-6234-4E5B-A7E2-1197AC0B3702}
          3⤵
          • Executes dropped EXE
          PID:3772
        • C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe
          C:\Windows\TEMP\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_is2025.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{75BBEB83-28B4-4CA6-868B-39D42B000530}
          3⤵
          • Executes dropped EXE
          PID:1196
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4564
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:1876
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRServer.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5128
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5160
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRApp.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5208
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5236
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAppPB.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5284
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5324
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeature.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5372
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5400
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeatMini.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5444
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5472
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRManager.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5516
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5548
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAgent.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5628
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5676
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5708
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAudioChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5756
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5784
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRVirtualDisplay.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5832
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3F563FA-EF6E-4E6E-B4AF-32BD4E12F658}
            3⤵
            • Executes dropped EXE
            PID:5988
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A0F1609-2BB9-45EC-A981-447281814ED0}
            3⤵
            • Executes dropped EXE
            PID:6024
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9254F3E-3999-4324-847A-F54948044881}
            3⤵
            • Executes dropped EXE
            PID:6056
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{468CBB83-058E-4E96-A426-7DE76A7422A4}
            3⤵
            • Executes dropped EXE
            PID:6088
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C30D8C69-A22A-42F8-8FEE-CB00EE788CB5}
            3⤵
            • Executes dropped EXE
            PID:6120
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{317A384E-59D3-4D69-8B95-9BAF1A10D8C5}
            3⤵
            • Executes dropped EXE
            PID:3052
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA3FAD96-D498-435F-BB4C-CF0B93B031EF}
            3⤵
            • Executes dropped EXE
            PID:5228
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF32B249-FCE8-4745-B3EB-C7B5D27C0CEC}
            3⤵
            • Executes dropped EXE
            PID:5192
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3BDE16C5-96E4-41C2-B144-ADEA05A146EE}
            3⤵
            • Executes dropped EXE
            PID:5320
          • C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
            C:\Windows\TEMP\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC6A931B-093C-4486-9B9E-A120D4672964}
            3⤵
            • Executes dropped EXE
            PID:3224
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A6C6FB1-48FC-44E0-9690-E794C65C2A3C}
            3⤵
            • Executes dropped EXE
            PID:5596
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BCAF9920-7AF0-4EFD-B6E0-53A32974D948}
            3⤵
            • Executes dropped EXE
            PID:5644
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C855A430-17EC-4E03-B409-6AAEEF0DC01C}
            3⤵
            • Executes dropped EXE
            PID:5676
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E324FE1-B2C2-467A-A058-021BEB9D8D72}
            3⤵
            • Executes dropped EXE
            PID:5648
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{457FBB16-4F5D-438E-8EA0-A856A25E6445}
            3⤵
            • Executes dropped EXE
            PID:1764
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D35CCF8E-937C-481E-81A0-8E87DE748D77}
            3⤵
            • Executes dropped EXE
            PID:5744
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A707899B-C234-4BC2-B01C-8CA3B4940790}
            3⤵
            • Executes dropped EXE
            PID:5840
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{53493599-C727-423A-803A-CCAF38BBDD81}
            3⤵
            • Executes dropped EXE
            PID:5820
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1217E8AB-2800-4903-AE29-4921DDF46BC8}
            3⤵
            • Executes dropped EXE
            PID:1712
          • C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe
            C:\Windows\TEMP\{19880953-2669-4F32-870B-730FBC42B87A}\_is3EAC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F90BD685-835B-4C7A-809E-DA06AE791F7F}
            3⤵
            • Executes dropped EXE
            PID:5868
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5940
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6052
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1808
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:5252
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                4⤵
                  PID:1404
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5456
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CED0AE9C-E0B9-4A2D-AB96-27E24BA5978F}
                3⤵
                • Executes dropped EXE
                PID:5568
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{556C325D-94B6-42FB-A8BF-6B8BDB772F97}
                3⤵
                • Executes dropped EXE
                PID:5620
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C093AAA-C41B-4595-B49F-09C308A2C258}
                3⤵
                • Executes dropped EXE
                PID:5556
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F894A50-1C05-4F15-86C6-6DF24E9C7A26}
                3⤵
                • Executes dropped EXE
                PID:5692
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{738AC9B6-BD07-43B5-AB1F-7E139FFDEEF5}
                3⤵
                • Executes dropped EXE
                PID:5676
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3ED6E684-DFC5-4B9E-821C-589A2C23C7DD}
                3⤵
                • Executes dropped EXE
                PID:1764
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E35373F7-16E1-4C1E-972D-006EEB365F7D}
                3⤵
                • Executes dropped EXE
                PID:5836
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C0BC3F06-B087-433D-BD65-165FD3BFC936}
                3⤵
                • Executes dropped EXE
                PID:5812
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30F3CC48-C793-47B7-A25C-2BFDB2E13C6C}
                3⤵
                • Executes dropped EXE
                PID:5056
              • C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe
                C:\Windows\TEMP\{A0156528-F2B4-4794-A65A-A373011FF673}\_is512C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7646D35-F063-419C-9571-6DF619CD70C8}
                3⤵
                • Executes dropped EXE
                PID:5872
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:1916
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30F4B590-80A9-4DB0-B00E-378058CECB8C}
                3⤵
                • Executes dropped EXE
                PID:6076
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{718C57FB-2FEA-46FF-A1C2-242B67A5FE14}
                3⤵
                • Executes dropped EXE
                PID:6108
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9BADFCF7-2C9F-4999-8B5D-4B1D98A860C9}
                3⤵
                • Executes dropped EXE
                PID:6140
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{27EC7247-B2FC-4DE8-8F6C-6423506ADF6D}
                3⤵
                • Executes dropped EXE
                PID:6128
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C88CFCFF-87A6-4EA4-A8C5-2C477F0A5FBC}
                3⤵
                • Executes dropped EXE
                PID:5204
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8B68BA05-805B-4747-B1CC-CA442A14DC03}
                3⤵
                • Executes dropped EXE
                PID:1636
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0307E487-20F9-4DAD-942E-9AD37284DAF2}
                3⤵
                • Executes dropped EXE
                PID:2036
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F09367B3-5E84-4CF7-8D71-9B13BBD73070}
                3⤵
                • Executes dropped EXE
                PID:4764
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CBDB6ED-F287-4EB7-B71D-5F2EF65D110C}
                3⤵
                • Executes dropped EXE
                PID:1420
              • C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe
                C:\Windows\TEMP\{01DC7B4A-66EA-4DC5-BFF6-C1C954B09F7F}\_is54C7.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A33AE72-73B8-4EE6-AC8C-FF6AD77DE1F8}
                3⤵
                  PID:4692
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5264
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 34FE16F841579D650221B6CC26EA047C E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5432
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI9306.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240686000 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4256
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI949D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240686234 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1008
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI97AC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687015 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5404
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2276
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4856
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:32
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3860
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:1692
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5820
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIBBD7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240696296 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2696
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:5940
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="c7855923-0b10-4350-ba21-5cfce30603ab"
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5064
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:2800
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:456
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:1044
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "9b686750-e4e2-48f6-ab0e-89b6e1469d55" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MVDpAIAX
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                PID:2456
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "bca81a44-c465-4a28-bad8-c751a5eb2dc5" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000MVDpAIAX
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4140
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1436
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:3404
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "df3e6912-cee7-4764-80d9-05db146cf6ef" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000MVDpAIAX
                2⤵
                • Executes dropped EXE
                PID:1464
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "50c90d42-654e-487c-965a-affa949be73c" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000MVDpAIAX
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4956
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4588
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2716
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1696
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "a1655f0f-9126-49dc-9d8f-b7832288c057" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MVDpAIAX
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:5076
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:1992
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:628
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "4bfffd33-95a9-4fd4-9e5d-dac714c890fb" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MVDpAIAX
                2⤵
                  PID:5276
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=a64f96139de52f7737c85a116012a691&rmm_session_pwd_ttl=86400"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4348
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "e17e60b6-9846-4285-9c60-aa43c3589514" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MVDpAIAX
                  2⤵
                    PID:4164
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      3⤵
                        PID:5768
                        • C:\Windows\system32\cscript.exe
                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          4⤵
                          • Modifies data under HKEY_USERS
                          PID:432
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "ba433051-c01c-4657-9424-7a82fbed796e" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MVDpAIAX
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      PID:5488
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                          PID:3612
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "d02b9421-6b85-417d-8d5f-5ffa25f697b0" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        PID:5880
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "9abeb229-ef52-4276-83b4-b86ec5279260" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        PID:1028
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "bc8c85c2-13bc-4eee-8e51-cd985dbc4961" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5240
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "218a6a42-193b-432c-be22-155b3b2681bf" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        PID:880
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "6d20232d-0c00-4fbb-a2f0-ec6ada0c90f7" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        PID:5472
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "70516a65-aafa-4059-b2b8-eb8f998055d5" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MVDpAIAX
                        2⤵
                        • Writes to the Master Boot Record (MBR)
                        • Modifies data under HKEY_USERS
                        PID:2196
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "3a81d785-9e46-4910-9a03-748d50ca4014" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        PID:1268
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "0bee0d86-c711-43e8-a764-d442b0baff1f" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        • Modifies registry class
                        PID:3504
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "273167bd-c0e7-44bb-9a83-9f41c7a2a287" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MVDpAIAX
                        2⤵
                        • Drops file in System32 directory
                        PID:5448
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                          3⤵
                          • System Time Discovery
                          PID:1800
                          • C:\Program Files\dotnet\dotnet.exe
                            dotnet --list-runtimes
                            4⤵
                            • System Time Discovery
                            PID:1824
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "5d2f2b1d-646f-410e-90f6-6cbf7ca50de4" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MVDpAIAX
                        2⤵
                          PID:5232
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "1a40dff6-c82f-442f-bb90-0c384ea0458f" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MVDpAIAX
                          2⤵
                          • Drops file in System32 directory
                          PID:5852
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                        1⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5196
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                          2⤵
                          • Drops file in System32 directory
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5452
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                            -h
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:5760
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                            3⤵
                            • Drops file in Program Files directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5724
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                              4⤵
                                PID:2204
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:1756
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4696
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                SRUtility.exe -r
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:6012
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:1248
                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                          "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                          1⤵
                          • Drops file in Program Files directory
                          • Modifies data under HKEY_USERS
                          PID:432
                          • C:\Windows\System32\sc.exe
                            "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                            2⤵
                            • Launches sc.exe
                            PID:6064
                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                            2⤵
                              PID:2404
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "427b40f3-2aac-4829-969c-7837f07bfa6a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MVDpAIAX
                              2⤵
                                PID:1228
                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "44343495-9b8d-4924-8b24-f441201db258" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MVDpAIAX
                                2⤵
                                • Modifies data under HKEY_USERS
                                PID:5476
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  3⤵
                                    PID:1776
                                    • C:\Windows\system32\cscript.exe
                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      4⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5300
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "7e3c6c2b-f0a6-459f-9f35-9fdd2e4b9350" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MVDpAIAX
                                  2⤵
                                    PID:4432
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                      3⤵
                                      • System Time Discovery
                                      PID:3132
                                      • C:\Program Files\dotnet\dotnet.exe
                                        dotnet --list-runtimes
                                        4⤵
                                        • System Time Discovery
                                        PID:4156
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "8b23c6dd-28f7-485b-a78e-c5e6608eedff" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MVDpAIAX
                                    2⤵
                                      PID:5268
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "89729f6c-1789-4189-b420-33b2b168cadb" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MVDpAIAX
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:6344
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "3381d90e-4a9b-4c7d-bbdc-b3bd2f911069" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MVDpAIAX
                                      2⤵
                                        PID:6360
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "c410ece9-710a-47cd-9156-87cfdfd22918" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MVDpAIAX
                                        2⤵
                                        • Writes to the Master Boot Record (MBR)
                                        PID:6452
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "05b3c7b9-8018-4b45-b512-aba242cd4d63" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MVDpAIAX
                                        2⤵
                                          PID:6492
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "aefdc0ab-a48e-4ac6-b1a1-7e1b32d1b061" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MVDpAIAX
                                          2⤵
                                            PID:6552
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "06ec7599-9732-4dd3-9efc-3f90c46e9e02" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MVDpAIAX
                                            2⤵
                                            • Modifies registry class
                                            PID:6612
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "b4802576-7a3c-4fce-a53f-c2d341abd68c" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MVDpAIAX
                                            2⤵
                                              PID:6624
                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=a64f96139de52f7737c85a116012a691&rmm_session_pwd_ttl=86400"
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:7080
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "771d5c77-f83d-43dc-a1a4-23a56dcdc100" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MVDpAIAX
                                              2⤵
                                                PID:6636
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                2⤵
                                                  PID:4812
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "7b4f363f-8016-4366-ac53-b102c596da0c" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MVDpAIAX
                                                  2⤵
                                                    PID:1672
                                                    • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                      "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "94ae291a-8739-4b3b-a9b7-54dade11c279" "7b4f363f-8016-4366-ac53-b102c596da0c" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000MVDpAIAX"
                                                      3⤵
                                                        PID:728
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                      2⤵
                                                        PID:6868
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                        2⤵
                                                          PID:6584
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "c410ece9-710a-47cd-9156-87cfdfd22918" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MVDpAIAX
                                                          2⤵
                                                          • Writes to the Master Boot Record (MBR)
                                                          PID:6840
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "427b40f3-2aac-4829-969c-7837f07bfa6a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MVDpAIAX
                                                          2⤵
                                                            PID:6488
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                            2⤵
                                                              PID:6164
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "aefdc0ab-a48e-4ac6-b1a1-7e1b32d1b061" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MVDpAIAX
                                                              2⤵
                                                                PID:5660
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                                2⤵
                                                                • Modifies data under HKEY_USERS
                                                                PID:924
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "c410ece9-710a-47cd-9156-87cfdfd22918" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MVDpAIAX
                                                                2⤵
                                                                • Writes to the Master Boot Record (MBR)
                                                                PID:1640
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                                2⤵
                                                                  PID:784
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                                  2⤵
                                                                    PID:5044
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                                    2⤵
                                                                      PID:5876
                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "aefdc0ab-a48e-4ac6-b1a1-7e1b32d1b061" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MVDpAIAX
                                                                      2⤵
                                                                        PID:4156
                                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "427b40f3-2aac-4829-969c-7837f07bfa6a" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MVDpAIAX
                                                                        2⤵
                                                                          PID:2196
                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "68c4a9c2-ceeb-43c5-ace5-5dd83a168345" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MVDpAIAX
                                                                          2⤵
                                                                            PID:2852
                                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 94ae291a-8739-4b3b-a9b7-54dade11c279 "c410ece9-710a-47cd-9156-87cfdfd22918" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MVDpAIAX
                                                                            2⤵
                                                                            • Writes to the Master Boot Record (MBR)
                                                                            PID:5376

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Persistence

                                                                        Event Triggered Execution

                                                                        2
                                                                        T1546

                                                                        Component Object Model Hijacking

                                                                        1
                                                                        T1546.015

                                                                        Installer Packages

                                                                        1
                                                                        T1546.016

                                                                        Pre-OS Boot

                                                                        1
                                                                        T1542

                                                                        Bootkit

                                                                        1
                                                                        T1542.003

                                                                        Privilege Escalation

                                                                        Event Triggered Execution

                                                                        2
                                                                        T1546

                                                                        Component Object Model Hijacking

                                                                        1
                                                                        T1546.015

                                                                        Installer Packages

                                                                        1
                                                                        T1546.016

                                                                        Defense Evasion

                                                                        Modify Registry

                                                                        1
                                                                        T1112

                                                                        Pre-OS Boot

                                                                        1
                                                                        T1542

                                                                        Bootkit

                                                                        1
                                                                        T1542.003

                                                                        Subvert Trust Controls

                                                                        1
                                                                        T1553

                                                                        Install Root Certificate

                                                                        1
                                                                        T1553.004

                                                                        System Binary Proxy Execution

                                                                        1
                                                                        T1218

                                                                        Msiexec

                                                                        1
                                                                        T1218.007

                                                                        Credential Access

                                                                        Discovery

                                                                        Peripheral Device Discovery

                                                                        2
                                                                        T1120

                                                                        Query Registry

                                                                        4
                                                                        T1012

                                                                        System Information Discovery

                                                                        3
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        System Time Discovery

                                                                        1
                                                                        T1124

                                                                        Lateral Movement

                                                                        Collection

                                                                        Command and Control

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Config.Msi\e57d7c3.rbs
                                                                          Filesize

                                                                          8KB

                                                                          MD5

                                                                          2495646ce206cf9890465ced7f29e99e

                                                                          SHA1

                                                                          d8ea671527f51b31ee0a939cb76c269ea9259104

                                                                          SHA256

                                                                          e37919829459777e48d70cca71bc612acbb05ec1d6049d584a0d2358ff76178f

                                                                          SHA512

                                                                          d465e968d7940901a2f7642fa0e0af90b9c676030ac7aafce0aaee1686540ea22ad5f6f09168f0921588b0461f41e76b6e26262d4d588e02e72a8c14136a506c

                                                                          Download Submit

                                                                        • C:\Config.Msi\e57d7c8.rbs
                                                                          Filesize

                                                                          74KB

                                                                          MD5

                                                                          f9747fde761a346b0e37ab8965736b78

                                                                          SHA1

                                                                          eb986f533373583cfaf87ee83089939a4b9c371d

                                                                          SHA256

                                                                          f7b9fa2133ba68ef2a0d09759969c79c47c57848c9ce59566b0c99d3097f008a

                                                                          SHA512

                                                                          05459285cc2bb30120e12530f9f9bdb68d279de125911b85b3ebeedadd8982517543f39f73254594902eed419c8627ca3b228a96ffa95fabb4c5b30f4cc38596

                                                                          Download Submit

                                                                        • C:\Config.Msi\e57d7ca.rbs
                                                                          Filesize

                                                                          464B

                                                                          MD5

                                                                          322beac4c81953ee129e4238f54a00d9

                                                                          SHA1

                                                                          6474ea8c383cfbe3039a9ab8cd43d6db76dbed7f

                                                                          SHA256

                                                                          b555985bb489ba511a61ea822f9c08e5c9fef52bc2bb9f77641f1638ffefe45c

                                                                          SHA512

                                                                          9e9892bd51e4b5af05418203646574e2aa88fcaf4e05957620f61ed8ac468f5101ef494f6949abac30f9d4d8f271a8785abfbfcd18d21af8b30902ed0e3ca32a

                                                                          Download Submit

                                                                        • C:\Config.Msi\e57d7d0.rbs
                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          a5204d0245c7dfa509a2ff49e19088f8

                                                                          SHA1

                                                                          4f1c980e84ae70beb487747ff9c3585f4d48489b

                                                                          SHA256

                                                                          74379dcc8158de04f5911faa2f57792bb90b8fd809c7947b3f071621b91b7838

                                                                          SHA512

                                                                          734cb497e809bb7568d0fbae2b0a4a21d1cf2e239161af77678788e49bf2313442b87b7477768290f22e31485b5081fb3569e293aa4bf98d698b80843464b24b

                                                                          Download Submit

                                                                        • C:\Config.Msi\e57d7d8.rbs
                                                                          Filesize

                                                                          8KB

                                                                          MD5

                                                                          c343dde9b00df83f263ce34a1230032f

                                                                          SHA1

                                                                          a999293f607d9a623f6901f7c06aa1f3b3a2a937

                                                                          SHA256

                                                                          5b6b5e1db5a18f8c214f3b176e35daa474f6e38c17b9aefa4baaf6f94d4412c7

                                                                          SHA512

                                                                          c52a91edfa8c450c48b448e0409d919a3d613958b7f70e855ccb9eac1082798e5eb03c9ae20f4124dcba682d5a52bbeb9f8608bf15091cb684a0bc92eaa50205

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          337079222a6f6c6edf58f3f981ff20ae

                                                                          SHA1

                                                                          1f705fc0faa84c69e1fe936b34783b301323e255

                                                                          SHA256

                                                                          ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                                          SHA512

                                                                          ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                          Filesize

                                                                          142KB

                                                                          MD5

                                                                          477293f80461713d51a98a24023d45e8

                                                                          SHA1

                                                                          e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                          SHA256

                                                                          a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                          SHA512

                                                                          23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          b3bb71f9bb4de4236c26578a8fae2dcd

                                                                          SHA1

                                                                          1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                          SHA256

                                                                          e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                          SHA512

                                                                          fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                          Filesize

                                                                          210KB

                                                                          MD5

                                                                          c106df1b5b43af3b937ace19d92b42f3

                                                                          SHA1

                                                                          7670fc4b6369e3fb705200050618acaa5213637f

                                                                          SHA256

                                                                          2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                          SHA512

                                                                          616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                          Filesize

                                                                          693KB

                                                                          MD5

                                                                          2c4d25b7fbd1adfd4471052fa482af72

                                                                          SHA1

                                                                          fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                          SHA256

                                                                          2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                          SHA512

                                                                          f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                          Filesize

                                                                          157KB

                                                                          MD5

                                                                          57130702f8ea46ed0437ea893c95f7e4

                                                                          SHA1

                                                                          0e26c3ef0ec0be063aacd7321ee550e321bad17f

                                                                          SHA256

                                                                          9338c8080cb7be1ee73f1cd706e5e230a0c3b8690305cd9de451fad20b2d0b7b

                                                                          SHA512

                                                                          10951c367ac35dba9d644fb1cc07043fc238f4cad5ab2280cc1102e860676e1bc4b3a88054f252e26aa9b9e2b52c8941c2d47e1e79d153b4ee3780151c73a02c

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                          Filesize

                                                                          51KB

                                                                          MD5

                                                                          3180c705182447f4bcc7ce8e2820b25d

                                                                          SHA1

                                                                          ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                          SHA256

                                                                          5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                          SHA512

                                                                          228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                          Filesize

                                                                          12B

                                                                          MD5

                                                                          dc63026e80d2bb04f71e41916f807e33

                                                                          SHA1

                                                                          6cda386d2c365f94ea3de41e2390fd916622eb51

                                                                          SHA256

                                                                          3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                                          SHA512

                                                                          61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                          Filesize

                                                                          173KB

                                                                          MD5

                                                                          31def444e6135301ea3c38a985341837

                                                                          SHA1

                                                                          f135be75c721af2d5291cb463cbc22a32467084a

                                                                          SHA256

                                                                          36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                                          SHA512

                                                                          bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                          Filesize

                                                                          546B

                                                                          MD5

                                                                          158fb7d9323c6ce69d4fce11486a40a1

                                                                          SHA1

                                                                          29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                          SHA256

                                                                          5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                          SHA512

                                                                          7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                          Filesize

                                                                          94KB

                                                                          MD5

                                                                          9d8b5941ea5b905e8197a175ef2b15a9

                                                                          SHA1

                                                                          86a078e94b5578ec4125f50f78c8518a8ce1d086

                                                                          SHA256

                                                                          c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d

                                                                          SHA512

                                                                          fab5fe82873862ce8ed1a427482093cca307f6663e9f6497fdc244ce461312872d419ff274cdca0c496414c28681901f335c9911b95d2a7c112d30e32d74e498

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                          Filesize

                                                                          688KB

                                                                          MD5

                                                                          ba66874c510645c1fb5fe74f85b32e98

                                                                          SHA1

                                                                          e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                                          SHA256

                                                                          12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                                          SHA512

                                                                          44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                          Filesize

                                                                          27KB

                                                                          MD5

                                                                          797c9554ec56fd72ebb3f6f6bef67fb5

                                                                          SHA1

                                                                          40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                          SHA256

                                                                          7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                          SHA512

                                                                          4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                          Filesize

                                                                          214KB

                                                                          MD5

                                                                          01807774f043028ec29982a62fa75941

                                                                          SHA1

                                                                          afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                          SHA256

                                                                          9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                          SHA512

                                                                          33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                          Filesize

                                                                          37KB

                                                                          MD5

                                                                          efb4712c8713cb05eb7fe7d87a83a55a

                                                                          SHA1

                                                                          c94d106bba77aecf88540807da89349b50ea5ae7

                                                                          SHA256

                                                                          30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                          SHA512

                                                                          3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                          Filesize

                                                                          3.4MB

                                                                          MD5

                                                                          e010d1f614b1a830482d3df4ba056f24

                                                                          SHA1

                                                                          5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                          SHA256

                                                                          98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                          SHA512

                                                                          727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                          Filesize

                                                                          389KB

                                                                          MD5

                                                                          5e3252e0248b484e76fcdbf8b42a645d

                                                                          SHA1

                                                                          11ae92fd16ac87f6ab755911e85e263253c16516

                                                                          SHA256

                                                                          01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                          SHA512

                                                                          540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          bb0622688747597214b4c5be0a88cbf2

                                                                          SHA1

                                                                          71f74f4b9e39502e8a04950b2325e609f07f5d7e

                                                                          SHA256

                                                                          8fc1cac39513e7c821465f6f43a9350a418466f8937909cdf3e0d55f7506bb7b

                                                                          SHA512

                                                                          d3a1045a0e97bf1c99895a96758b718b010695b582245978c0bfa7b280ecf90e971fe698163fa16f6ecce9d1e01ab20e16101c96964dad20e148b005578125c1

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                          Filesize

                                                                          196KB

                                                                          MD5

                                                                          5f782d0cb0f717ae9dfd1b4da1295f15

                                                                          SHA1

                                                                          b33575e428e19940f0585c747e054ca70a12d454

                                                                          SHA256

                                                                          0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                                          SHA512

                                                                          e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                          Filesize

                                                                          55KB

                                                                          MD5

                                                                          a739b889642ca9ce4ad3a37a3c521604

                                                                          SHA1

                                                                          18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                                          SHA256

                                                                          44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                                          SHA512

                                                                          92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          9d1528a2ce17522f6de064ae2c2b608e

                                                                          SHA1

                                                                          2f1ce8b589e57ab300bb93dde176689689f75114

                                                                          SHA256

                                                                          11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                          SHA512

                                                                          a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.880.update
                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          14ffcf07375b3952bd3f2fe52bb63c14

                                                                          SHA1

                                                                          ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                          SHA256

                                                                          6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                          SHA512

                                                                          14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                          Filesize

                                                                          8KB

                                                                          MD5

                                                                          88492105286ac447615803d66201b486

                                                                          SHA1

                                                                          c65b5d67a798038e7c8becc669d61729b97634ec

                                                                          SHA256

                                                                          8ff745ffe1033874154491100150890f54e1ad1389a48ad6429ada477ed1809d

                                                                          SHA512

                                                                          edf742db94f8ccffc67fdb7989ce806fee9fdce88811cd002659db5a5e23935c754020769a79ce5279cbfde5056d8724d45bcc172dc74f47cb915daa98bb010e

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                          Filesize

                                                                          2B

                                                                          MD5

                                                                          81051bcc2cf1bedf378224b0a93e2877

                                                                          SHA1

                                                                          ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                          SHA256

                                                                          7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                          SHA512

                                                                          1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                          Filesize

                                                                          54KB

                                                                          MD5

                                                                          77c613ffadf1f4b2f50d31eeec83af30

                                                                          SHA1

                                                                          76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                          SHA256

                                                                          2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                          SHA512

                                                                          29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          749c51599fbf82422791e0df1c1e841c

                                                                          SHA1

                                                                          bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                                          SHA256

                                                                          c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                                          SHA512

                                                                          f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                          Filesize

                                                                          50KB

                                                                          MD5

                                                                          c0f02eaa3eb28659d8f1bcba8de48479

                                                                          SHA1

                                                                          5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                                          SHA256

                                                                          6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                                          SHA512

                                                                          47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                          Filesize

                                                                          32KB

                                                                          MD5

                                                                          f531d3157e9ff57eea92db36c40e283e

                                                                          SHA1

                                                                          d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                                          SHA256

                                                                          30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                                          SHA512

                                                                          27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                          Filesize

                                                                          54KB

                                                                          MD5

                                                                          d11b2139d29e79d795054c3866898b7f

                                                                          SHA1

                                                                          020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                                          SHA256

                                                                          11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                                          SHA512

                                                                          de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                          Filesize

                                                                          588KB

                                                                          MD5

                                                                          17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                          SHA1

                                                                          bc0316e11c119806907c058d62513eb8ce32288c

                                                                          SHA256

                                                                          13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                          SHA512

                                                                          f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                          Filesize

                                                                          214B

                                                                          MD5

                                                                          1d5bb68dcef4a84b6967b4399524734b

                                                                          SHA1

                                                                          78c45782f4794f01c9a2eeeb85caa79955a662ef

                                                                          SHA256

                                                                          e92f50544d88c7bff7c5134c4bacedea19a04c0f8fd7b86b388102a616444023

                                                                          SHA512

                                                                          221ee64c121db8a0a20a783d26164ad43bfccb04ebc0e0f11842f1785701b5d14e28f956799de0dc4bb314b17b486b0aa616d0c4bc7f79f699f75eb6eed6aaa8

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                          Filesize

                                                                          9KB

                                                                          MD5

                                                                          1ef7574bc4d8b6034935d99ad884f15b

                                                                          SHA1

                                                                          110709ab33f893737f4b0567f9495ac60c37667c

                                                                          SHA256

                                                                          0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                          SHA512

                                                                          947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          f512536173e386121b3ebd22aac41a4e

                                                                          SHA1

                                                                          74ae133215345beaebb7a95f969f34a40dda922a

                                                                          SHA256

                                                                          a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                          SHA512

                                                                          1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                          Filesize

                                                                          76KB

                                                                          MD5

                                                                          b40fe65431b18a52e6452279b88954af

                                                                          SHA1

                                                                          c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                          SHA256

                                                                          800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                          SHA512

                                                                          e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                          Filesize

                                                                          80KB

                                                                          MD5

                                                                          3904d0698962e09da946046020cbcb17

                                                                          SHA1

                                                                          edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                          SHA256

                                                                          a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                          SHA512

                                                                          c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                          Download Submit

                                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                                          Filesize

                                                                          92KB

                                                                          MD5

                                                                          1ed3ba4568ccd052b28109123a3a2196

                                                                          SHA1

                                                                          1639e8dd5ee78b493d708b7b261288c731190a8b

                                                                          SHA256

                                                                          e18421a57eb3acc1d50b40a21c1668121ca5fc8065f6da4f465cd9fec43905d7

                                                                          SHA512

                                                                          d55b8640056c1cc89268658c63cbbf50069f54591d4a80416c2df4142c7bb3d033a0ecce342102b66995f45bbaec24da8685263760006ed16f635bf5b68dce9b

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                          Filesize

                                                                          287B

                                                                          MD5

                                                                          fcad4da5d24f95ebf38031673ddbcdb8

                                                                          SHA1

                                                                          3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                                          SHA256

                                                                          7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                                          SHA512

                                                                          1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                          Filesize

                                                                          7KB

                                                                          MD5

                                                                          362ce475f5d1e84641bad999c16727a0

                                                                          SHA1

                                                                          6b613c73acb58d259c6379bd820cca6f785cc812

                                                                          SHA256

                                                                          1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                          SHA512

                                                                          7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                          Filesize

                                                                          1.9MB

                                                                          MD5

                                                                          e0b94ce5d948f332b6bcb4661b73611b

                                                                          SHA1

                                                                          a9272bd639ff5f25f44b3a31c5cb919f0d40c4d3

                                                                          SHA256

                                                                          a27b758c00eab6777ac9571ef4fcdb80abaccbc4eb6fa5ff8e5ec33c08ffbc37

                                                                          SHA512

                                                                          17b5df8ea6ccbb64839e5d223ed388a3bb54c0a7974e05e285361e36489d63f9e4a5f0da21cdf86c58dbe80903e8cb288817291dce4c7e98e8e8ce8a0b912b46

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.ini
                                                                          Filesize

                                                                          13B

                                                                          MD5

                                                                          82f71b382e51cae212e670779dbdf14e

                                                                          SHA1

                                                                          c764f353e7b76236468649989c39eaef3b97e701

                                                                          SHA256

                                                                          b57642302dea3460bd78b6d9c62593939852c8526ba1779067d411e4dda3de17

                                                                          SHA512

                                                                          c5687a7dbbd4c714181f1ecfe1810a48109a4d9d4e3e90e88da67fa3cb2736d5b3aa260b6680fa6a07faa66ccb59db05f9e8e345fd0dc50abb63cb83daaf0bff

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                          Filesize

                                                                          1.1MB

                                                                          MD5

                                                                          9a9b1fd85b5f1dcd568a521399a0d057

                                                                          SHA1

                                                                          34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                          SHA256

                                                                          88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                          SHA512

                                                                          7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                          Filesize

                                                                          375KB

                                                                          MD5

                                                                          3c93b399b417b0d6a232d386e65a8b46

                                                                          SHA1

                                                                          bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                                          SHA256

                                                                          29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                                          SHA512

                                                                          a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                          Filesize

                                                                          321KB

                                                                          MD5

                                                                          d3901e62166e9c42864fe3062cb4d8d5

                                                                          SHA1

                                                                          c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                          SHA256

                                                                          dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                          SHA512

                                                                          ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                          Filesize

                                                                          814KB

                                                                          MD5

                                                                          9b1f97a41bfb95f148868b49460d9d04

                                                                          SHA1

                                                                          768031d5e877e347a249dfdeab7c725df941324b

                                                                          SHA256

                                                                          09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                          SHA512

                                                                          9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\log.txt
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          c7406225f0c7a53b06931ea9919188a8

                                                                          SHA1

                                                                          c2ac8ae1777d3c7b377c9a3dbfee31b713ccf46d

                                                                          SHA256

                                                                          e7b0bcc2702df286b0ff8a8eeb03450180b0cf360d76fe3a79ed79259bb6fb60

                                                                          SHA512

                                                                          d999e8159eb7f0cc5e8e0f728fd4c9cc000f27fa2eef48905d34185108cac3a2954644843da41aa1c62e89d37470b4dac4d859e9dcb30e5d76e6cf856959e868

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                          Filesize

                                                                          1.2MB

                                                                          MD5

                                                                          e74d2a16da1ddb7f9c54f72b8a25897c

                                                                          SHA1

                                                                          32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                          SHA256

                                                                          a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                          SHA512

                                                                          52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                          Filesize

                                                                          11B

                                                                          MD5

                                                                          5eda46a55c61b07029e7202f8cf1781c

                                                                          SHA1

                                                                          862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                          SHA256

                                                                          12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                          SHA512

                                                                          4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                          Filesize

                                                                          12B

                                                                          MD5

                                                                          5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                                          SHA1

                                                                          93012724e6cc0a298838aede678806e6c0c6517d

                                                                          SHA256

                                                                          a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                                          SHA512

                                                                          890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          10c3db0f1db581816d0b9d66e1465175

                                                                          SHA1

                                                                          17d7d1f3cc78321b6fecc05a8881dcdd77598bd1

                                                                          SHA256

                                                                          44212e71af43092a05d2e6dad945ad765cb96b9aad33571a2783f9f9c63ac21a

                                                                          SHA512

                                                                          1c1438b3ee8b8aa72ad3db93a6fa5da936fdb4a61bea8f73bb97ecb171d40e3af135d2e0296d8948a52709a5edbf15b133b6ef454b172d4b25c4913f97372623

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          43b8b49417883a65db80497104bc5e72

                                                                          SHA1

                                                                          3a1c01050d0e3b7ece984006363d1bc4b1a0666a

                                                                          SHA256

                                                                          858249add5f3dbf7696a0a61875fdfb7f425fd5865d9206f0206a91683cef5ff

                                                                          SHA512

                                                                          ea3bf5f4edd32705c83728e68f3504a5c2d866e05c20cfd69b5e02fb0687f292bca24d5fcdd41565d4ac00a8aa1e1c3cbf6cf334e3f2304c53dcaa828b17db43

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          f5dca09df1a2fcd22ab2951629b389e3

                                                                          SHA1

                                                                          f912a8061e4d0dfe7c24b9c15913743791951b4b

                                                                          SHA256

                                                                          62f5358fb0fa4218b99422bc65b454e19c9687b2f79463dda3a03e77e2a474c5

                                                                          SHA512

                                                                          e581bddcd1203421d961159c6f59f82b54409a36e9ab35236c35637021df91bc0ac0d37d3a634de3027355f8957b64e3abdbd7a46c46a1f08c9b5ac5fed52121

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          d4d28e08bddc6693bcdfe3fb0a2ea13a

                                                                          SHA1

                                                                          7f8d567d9958bbdeb675f8cd671bbed616a8d85b

                                                                          SHA256

                                                                          2bedaf72404f77d72ee8ae654993a897b3b65a9358f7734906849b9f3c9f8a97

                                                                          SHA512

                                                                          fb659543ca3513ff21c41a27687fb49cedd6b78c8c5fefb72ee57b7ddfe4455a783e10bb3a155596e7c458b81dc657189a8b989b2eb0f081e0704337405f54e7

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          9789dca2c8e9ad3fbad751dd9a4a5dcb

                                                                          SHA1

                                                                          4878cd819d62691cbb89fe0ad424fdeb527bec00

                                                                          SHA256

                                                                          35f56eeb7af75697ffbb8397dc3e40896729938e0a47bc5a048e382c5dc9e550

                                                                          SHA512

                                                                          b09e1081f9dd27e35499264af5b69e6e828f05646bcbab48d68dfff39ade4ca1812a830c747cb00930a005b6e114a450a5f815e1a5eb0a0af59a549a48e1ebb6

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                          Filesize

                                                                          2.8MB

                                                                          MD5

                                                                          91453d3e1e2bc9586cf5495073fb3cf7

                                                                          SHA1

                                                                          09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                                          SHA256

                                                                          5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                                          SHA512

                                                                          462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                          Filesize

                                                                          2.9MB

                                                                          MD5

                                                                          384d6da5c34ff401b18f0af41e3a2643

                                                                          SHA1

                                                                          3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                                          SHA256

                                                                          0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                                          SHA512

                                                                          5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                          Filesize

                                                                          1.1MB

                                                                          MD5

                                                                          6c6f85e896655a6eb726482f04c49086

                                                                          SHA1

                                                                          2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                          SHA256

                                                                          e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                          SHA512

                                                                          b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                          Filesize

                                                                          334KB

                                                                          MD5

                                                                          b3e14504a48bed32c53ec7aab2cb2c8f

                                                                          SHA1

                                                                          0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                                          SHA256

                                                                          adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                                          SHA512

                                                                          e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                          Filesize

                                                                          646KB

                                                                          MD5

                                                                          7895698867d1ad33934a8553b4806dc5

                                                                          SHA1

                                                                          32704df55deaff9bf0b4ee0b887541856578938b

                                                                          SHA256

                                                                          ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                                          SHA512

                                                                          20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                          Filesize

                                                                          3.1MB

                                                                          MD5

                                                                          85e1898362165fc1315d18abb73c1b37

                                                                          SHA1

                                                                          289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                                          SHA256

                                                                          d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                                          SHA512

                                                                          49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                                          Download Submit

                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                          Filesize

                                                                          569KB

                                                                          MD5

                                                                          9614d1da18956de06747c03068208d66

                                                                          SHA1

                                                                          fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                                          SHA256

                                                                          dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                                          SHA512

                                                                          d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                                          Download Submit

                                                                        • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\616f7f76a22824b9dbfbc1da00dac7d3
                                                                          Filesize

                                                                          16KB

                                                                          MD5

                                                                          b2e89027a140a89b6e3eb4e504e93d96

                                                                          SHA1

                                                                          f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                          SHA256

                                                                          5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                          SHA512

                                                                          93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                          Download Submit

                                                                        • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                          Filesize

                                                                          809B

                                                                          MD5

                                                                          8b6737800745d3b99886d013b3392ac3

                                                                          SHA1

                                                                          bb94da3f294922d9e8d31879f2d145586a182e19

                                                                          SHA256

                                                                          86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                          SHA512

                                                                          654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                          Download Submit

                                                                        • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                          Filesize

                                                                          7KB

                                                                          MD5

                                                                          6507970040b38a3192a8744692b7d401

                                                                          SHA1

                                                                          d941ae92e8d8f2c37f205cbe53a9fdd418b57632

                                                                          SHA256

                                                                          de96fb12fe458fabd542e10895a1b1f5aaca774920378f34d5f47e75d6076c71

                                                                          SHA512

                                                                          d2bf400a82060c272c40d6732fff1a488bb0736c521c3fd67bb5aac4684b6773d42d1f777b5ac6cb8e191d74a382fd96e58d95d7740f72de8bf6153ef4912873

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                          Filesize

                                                                          471B

                                                                          MD5

                                                                          646afabf478eda786a8d5e0dee389b34

                                                                          SHA1

                                                                          eac4daeba634957d051073a55e3b9a7c80991cba

                                                                          SHA256

                                                                          ccb28545fc0777dc459b1e9c1b1eae508ffd640c399b8b93de03dee6ab1e9903

                                                                          SHA512

                                                                          5b0770ce768d8aad0e5031bbc73c00a4ebbda78a43a77a20b7a4acc49acdd985e08f3b6bc631b25dde7e45edd81d51acd35a8f03ddd250f67deb8f613708ac94

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                          Filesize

                                                                          727B

                                                                          MD5

                                                                          98ba296b37c9c78c48d34c777950ab64

                                                                          SHA1

                                                                          ba86dca09404b8990bf7e13d610d1a38e691d781

                                                                          SHA256

                                                                          6281cdb569e64fc90164523b3ec2c07ab9132813210ea66abdfc66ac185c1c54

                                                                          SHA512

                                                                          60112d95c7388ed9b9702b7aae668fc91324c1ca119e356b52bec90c0c35890b6a7ebe93adfc2f23d360bae42802ab6334337b30aaf35ed9ed31d59faeffc474

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          Filesize

                                                                          727B

                                                                          MD5

                                                                          719b49661d0a10c36a9271d9507c808a

                                                                          SHA1

                                                                          7260d87a2df3f93d46aa430db45c7cc46c46de57

                                                                          SHA256

                                                                          3d2935f485ba86c0baa174e3b0a0f116af7ccdd1442905d007ea96de1f27dc10

                                                                          SHA512

                                                                          a53a4cfe3f12340737c015b40e08c7e3225d9561e91a6ed259a7c8151e67c5588c8864381504506a0deb06f1d4f766a35d264fa7996928056cadd2956d783b24

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                          Filesize

                                                                          400B

                                                                          MD5

                                                                          e9625dbb2bfc027ad992e741b516f582

                                                                          SHA1

                                                                          86cbb0cbe0ff5b0bb89b69792c9eb717d8d28ebb

                                                                          SHA256

                                                                          9f63fcdcc11979451c483df7de589a5f49e690268d19f945f825b178009eb3ed

                                                                          SHA512

                                                                          4815757dae8f5c6e26e7bbe2d92846e05685466189904281937f679c72a1704303e90d1b860be407cd880bc40fb67d5f4d6929a66c76ddd124fcd7887a94abca

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                          Filesize

                                                                          404B

                                                                          MD5

                                                                          9b396862a74f17424034b49decdd73ca

                                                                          SHA1

                                                                          88f0f4868876c1535f53f52d86313da7716cd1c2

                                                                          SHA256

                                                                          33f81ac4b379b70f2a391efd46f5d7703b3e5edd35dca2c5096725b22e479dbf

                                                                          SHA512

                                                                          b2640debba6b8120a99066aec04fb4da5f4579f8e982ae81ada7f38d01ab18c43d57db84486e2b5b8e9573fcbc2afb0dd8093525cf36f4992d3061016bebaa75

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          Filesize

                                                                          412B

                                                                          MD5

                                                                          4ca8598f07b178285cd3d12d319ab480

                                                                          SHA1

                                                                          f55b6e8fd22f3ced75add6a6f9e10bfe67a84593

                                                                          SHA256

                                                                          2766ef67b88e662ee06aa3a8c10602862212dc37a72d95cb3674eb9ba9827c31

                                                                          SHA512

                                                                          21d17d403abf21553d45f4d28be01bd553dd3f4147a520eee506f2adb23973a4ca6c4c88dcfc13638815d83756431ffd504173c6883ed69b00e5a44e94051905

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                          Filesize

                                                                          651B

                                                                          MD5

                                                                          9bbfe11735bac43a2ed1be18d0655fe2

                                                                          SHA1

                                                                          61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                          SHA256

                                                                          549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                          SHA512

                                                                          a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSI3DCE.tmp
                                                                          Filesize

                                                                          4.5MB

                                                                          MD5

                                                                          2207f96731ce2f9d9327c0baaf4959ef

                                                                          SHA1

                                                                          f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                                          SHA256

                                                                          e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                                          SHA512

                                                                          7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSI9306.tmp-\System.Management.dll
                                                                          Filesize

                                                                          60KB

                                                                          MD5

                                                                          878e361c41c05c0519bfc72c7d6e141c

                                                                          SHA1

                                                                          432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                          SHA256

                                                                          24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                          SHA512

                                                                          59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSID84F.tmp
                                                                          Filesize

                                                                          509KB

                                                                          MD5

                                                                          88d29734f37bdcffd202eafcdd082f9d

                                                                          SHA1

                                                                          823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                          SHA256

                                                                          87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                          SHA512

                                                                          1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSID84F.tmp-\AlphaControlAgentInstallation.dll
                                                                          Filesize

                                                                          25KB

                                                                          MD5

                                                                          aa1b9c5c685173fad2dabebeb3171f01

                                                                          SHA1

                                                                          ed756b1760e563ce888276ff248c734b7dd851fb

                                                                          SHA256

                                                                          e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                          SHA512

                                                                          d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSID84F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                          Filesize

                                                                          179KB

                                                                          MD5

                                                                          1a5caea6734fdd07caa514c3f3fb75da

                                                                          SHA1

                                                                          f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                          SHA256

                                                                          cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                          SHA512

                                                                          a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSIDB2E.tmp-\CustomAction.config
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          bc17e956cde8dd5425f2b2a68ed919f8

                                                                          SHA1

                                                                          5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                          SHA256

                                                                          e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                          SHA512

                                                                          02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSIDB2E.tmp-\Newtonsoft.Json.dll
                                                                          Filesize

                                                                          695KB

                                                                          MD5

                                                                          715a1fbee4665e99e859eda667fe8034

                                                                          SHA1

                                                                          e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                          SHA256

                                                                          c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                          SHA512

                                                                          bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                          Download Submit

                                                                        • C:\Windows\Installer\MSIE15B.tmp
                                                                          Filesize

                                                                          211KB

                                                                          MD5

                                                                          a3ae5d86ecf38db9427359ea37a5f646

                                                                          SHA1

                                                                          eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                          SHA256

                                                                          c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                          SHA512

                                                                          96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                          Download Submit

                                                                        • C:\Windows\Installer\e57d7c2.msi
                                                                          Filesize

                                                                          2.9MB

                                                                          MD5

                                                                          c5d6f1dbaaa149c1037f2e88d824a759

                                                                          SHA1

                                                                          46facb96e7a2332c44e412cc8aca7d2b9aca497a

                                                                          SHA256

                                                                          e6d41a5c8b4ee4d298da209f75f5ff678bfec84d8ac4a4dbf11d17e6b6aa7007

                                                                          SHA512

                                                                          5edf7f578c5cedd6cbd12f8904019a52a85ac819b2d87eb47e2300a0e95fd891a220b32790587eec6c93b4a0c88a0f554301e17bca2c78801fbb55381ad3c7e0

                                                                          Download Submit

                                                                        • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-12-58-30.dat
                                                                          Filesize

                                                                          602B

                                                                          MD5

                                                                          1948dbffff23e8bc2761478b37546bd9

                                                                          SHA1

                                                                          afff950b54a043fb404cbaa4fd40b043ed96dd8a

                                                                          SHA256

                                                                          44bd3227abfc12c3579eb89d7817908ddbe0fbbfad15319d509af01223d6ebf6

                                                                          SHA512

                                                                          abd6a47cd9279bd631673326800faa1608b832e667137d9a9729b4f0735578759e6935a78a981c2835cb22849f156a1140e11f696374213f3b98923f0835f42f

                                                                          Download Submit

                                                                        • C:\Windows\Temp\InstallUtil.log
                                                                          Filesize

                                                                          4KB

                                                                          MD5

                                                                          5d9e99c4c89f1d11aa4fecfdaab14a41

                                                                          SHA1

                                                                          57454eee0fff27619a6d1f779a68dde822528a54

                                                                          SHA256

                                                                          b7e2be001a8688081cceae37f6cb84261825d19daf21c27ec9a9fa1ad08030f4

                                                                          SHA512

                                                                          26e8e0f586ce98c57262eea91a77255632671907dcac39100c59dbfd2932ade36efe72dcd2011bb6f57727e39a7732df65a21eb531f2d50b822c4bf83060bc47

                                                                          Download Submit

                                                                        • C:\Windows\Temp\InstallUtil.log
                                                                          Filesize

                                                                          708B

                                                                          MD5

                                                                          c40c0600e978845d7a82f57bc9abb217

                                                                          SHA1

                                                                          cd76f55f5a6874bf8383c9b5817161e4ac363625

                                                                          SHA256

                                                                          54f08e6a708ac067272a0c19e948549274d58cf501d5f02343d42a5280490d18

                                                                          SHA512

                                                                          a10ac76de3aa0e068f9574c740e84985fcd7087ce34e339faab2b55bb4412d3f5a3aa9141fd562573a88242e25ce2b57b534698c3f0ea4b18db15956a9924fce

                                                                          Download Submit

                                                                        • C:\Windows\Temp\PreVer.log
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          a14aa4db8cb24316b5a76cade068c293

                                                                          SHA1

                                                                          3bb5cf956be1ba75d2c34da06ecd887f1af7c372

                                                                          SHA256

                                                                          520aebdc5f74ed96c99eb4cb73b4143b4c94a017bc0556e100f728246372fa8d

                                                                          SHA512

                                                                          9f33ff5aedafe576a5c68b6fa854e37897c23b9305c366be08fab19b6a53e428baeb58340e4257185f657d23d290059447d04522db109831513c0b24750d205c

                                                                          Download Submit

                                                                        • C:\Windows\Temp\unpack.log
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          2f8b95cc346b476b813a1c6d9d030d4e

                                                                          SHA1

                                                                          fb3634250ddc7471410efe9eeb1ab1585cfd3f2b

                                                                          SHA256

                                                                          e47a5086890cdd08466e043a9d336771d55fa6ba6236f9525c436857136cfb8c

                                                                          SHA512

                                                                          0ac2dc39bb93307a986d5ef28faefc00b5ebd7d52fb08123ca68fcfe104953ae7332eb40cc75657a53b50f8baccc41397cb6d2c3a4889ef08252db47dd7f0244

                                                                          Download Submit

                                                                        • C:\Windows\Temp\unpack.log
                                                                          Filesize

                                                                          4KB

                                                                          MD5

                                                                          888eefd8d580fda9bf3049aff8c9cc9b

                                                                          SHA1

                                                                          2b2c27b9a8697d8deb00fd660448c397a6a55a21

                                                                          SHA256

                                                                          c020f72c8aea805e69ce224271a170d062ecadaf34917350b1ca9bd0ef846bd4

                                                                          SHA512

                                                                          753743d40ea064f381325dd41f27661590761dd46f63ebda2877445deccc2d80800b3d3da0e431292093cfa4ef4816e1805130326cda76034e4334759e6d10b6

                                                                          Download Submit

                                                                        • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                          Filesize

                                                                          3.2MB

                                                                          MD5

                                                                          a7ce785b6cd1c9657040ca9b6cbeed10

                                                                          SHA1

                                                                          4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                                          SHA256

                                                                          7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                                          SHA512

                                                                          39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                                          Download Submit

                                                                        • C:\Windows\Temp\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\IsConfig.ini
                                                                          Filesize

                                                                          571B

                                                                          MD5

                                                                          38370175ce7d8dd5c3581030a9104259

                                                                          SHA1

                                                                          bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                                          SHA256

                                                                          ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                                          SHA512

                                                                          e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                                          Download Submit

                                                                        • C:\Windows\Temp\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\String1033.txt
                                                                          Filesize

                                                                          182KB

                                                                          MD5

                                                                          37a2c4ef0ff41955f1cb884b7790699f

                                                                          SHA1

                                                                          8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                                          SHA256

                                                                          6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                                          SHA512

                                                                          fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                                          Download Submit

                                                                        • C:\Windows\Temp\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\_is2C6B.exe
                                                                          Filesize

                                                                          179KB

                                                                          MD5

                                                                          7a1c100df8065815dc34c05abc0c13de

                                                                          SHA1

                                                                          3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                          SHA256

                                                                          e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                          SHA512

                                                                          bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                          Download Submit

                                                                        • C:\Windows\Temp\{19281E57-1B5C-4D70-813D-D60F27E6CB39}\setup.inx
                                                                          Filesize

                                                                          345KB

                                                                          MD5

                                                                          0376dd5b7e37985ea50e693dc212094c

                                                                          SHA1

                                                                          02859394164c33924907b85ab0aaddc628c31bf1

                                                                          SHA256

                                                                          c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                          SHA512

                                                                          69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                          Download Submit

                                                                        • C:\Windows\Temp\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\ISRT.dll
                                                                          Filesize

                                                                          427KB

                                                                          MD5

                                                                          85315ad538fa5af8162f1cd2fce1c99d

                                                                          SHA1

                                                                          31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                          SHA256

                                                                          70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                          SHA512

                                                                          877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                          Download Submit

                                                                        • C:\Windows\Temp\{BEE33017-ECAC-47AF-88CB-FD27BC23DBF8}\_isres_0x0409.dll
                                                                          Filesize

                                                                          1.8MB

                                                                          MD5

                                                                          befe2ef369d12f83c72c5f2f7069dd87

                                                                          SHA1

                                                                          b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                          SHA256

                                                                          9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                          SHA512

                                                                          760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                          Download Submit

                                                                        • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                          Filesize

                                                                          404B

                                                                          MD5

                                                                          7910b26d97bed5d0ce4d7766ad891536

                                                                          SHA1

                                                                          a1cdb94adac1ea92624ae66ec0ab1eb26361af1c

                                                                          SHA256

                                                                          793967fc984183d18865aa9da675be5b8530c367a827fb2d8ae56971e5c12b8a

                                                                          SHA512

                                                                          50e6decebce2920347287ce70c1f1323e51f011f5b9cf64de00baf3079ab30cf9ab6dfa08fac052d61c883ab3dafd4935975dba3ff1b1c215b16ed3d0212d802

                                                                          Download Submit

                                                                        • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                          Filesize

                                                                          412B

                                                                          MD5

                                                                          c0a68452ea1ea90fc60911e1179d7f74

                                                                          SHA1

                                                                          eb425ddf27995e1f806ad5e636695c3b962b3061

                                                                          SHA256

                                                                          4337d06e96ecc384975b510cb4ab3c56ca31c9477751558414af6bdd52f5fd44

                                                                          SHA512

                                                                          02edb47f2d018612c74eacf2d6bc7f1b1e0fbe7b14275186fe7bfc47c5c0adc810f2b56e4772b82ae90ee8bdb14799e8c2767f8ee4eba0b51dc5076cfae7bb84

                                                                          Download Submit

                                                                        • memory/456-195-0x000001FFC4CE0000-0x000001FFC4D92000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/456-241-0x000001FFC5220000-0x000001FFC5258000-memory.dmp

                                                                          Filesize

                                                                          224KB

                                                                          Download

                                                                        • memory/456-198-0x000001FFC4C50000-0x000001FFC4C72000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/464-76-0x0000000005330000-0x00000000053E2000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/464-79-0x0000000002F20000-0x0000000002F42000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                          Download

                                                                        • memory/464-80-0x00000000053F0000-0x0000000005744000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                          Download

                                                                        • memory/788-1044-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/788-513-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/788-901-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/788-904-0x0000000003630000-0x00000000037F7000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/788-988-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/788-1081-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/788-477-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/788-480-0x00000000035F0000-0x00000000037B7000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                          Download

                                                                        • memory/880-1762-0x000002179EEF0000-0x000002179EF36000-memory.dmp

                                                                          Filesize

                                                                          280KB

                                                                          Download

                                                                        • memory/880-1756-0x000002179F550000-0x000002179FBAC000-memory.dmp

                                                                          Filesize

                                                                          6.4MB

                                                                          Download

                                                                        • memory/880-1740-0x0000021785AD0000-0x0000021785AE0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/880-1738-0x0000021785180000-0x0000021785190000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/880-1749-0x0000021785B00000-0x0000021785B20000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/880-1743-0x000002179E2B0000-0x000002179E362000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/1028-1744-0x000001F0E2A00000-0x000001F0E2A1C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/1028-1741-0x000001F0E20A0000-0x000001F0E20B0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/1028-1772-0x000001F0FB560000-0x000001F0FB612000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/1028-1755-0x000001F0FB480000-0x000001F0FB55C000-memory.dmp

                                                                          Filesize

                                                                          880KB

                                                                          Download

                                                                        • memory/1028-1778-0x000001F0E2A20000-0x000001F0E2A28000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/1028-1742-0x000001F0E2A30000-0x000001F0E2A7A000-memory.dmp

                                                                          Filesize

                                                                          296KB

                                                                          Download

                                                                        • memory/1268-1760-0x000002870C2A0000-0x000002870C2D4000-memory.dmp

                                                                          Filesize

                                                                          208KB

                                                                          Download

                                                                        • memory/1268-1771-0x000002870CB20000-0x000002870CB3C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/1268-1784-0x000002870CB40000-0x000002870CB58000-memory.dmp

                                                                          Filesize

                                                                          96KB

                                                                          Download

                                                                        • memory/1268-1803-0x000002870CB10000-0x000002870CB1A000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                          Download

                                                                        • memory/1268-1761-0x000002870CBA0000-0x000002870CBEA000-memory.dmp

                                                                          Filesize

                                                                          296KB

                                                                          Download

                                                                        • memory/2456-272-0x000002227F010000-0x000002227F040000-memory.dmp

                                                                          Filesize

                                                                          192KB

                                                                          Download

                                                                        • memory/2456-275-0x000002227FE60000-0x000002227FF10000-memory.dmp

                                                                          Filesize

                                                                          704KB

                                                                          Download

                                                                        • memory/2456-277-0x000002227F880000-0x000002227F89C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/3340-110-0x0000000005080000-0x00000000050E6000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/3504-1764-0x000001CFA0990000-0x000001CFA0A42000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/3504-1763-0x000001CF87FA0000-0x000001CF87FB8000-memory.dmp

                                                                          Filesize

                                                                          96KB

                                                                          Download

                                                                        • memory/3504-1776-0x000001CF87FC0000-0x000001CF87FE0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3504-1757-0x000001CF87750000-0x000001CF8775C000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/3960-164-0x000001A9EEB70000-0x000001A9EEB82000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                          Download

                                                                        • memory/3960-165-0x000001A9EF500000-0x000001A9EF53C000-memory.dmp

                                                                          Filesize

                                                                          240KB

                                                                          Download

                                                                        • memory/3960-160-0x000001A9EF5A0000-0x000001A9EF638000-memory.dmp

                                                                          Filesize

                                                                          608KB

                                                                          Download

                                                                        • memory/3960-148-0x000001A9ECFB0000-0x000001A9ECFD8000-memory.dmp

                                                                          Filesize

                                                                          160KB

                                                                          Download

                                                                        • memory/4348-1769-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/4348-1773-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/4348-1783-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/4348-1786-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/4388-43-0x0000000004F70000-0x0000000004F7C000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/4388-39-0x0000000004F30000-0x0000000004F5E000-memory.dmp

                                                                          Filesize

                                                                          184KB

                                                                          Download

                                                                        • memory/4956-300-0x0000020A69670000-0x0000020A69722000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/4956-301-0x0000020A68E60000-0x0000020A68E7C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/4956-299-0x0000020A684D0000-0x0000020A684E6000-memory.dmp

                                                                          Filesize

                                                                          88KB

                                                                          Download

                                                                        • memory/5076-344-0x000001721EFF0000-0x000001721F00C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/5076-357-0x0000017237F40000-0x0000017237F66000-memory.dmp

                                                                          Filesize

                                                                          152KB

                                                                          Download

                                                                        • memory/5076-342-0x000001721EBC0000-0x000001721EC24000-memory.dmp

                                                                          Filesize

                                                                          400KB

                                                                          Download

                                                                        • memory/5076-356-0x0000017238270000-0x00000172382AA000-memory.dmp

                                                                          Filesize

                                                                          232KB

                                                                          Download

                                                                        • memory/5076-343-0x000001721F4C0000-0x000001721F50A000-memory.dmp

                                                                          Filesize

                                                                          296KB

                                                                          Download

                                                                        • memory/5076-345-0x000001721F560000-0x000001721F5AC000-memory.dmp

                                                                          Filesize

                                                                          304KB

                                                                          Download

                                                                        • memory/5076-346-0x0000017237EF0000-0x0000017237F38000-memory.dmp

                                                                          Filesize

                                                                          288KB

                                                                          Download

                                                                        • memory/5076-355-0x0000017237F70000-0x0000017237F9A000-memory.dmp

                                                                          Filesize

                                                                          168KB

                                                                          Download

                                                                        • memory/5076-354-0x0000017238020000-0x0000017238088000-memory.dmp

                                                                          Filesize

                                                                          416KB

                                                                          Download

                                                                        • memory/5076-353-0x000001721F600000-0x000001721F608000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/5076-352-0x000001721F5F0000-0x000001721F5F8000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/5076-351-0x000001721F5B0000-0x000001721F5B8000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/5076-350-0x0000017238170000-0x0000017238222000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/5076-347-0x000001721F010000-0x000001721F018000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/5076-348-0x000001721F020000-0x000001721F02A000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                          Download

                                                                        • memory/5076-349-0x0000017238090000-0x000001723816C000-memory.dmp

                                                                          Filesize

                                                                          880KB

                                                                          Download

                                                                        • memory/5240-1735-0x000001FC34300000-0x000001FC3430C000-memory.dmp

                                                                          Filesize

                                                                          48KB

                                                                          Download

                                                                        • memory/5240-1739-0x000001FC34C70000-0x000001FC34C8C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/5240-1798-0x000001FC4D5F0000-0x000001FC4D6A0000-memory.dmp

                                                                          Filesize

                                                                          704KB

                                                                          Download

                                                                        • memory/5240-1736-0x000001FC34CA0000-0x000001FC34CEA000-memory.dmp

                                                                          Filesize

                                                                          296KB

                                                                          Download

                                                                        • memory/5448-1770-0x0000018CB92E0000-0x0000018CB932A000-memory.dmp

                                                                          Filesize

                                                                          296KB

                                                                          Download

                                                                        • memory/5448-1777-0x0000018CB9290000-0x0000018CB92AC000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/5448-1758-0x0000018CB8A20000-0x0000018CB8A32000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                          Download

                                                                        • memory/5452-1135-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5452-2291-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5452-2292-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5452-1134-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5452-1219-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5452-1218-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5472-1745-0x000002A4F56A0000-0x000002A4F56DA000-memory.dmp

                                                                          Filesize

                                                                          232KB

                                                                          Download

                                                                        • memory/5488-1242-0x00000294389B0000-0x00000294389C2000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                          Download

                                                                        • memory/5488-1243-0x0000029438E70000-0x0000029438E8C000-memory.dmp

                                                                          Filesize

                                                                          112KB

                                                                          Download

                                                                        • memory/5488-1324-0x0000029452620000-0x0000029452674000-memory.dmp

                                                                          Filesize

                                                                          336KB

                                                                          Download

                                                                        • memory/5488-1244-0x0000029451AE0000-0x0000029451B92000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/5724-1599-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5724-1612-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5724-1163-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5724-1176-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5760-1615-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5760-3105-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5760-1178-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5760-2293-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5760-1614-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5760-1177-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5760-3104-0x00000000728C0000-0x00000000729DC000-memory.dmp

                                                                          Filesize

                                                                          1.1MB

                                                                          Download

                                                                        • memory/5760-2294-0x00000000724F0000-0x00000000728BD000-memory.dmp

                                                                          Filesize

                                                                          3.8MB

                                                                          Download

                                                                        • memory/5852-1774-0x00000267129B0000-0x00000267129C0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5852-1804-0x000002672BBF0000-0x000002672BCA2000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/5852-1775-0x0000026712E50000-0x0000026712E70000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/5880-1600-0x0000020452AF0000-0x0000020452B0A000-memory.dmp

                                                                          Filesize

                                                                          104KB

                                                                          Download

                                                                        • memory/5880-1483-0x00000204521A0000-0x00000204521AA000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                          Download

                                                                        • memory/5880-1704-0x000002046B350000-0x000002046B402000-memory.dmp

                                                                          Filesize

                                                                          712KB

                                                                          Download

                                                                        • memory/5880-1759-0x000002046BA40000-0x000002046BF68000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                          Download