Overview

overview

10

Static

static

10

99943cbf51...06.msi

windows7-x64

10

99943cbf51...06.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 01:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    99943cbf5119b45787f6d349e0c8f65768360253e00451b9050923bfe4618e06.msi

  • Size

    2.9MB

  • MD5

    16a2d0c6e475bc422bf93644bef37e3a

  • SHA1

    f81d7cebf47a0df8e55501ef8edb2ff9fbf8c78d

  • SHA256

    99943cbf5119b45787f6d349e0c8f65768360253e00451b9050923bfe4618e06

  • SHA512

    77fd886d244569e7074b87c48666e1b568fee6b8cde708f81b7b99e60744d7abe35bfaf46540a42f9cdc86d65cc84ae089d55567c702e608c0de7dbed628f79f

  • SSDEEP

    49152:T+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:T+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\99943cbf5119b45787f6d349e0c8f65768360253e00451b9050923bfe4618e06.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1728
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:732
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 73CDFDF7C2D2D0D1D1ECBAE103A94A4E
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC69C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633734 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4340
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC94C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240634234 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3832
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICE6E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240635515 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:676
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID9AE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638437 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4828
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 3038181356C819C298A9B6B240A31ED5 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3600
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:536
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1132
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000MsCh3IAF" /AgentId="05f830d3-cb93-445c-90f7-03fc47a8b918"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        PID:3436
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 37A6D25FFABBD0F3718142ABAB6107B7 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32E32E4F-A2BF-4393-AE82-FAD76895EFED}
          3⤵
          • Executes dropped EXE
          PID:1976
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A225A389-4658-4801-A99C-9FAD9A9B9EA8}
          3⤵
          • Executes dropped EXE
          PID:1836
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A89F5E7A-56AF-412D-BD0D-3284E192714C}
          3⤵
          • Executes dropped EXE
          PID:732
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21D53B08-9614-4C1C-8AB5-CC254DCCF91B}
          3⤵
          • Executes dropped EXE
          PID:3556
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F31F64D0-7C08-4792-A7CA-A0C514F3CC7B}
          3⤵
          • Executes dropped EXE
          PID:3052
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC53CCF6-8E55-4873-A51F-8101606CF506}
          3⤵
          • Executes dropped EXE
          PID:4340
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{960FC13B-CFBC-4BB0-8987-87F458100B81}
          3⤵
          • Executes dropped EXE
          PID:3192
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF50BD5C-3517-41EC-999B-E58E033D55B8}
          3⤵
          • Executes dropped EXE
          PID:2900
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{15DDC1A9-3173-4AA7-9B40-48B435E4F2DE}
          3⤵
          • Executes dropped EXE
          PID:4324
        • C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe
          C:\Windows\TEMP\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_is1C2E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8AA5D53-13BC-40EE-AE25-C159043F5114}
          3⤵
          • Executes dropped EXE
          PID:1836
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1396
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3576
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3600
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1976
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2008
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4592
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:536
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1972
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:3052
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRFeatMini.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1380
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4996
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRManager.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:2756
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2032
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAgent.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:2624
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4416
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:4508
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2624
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAudioChat.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:4692
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1380
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:4508
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRVirtualDisplay.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:380
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7476506F-A308-4B63-9930-AE0056F312D3}
              3⤵
              • Executes dropped EXE
              PID:3896
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8EC89ABC-96C6-45E8-9355-C8E8CB318314}
              3⤵
              • Executes dropped EXE
              PID:3052
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2BFF0A40-8171-4B56-B4C7-71D87403C1A4}
              3⤵
              • Executes dropped EXE
              PID:4948
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7D0D752-13FC-47BA-B26A-AB059C0FD549}
              3⤵
              • Executes dropped EXE
              PID:4324
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59FB60A4-8A64-4107-9EB8-DE5E6CA4DEC6}
              3⤵
              • Executes dropped EXE
              PID:1436
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A47B9D23-D18F-4932-9993-E313DB1EFDE8}
              3⤵
              • Executes dropped EXE
              PID:1924
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9D7101B0-FB82-40C7-BE74-3193C2329FF5}
              3⤵
              • Executes dropped EXE
              PID:1480
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B1EF27F-D4FA-4724-AB28-CBE9F7A0F43C}
              3⤵
              • Executes dropped EXE
              PID:5116
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4BC0FA2-CD43-4CFF-970D-802AB1A52CDD}
              3⤵
              • Executes dropped EXE
              PID:4360
            • C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
              C:\Windows\TEMP\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D0E2A9BE-F4F7-4B54-979C-AAC4C8E0D1AB}
              3⤵
              • Executes dropped EXE
              PID:4684
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ABD7859C-5F54-40F6-8434-637CD04051A5}
              3⤵
              • Executes dropped EXE
              PID:3304
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{05D9E4D3-1F64-472C-A83D-91C094512E05}
              3⤵
              • Executes dropped EXE
              PID:1760
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{64B6EAA2-9814-4D78-98C0-2C7AE692EB70}
              3⤵
              • Executes dropped EXE
              PID:2756
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{052DFDFC-0352-4244-A01E-7193EEA5CDD8}
              3⤵
              • Executes dropped EXE
              PID:1436
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E29A4485-619F-4A73-9DCA-C9E7A6E3354B}
              3⤵
              • Executes dropped EXE
              PID:4872
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{24F9905D-0EB8-4C0D-9B65-FDD52EA56791}
              3⤵
              • Executes dropped EXE
              PID:1132
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{93834747-DBAA-421A-B23D-6BAD4CC0B5E4}
              3⤵
              • Executes dropped EXE
              PID:1716
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{335E6DFB-5922-4EB6-86F1-FECEA4CAD27A}
              3⤵
              • Executes dropped EXE
              PID:452
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C0CF65C-9E49-4AF1-B35A-DD9FE518757F}
              3⤵
              • Executes dropped EXE
              PID:4948
            • C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe
              C:\Windows\TEMP\{426F4AFD-E9D5-44A6-8627-5621E92AECDA}\_is349A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5A565FC3-2578-4BD0-BC64-BB2EB5D3240D}
              3⤵
              • Executes dropped EXE
              PID:4804
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4200
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4536
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4508
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                4⤵
                  PID:4692
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                  4⤵
                    PID:4324
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4772
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA7E6569-4175-48B5-AEFD-9F1464FAF582}
                  3⤵
                  • Executes dropped EXE
                  PID:1172
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6C45F587-C1C5-4D81-96E1-C90E8AB73A80}
                  3⤵
                  • Executes dropped EXE
                  PID:4896
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A745F394-1F43-4BFB-8EB5-4699BECDA8A6}
                  3⤵
                  • Executes dropped EXE
                  PID:3788
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1D25C01-40E4-45E7-AF01-8D820BECC9ED}
                  3⤵
                  • Executes dropped EXE
                  PID:1004
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9DBE5D7-263E-4488-B45A-4C6461F5DBC9}
                  3⤵
                  • Executes dropped EXE
                  PID:4340
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CF3586B5-E19C-4068-91CC-CF32492E33E2}
                  3⤵
                  • Executes dropped EXE
                  PID:4768
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA6ECD47-7DE6-4EA2-B08C-0A1FAD4193A9}
                  3⤵
                  • Executes dropped EXE
                  PID:1576
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{76C71181-B0F5-4E12-BFEE-EF9E8F80524E}
                  3⤵
                  • Executes dropped EXE
                  PID:1176
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{56E6FFC5-6163-44EC-AD58-BBD7D5110E80}
                  3⤵
                  • Executes dropped EXE
                  PID:1172
                • C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe
                  C:\Windows\TEMP\{B175E83F-78BC-4D06-954F-59D055B3A0EB}\_is4620.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D0F057B-DDE4-4715-9159-32D2019FCFDE}
                  3⤵
                  • Executes dropped EXE
                  PID:5012
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2008
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    4⤵
                      PID:1004
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{553A6681-7FAB-4401-9601-AA8F10FD9364}
                    3⤵
                    • Executes dropped EXE
                    PID:4888
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2CAC81FB-0C8D-4014-98DA-3041DB4F15ED}
                    3⤵
                    • Executes dropped EXE
                    PID:4896
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1AFB0B88-DC4E-40F4-B6E7-2B0B0D1625F7}
                    3⤵
                    • Executes dropped EXE
                    PID:3660
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C8ABE68-B4CF-4FBE-A2AD-1324FCC75213}
                    3⤵
                    • Executes dropped EXE
                    PID:4692
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16BD07B7-8EFA-4484-AB2D-B03428CC798D}
                    3⤵
                    • Executes dropped EXE
                    PID:1292
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1699522D-230A-4C7E-9516-2A31FF708DE7}
                    3⤵
                    • Executes dropped EXE
                    PID:2660
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2077C5E8-50D8-4B6F-A126-F47055C60E3D}
                    3⤵
                    • Executes dropped EXE
                    PID:1576
                  • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                    C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0E91AF40-DE00-4FAD-8FFC-F9A36C61E626}
                    3⤵
                      PID:428
                    • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                      C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B08EF834-4835-4634-ACDF-45638BD5D05A}
                      3⤵
                        PID:1964
                      • C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe
                        C:\Windows\TEMP\{6889FB31-903B-42B7-A8E3-8C4AEDB7968D}\_is4A57.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{96D12DC2-48A4-4D27-A6CC-2C0BC61FFA65}
                        3⤵
                          PID:3304
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1832
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding B5EBD936DFDB4FC6E681FAD04E22DAF6 E Global\MSI0000
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:5724
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Windows\Installer\MSI826C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240681625 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                          3⤵
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:6120
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Windows\Installer\MSI8309.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240681718 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                          3⤵
                          • Blocklisted process makes network request
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:5328
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Windows\Installer\MSI859B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240682375 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                          3⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3292
                        • C:\Windows\SysWOW64\NET.exe
                          "NET" STOP AteraAgent
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5720
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 STOP AteraAgent
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5568
                        • C:\Windows\SysWOW64\TaskKill.exe
                          "TaskKill.exe" /f /im AteraAgent.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          PID:2816
                        • C:\Windows\syswow64\NET.exe
                          "NET" STOP AteraAgent
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2860
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 STOP AteraAgent
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:6104
                        • C:\Windows\syswow64\TaskKill.exe
                          "TaskKill.exe" /f /im AteraAgent.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          PID:5336
                        • C:\Windows\SysWOW64\rundll32.exe
                          rundll32.exe "C:\Windows\Installer\MSIA58F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240690546 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                          3⤵
                          • Blocklisted process makes network request
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:5556
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                        2⤵
                        • Drops file in System32 directory
                        PID:5576
                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                        "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="c10b3b9c-824e-4ab5-9dd2-71300d6c626d"
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:2224
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3144
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                      1⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2880
                      • C:\Windows\System32\sc.exe
                        "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                        2⤵
                        • Launches sc.exe
                        PID:3076
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "724ba066-2113-4ad2-9022-ec90807adf20" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MsCh3IAF
                        2⤵
                        • Drops file in System32 directory
                        • Executes dropped EXE
                        PID:2264
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "b2a46517-5aed-4fc4-8d06-06671cb30293" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MsCh3IAF
                        2⤵
                        • Executes dropped EXE
                        PID:1144
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "8429ed0f-c2a0-4725-bff9-cb0df7a38412" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000MsCh3IAF
                        2⤵
                        • Executes dropped EXE
                        PID:1972
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "9c4a51ca-6084-458c-8038-adba41617ebf" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000MsCh3IAF
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3552
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2008
                          • C:\Windows\system32\cscript.exe
                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            4⤵
                            • Modifies data under HKEY_USERS
                            PID:3208
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "a4f67de4-793a-4502-8adc-16c4458a5fba" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000MsCh3IAF
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2932
                        • C:\Windows\TEMP\SplashtopStreamer.exe
                          "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3164
                          • C:\Windows\Temp\unpack\PreVerCheck.exe
                            "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:4100
                            • C:\Windows\SysWOW64\msiexec.exe
                              msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:3096
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "b0d08bab-c174-4b3c-b353-6234e832f3a8" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MsCh3IAF
                        2⤵
                        • Executes dropped EXE
                        PID:2140
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                      1⤵
                      • Drops file in Program Files directory
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3516
                      • C:\Windows\System32\sc.exe
                        "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                        2⤵
                        • Launches sc.exe
                        PID:4216
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "b0d08bab-c174-4b3c-b353-6234e832f3a8" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MsCh3IAF
                        2⤵
                        • Drops file in System32 directory
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1836
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "74af7394-0ef1-4816-a18f-4e5a523ec462" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MsCh3IAF
                        2⤵
                        • Modifies data under HKEY_USERS
                        PID:4200
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          3⤵
                            PID:5668
                            • C:\Windows\system32\cscript.exe
                              cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                              4⤵
                              • Modifies data under HKEY_USERS
                              PID:5896
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "b873e327-13e1-43e0-b147-3033ac59d88e" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MsCh3IAF
                          2⤵
                          • Writes to the Master Boot Record (MBR)
                          • Modifies data under HKEY_USERS
                          PID:2676
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "47eb203e-8d0f-4f56-8be9-633d2a7387be" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MsCh3IAF
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          PID:4684
                          • C:\Windows\SYSTEM32\msiexec.exe
                            "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                            3⤵
                            • Modifies data under HKEY_USERS
                            PID:5284
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "ec1fb06b-f483-4e10-a461-7ca24f09ab00" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MsCh3IAF
                          2⤵
                          • Drops file in System32 directory
                          PID:4772
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "8e46a7f4-1cc1-4de8-ba98-561a5e1e6268" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MsCh3IAF
                          2⤵
                          • Drops file in System32 directory
                          PID:1380
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "ccccf036-291e-40a9-8838-6e71f9a066fb" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MsCh3IAF
                          2⤵
                          • Drops file in System32 directory
                          PID:5592
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "717442ed-fb02-4da9-b9a5-6a58b52f0b13" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MsCh3IAF
                          2⤵
                          • Drops file in System32 directory
                          PID:5956
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "f932df9b-f775-46f3-8fe0-c62d0bd50851" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MsCh3IAF
                          2⤵
                            PID:5980
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "29fc3613-070a-4bfd-97ad-382d9dba0bad" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MsCh3IAF
                            2⤵
                              PID:5492
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=c4f5d676b4c4925f96e85d5978affb7c&rmm_session_pwd_ttl=86400"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5984
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "9f2886c8-029f-43fb-99e3-94721c081b04" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MsCh3IAF
                              2⤵
                                PID:5508
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "ae91e386-f81c-4ccc-9948-9aa6c059b72e" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MsCh3IAF
                                2⤵
                                • Modifies registry class
                                PID:5340
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "629eb35a-a9d7-45ef-a88e-6e4c1a026a96" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MsCh3IAF
                                2⤵
                                • Drops file in System32 directory
                                PID:1464
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "214d410b-0220-4205-8203-f8136b677c94" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MsCh3IAF
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                PID:6024
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "e806e88e-699e-46ee-aa0a-3f9fccf078a7" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MsCh3IAF
                                2⤵
                                • Drops file in Program Files directory
                                PID:5872
                                • C:\Windows\SYSTEM32\cmd.exe
                                  "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                  3⤵
                                  • System Time Discovery
                                  PID:5824
                                  • C:\Program Files\dotnet\dotnet.exe
                                    dotnet --list-runtimes
                                    4⤵
                                    • System Time Discovery
                                    PID:5848
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:824
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:536
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                  -h
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4768
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                  3⤵
                                  • Drops file in Program Files directory
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:4896
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                    4⤵
                                      PID:4284
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5012
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3428
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                      SRUtility.exe -r
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2956
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5876
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                      4⤵
                                        PID:2860
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ver
                                          5⤵
                                            PID:6036
                                          • C:\Windows\system32\sc.exe
                                            sc query ddmgr
                                            5⤵
                                            • Launches sc.exe
                                            PID:4536
                                          • C:\Windows\system32\sc.exe
                                            sc query lci_proxykmd
                                            5⤵
                                            • Launches sc.exe
                                            PID:4572
                                          • C:\Windows\system32\rundll32.exe
                                            rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                            5⤵
                                            • Drops file in Windows directory
                                            • Checks SCSI registry key(s)
                                            • Modifies data under HKEY_USERS
                                            PID:5844
                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                    1⤵
                                    • Drops file in Program Files directory
                                    • Modifies data under HKEY_USERS
                                    PID:5852
                                    • C:\Windows\System32\sc.exe
                                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                      2⤵
                                      • Launches sc.exe
                                      PID:672
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "a77fd15f-ad24-469c-89bf-8c1e4c8b41f9" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MsCh3IAF
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5768
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                        3⤵
                                          PID:5216
                                          • C:\Windows\system32\cscript.exe
                                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                            4⤵
                                            • Modifies data under HKEY_USERS
                                            PID:5916
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "0857fa84-d44f-4105-a955-a2d745c73181" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MsCh3IAF
                                        2⤵
                                          PID:2756
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "e820b02b-4d02-4f9a-a4ff-7c5de28840cc" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MsCh3IAF
                                          2⤵
                                            PID:5492
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "1996b2fe-5f96-44e7-9839-c9e16561fda2" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MsCh3IAF
                                            2⤵
                                            • Drops file in Program Files directory
                                            • Modifies data under HKEY_USERS
                                            PID:2096
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "2ff00433-8d1e-4b9d-aa5b-97c935ca416b" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MsCh3IAF
                                            2⤵
                                              PID:5740
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "fd9427e3-4f06-40ef-a493-16a89e1c4473" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MsCh3IAF
                                              2⤵
                                                PID:1972
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "ae1596ec-a130-45d8-8c29-e244b0d5ef97" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MsCh3IAF
                                                2⤵
                                                  PID:4200
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                    3⤵
                                                    • System Time Discovery
                                                    PID:1856
                                                    • C:\Program Files\dotnet\dotnet.exe
                                                      dotnet --list-runtimes
                                                      4⤵
                                                      • System Time Discovery
                                                      PID:1988
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "6144ab5a-f150-41b6-a554-d14c32509d78" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MsCh3IAF
                                                  2⤵
                                                    PID:5712
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "1ec0fb05-b370-44dd-aefc-79c999e871d5" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MsCh3IAF
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:6120
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "535306cf-bed7-45ab-a12f-aa186f3281a3" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MsCh3IAF
                                                    2⤵
                                                      PID:5516
                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=c4f5d676b4c4925f96e85d5978affb7c&rmm_session_pwd_ttl=86400"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1288
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "3574def4-fb94-4d80-8446-527a076f588d" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MsCh3IAF
                                                      2⤵
                                                        PID:2068
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "a32eb3b5-78c8-48b2-a6c9-96234645a168" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MsCh3IAF
                                                        2⤵
                                                          PID:5896
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "435baa3a-4ed2-4b25-b81d-9a2867c00957" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MsCh3IAF
                                                          2⤵
                                                          • Modifies registry class
                                                          PID:5284
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "20ce9dd3-5ce4-416e-9557-a29506ec7970" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MsCh3IAF
                                                          2⤵
                                                            PID:2888
                                                            • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                              "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "05f830d3-cb93-445c-90f7-03fc47a8b918" "20ce9dd3-5ce4-416e-9557-a29506ec7970" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000MsCh3IAF"
                                                              3⤵
                                                                PID:5336
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 05f830d3-cb93-445c-90f7-03fc47a8b918 "0857fa84-d44f-4105-a955-a2d745c73181" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MsCh3IAF
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:5224
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            PID:5568
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:5720
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000015C" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:5916
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000160"
                                                              2⤵
                                                              • Drops file in Drivers directory
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              PID:5552
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                              2⤵
                                                              • Drops file in Drivers directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              PID:5364

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Persistence

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Privilege Escalation

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Defense Evasion

                                                          Modify Registry

                                                          1
                                                          T1112

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Subvert Trust Controls

                                                          1
                                                          T1553

                                                          Install Root Certificate

                                                          1
                                                          T1553.004

                                                          System Binary Proxy Execution

                                                          1
                                                          T1218

                                                          Msiexec

                                                          1
                                                          T1218.007

                                                          Credential Access

                                                          Discovery

                                                          Peripheral Device Discovery

                                                          2
                                                          T1120

                                                          Query Registry

                                                          4
                                                          T1012

                                                          System Information Discovery

                                                          3
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          System Time Discovery

                                                          1
                                                          T1124

                                                          Lateral Movement

                                                          Collection

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Config.Msi\e57c600.rbs
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            29364f8255337ac799abd880fd936841

                                                            SHA1

                                                            02f42587c824eed1a9f1413d5d1a2d73d45bf847

                                                            SHA256

                                                            75527b0507650ad52e9235d7b040cd7bcee0632f4ea1da1da90df500edb5c8f5

                                                            SHA512

                                                            ce6f8f9cfdb032435ce317f3ca840ab544b9ed933539ba45458421083e050417089825485da63b2ec1f1896f9ef9319fdcf0992133575b5528e8a74f4de64a41

                                                            Download Submit

                                                          • C:\Config.Msi\e57c605.rbs
                                                            Filesize

                                                            74KB

                                                            MD5

                                                            94554ae18335d45db9c8a1d4ac2f2900

                                                            SHA1

                                                            b34d9e6b9af8edfa88240d40216b0d613fe2f20a

                                                            SHA256

                                                            bfa3e47482b223081aaad097f338bf2eccbc33b03185914b76c1d4e114c6c933

                                                            SHA512

                                                            70493173e781fabfe1db61d8a10b83124cc79fa499f797cd0211525791cb6863d806b530234d7a5ae51163c2877fbb97bfb54b512ce28f32c22082e4bcba376a

                                                            Download Submit

                                                          • C:\Config.Msi\e57c607.rbs
                                                            Filesize

                                                            464B

                                                            MD5

                                                            98a71e5f7f8d8bd38733765ca300aa63

                                                            SHA1

                                                            d704baa7a38b469433c543374c382fe16ed5f0b5

                                                            SHA256

                                                            5806f5a8b7952a3bbfb742e242eb9a05a3bb3457ee94e359c20ed53b1ce5b826

                                                            SHA512

                                                            66f4f9993483e98a859e144f8415d6dcb42bde4583c8b66f07eea5f140fed22a2e3ed619bd7ab4657bb3d9fb99d58241315d608cbee01bc87c530d4798d16dd4

                                                            Download Submit

                                                          • C:\Config.Msi\e57c60d.rbs
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            dc6b574b80fe000a09aad025bb580133

                                                            SHA1

                                                            5046cc7f36b98c454f0ede0b3968dd261a3643fe

                                                            SHA256

                                                            e6a02f53bda3bd4595cf16acb2f6cdf51eb68b438780b0fed64c69b9e6f3e9c2

                                                            SHA512

                                                            b57d5ac26b325c916c117b48eab24a1b46aee756ce70fa1083118a5b61fcb5012ceff633967bd09b325c140c4c80165e0780907fe85176c55001a27663c4936b

                                                            Download Submit

                                                          • C:\Config.Msi\e57c615.rbs
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            d95514f7ed9cf0adb6049761627229b7

                                                            SHA1

                                                            96b0bbc1d8bf4441ed3fa55263e592e2356d96ea

                                                            SHA256

                                                            cb526dcaabc2f2907c2b210d4cf8556b8f7f5a757c4684cefb6833d59eb44de2

                                                            SHA512

                                                            8f0fb19b45d9e727fd2dda2ed128f67c2d6b83516984e89e5de7a4ce87e752b851c0a089652b4d9d62f58c15b1be0c68cb58ab8fd4131b168fc64d161d7f785d

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            337079222a6f6c6edf58f3f981ff20ae

                                                            SHA1

                                                            1f705fc0faa84c69e1fe936b34783b301323e255

                                                            SHA256

                                                            ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                            SHA512

                                                            ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                            Filesize

                                                            142KB

                                                            MD5

                                                            477293f80461713d51a98a24023d45e8

                                                            SHA1

                                                            e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                            SHA256

                                                            a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                            SHA512

                                                            23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            b3bb71f9bb4de4236c26578a8fae2dcd

                                                            SHA1

                                                            1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                            SHA256

                                                            e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                            SHA512

                                                            fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                            Filesize

                                                            210KB

                                                            MD5

                                                            c106df1b5b43af3b937ace19d92b42f3

                                                            SHA1

                                                            7670fc4b6369e3fb705200050618acaa5213637f

                                                            SHA256

                                                            2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                            SHA512

                                                            616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                            Filesize

                                                            693KB

                                                            MD5

                                                            2c4d25b7fbd1adfd4471052fa482af72

                                                            SHA1

                                                            fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                            SHA256

                                                            2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                            SHA512

                                                            f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                            Filesize

                                                            157KB

                                                            MD5

                                                            57130702f8ea46ed0437ea893c95f7e4

                                                            SHA1

                                                            0e26c3ef0ec0be063aacd7321ee550e321bad17f

                                                            SHA256

                                                            9338c8080cb7be1ee73f1cd706e5e230a0c3b8690305cd9de451fad20b2d0b7b

                                                            SHA512

                                                            10951c367ac35dba9d644fb1cc07043fc238f4cad5ab2280cc1102e860676e1bc4b3a88054f252e26aa9b9e2b52c8941c2d47e1e79d153b4ee3780151c73a02c

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                            Filesize

                                                            51KB

                                                            MD5

                                                            3180c705182447f4bcc7ce8e2820b25d

                                                            SHA1

                                                            ad6486557819a33d3f29b18d92b43b11707aae6e

                                                            SHA256

                                                            5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                            SHA512

                                                            228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                            Filesize

                                                            12B

                                                            MD5

                                                            dc63026e80d2bb04f71e41916f807e33

                                                            SHA1

                                                            6cda386d2c365f94ea3de41e2390fd916622eb51

                                                            SHA256

                                                            3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                            SHA512

                                                            61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                            Filesize

                                                            173KB

                                                            MD5

                                                            31def444e6135301ea3c38a985341837

                                                            SHA1

                                                            f135be75c721af2d5291cb463cbc22a32467084a

                                                            SHA256

                                                            36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                            SHA512

                                                            bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                            Filesize

                                                            546B

                                                            MD5

                                                            158fb7d9323c6ce69d4fce11486a40a1

                                                            SHA1

                                                            29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                            SHA256

                                                            5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                            SHA512

                                                            7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                            Filesize

                                                            94KB

                                                            MD5

                                                            9d8b5941ea5b905e8197a175ef2b15a9

                                                            SHA1

                                                            86a078e94b5578ec4125f50f78c8518a8ce1d086

                                                            SHA256

                                                            c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d

                                                            SHA512

                                                            fab5fe82873862ce8ed1a427482093cca307f6663e9f6497fdc244ce461312872d419ff274cdca0c496414c28681901f335c9911b95d2a7c112d30e32d74e498

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                            Filesize

                                                            688KB

                                                            MD5

                                                            ba66874c510645c1fb5fe74f85b32e98

                                                            SHA1

                                                            e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                            SHA256

                                                            12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                            SHA512

                                                            44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            797c9554ec56fd72ebb3f6f6bef67fb5

                                                            SHA1

                                                            40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                            SHA256

                                                            7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                            SHA512

                                                            4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                            Filesize

                                                            214KB

                                                            MD5

                                                            01807774f043028ec29982a62fa75941

                                                            SHA1

                                                            afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                            SHA256

                                                            9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                            SHA512

                                                            33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                            Filesize

                                                            37KB

                                                            MD5

                                                            efb4712c8713cb05eb7fe7d87a83a55a

                                                            SHA1

                                                            c94d106bba77aecf88540807da89349b50ea5ae7

                                                            SHA256

                                                            30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                            SHA512

                                                            3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                            Filesize

                                                            3.4MB

                                                            MD5

                                                            e010d1f614b1a830482d3df4ba056f24

                                                            SHA1

                                                            5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                            SHA256

                                                            98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                            SHA512

                                                            727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                            Filesize

                                                            389KB

                                                            MD5

                                                            5e3252e0248b484e76fcdbf8b42a645d

                                                            SHA1

                                                            11ae92fd16ac87f6ab755911e85e263253c16516

                                                            SHA256

                                                            01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                            SHA512

                                                            540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            69b58d17dea8b913c931a076208ce56e

                                                            SHA1

                                                            515f518ed56ac2c06e37de6d073723918a28adaa

                                                            SHA256

                                                            1bf2802b60e40a856e08183dee6831629a8d98a23fda78641f811db650750ee4

                                                            SHA512

                                                            7792bfee9852048568b18d484841056832de4b3ddc14910ad4721230ec6295dde6fd5badbdaf6bab6ffa7736c6abac9a348686bf2f877b8ded21dab3feddc1d3

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            Filesize

                                                            196KB

                                                            MD5

                                                            5f782d0cb0f717ae9dfd1b4da1295f15

                                                            SHA1

                                                            b33575e428e19940f0585c747e054ca70a12d454

                                                            SHA256

                                                            0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                            SHA512

                                                            e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            Filesize

                                                            55KB

                                                            MD5

                                                            a739b889642ca9ce4ad3a37a3c521604

                                                            SHA1

                                                            18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                            SHA256

                                                            44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                            SHA512

                                                            92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            9d1528a2ce17522f6de064ae2c2b608e

                                                            SHA1

                                                            2f1ce8b589e57ab300bb93dde176689689f75114

                                                            SHA256

                                                            11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                            SHA512

                                                            a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.6024.update
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            14ffcf07375b3952bd3f2fe52bb63c14

                                                            SHA1

                                                            ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                            SHA256

                                                            6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                            SHA512

                                                            14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            11a86f266e62519a8474015d2ddf545c

                                                            SHA1

                                                            cc9ad706e3ce0b08ecb405d006c5b469276ca7dd

                                                            SHA256

                                                            334cd83fa87d528999e3d43faf7942e220097f25675a4a2b5305271e0d9f782b

                                                            SHA512

                                                            47c03c1c1c1404d451f96387290d1e584a5c6d174dd5d00b91522223590124a611d98f8e35f99893bea9e1c5372f296325d4f3a3c8e187154a495c2bc59a9a87

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                            Filesize

                                                            2B

                                                            MD5

                                                            81051bcc2cf1bedf378224b0a93e2877

                                                            SHA1

                                                            ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                            SHA256

                                                            7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                            SHA512

                                                            1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                            Filesize

                                                            54KB

                                                            MD5

                                                            77c613ffadf1f4b2f50d31eeec83af30

                                                            SHA1

                                                            76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                            SHA256

                                                            2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                            SHA512

                                                            29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                            Filesize

                                                            334KB

                                                            MD5

                                                            b3e14504a48bed32c53ec7aab2cb2c8f

                                                            SHA1

                                                            0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                            SHA256

                                                            adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                            SHA512

                                                            e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            Filesize

                                                            72KB

                                                            MD5

                                                            749c51599fbf82422791e0df1c1e841c

                                                            SHA1

                                                            bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                            SHA256

                                                            c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                            SHA512

                                                            f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                            Filesize

                                                            50KB

                                                            MD5

                                                            c0f02eaa3eb28659d8f1bcba8de48479

                                                            SHA1

                                                            5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                            SHA256

                                                            6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                            SHA512

                                                            47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            Filesize

                                                            32KB

                                                            MD5

                                                            f531d3157e9ff57eea92db36c40e283e

                                                            SHA1

                                                            d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                            SHA256

                                                            30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                            SHA512

                                                            27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                            Filesize

                                                            54KB

                                                            MD5

                                                            d11b2139d29e79d795054c3866898b7f

                                                            SHA1

                                                            020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                            SHA256

                                                            11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                            SHA512

                                                            de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                            Filesize

                                                            588KB

                                                            MD5

                                                            17d74c03b6bcbcd88b46fcc58fc79a0d

                                                            SHA1

                                                            bc0316e11c119806907c058d62513eb8ce32288c

                                                            SHA256

                                                            13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                            SHA512

                                                            f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                            Filesize

                                                            215B

                                                            MD5

                                                            2cea4da3bcbf3878c6cbbb69ea11616d

                                                            SHA1

                                                            e96a1e7216d2e93711dc963e72b37d11b2ca522c

                                                            SHA256

                                                            08f6ba6fee0e4cd547413234077c805d359b0c4d45a783d4825d17aecd8d3ae1

                                                            SHA512

                                                            eddd94bdf392abf100731ceb3ac40719af538667dee0f51da3e33c2c3424a08edced9e5ce1d583c4cb369dccfb1e40b0e2a0dfc55ac633540e5e888d3425b921

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            1ef7574bc4d8b6034935d99ad884f15b

                                                            SHA1

                                                            110709ab33f893737f4b0567f9495ac60c37667c

                                                            SHA256

                                                            0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                            SHA512

                                                            947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            f512536173e386121b3ebd22aac41a4e

                                                            SHA1

                                                            74ae133215345beaebb7a95f969f34a40dda922a

                                                            SHA256

                                                            a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                            SHA512

                                                            1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                            Filesize

                                                            76KB

                                                            MD5

                                                            b40fe65431b18a52e6452279b88954af

                                                            SHA1

                                                            c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                            SHA256

                                                            800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                            SHA512

                                                            e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                            Filesize

                                                            80KB

                                                            MD5

                                                            3904d0698962e09da946046020cbcb17

                                                            SHA1

                                                            edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                            SHA256

                                                            a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                            SHA512

                                                            c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                            Filesize

                                                            92KB

                                                            MD5

                                                            d8e28431e3493c83baddb1ccfaee2a8a

                                                            SHA1

                                                            dc9a410a2adb8dadcf3ec13559c63fdd38eae40a

                                                            SHA256

                                                            ddc6c371f85765ab60612d4ce1cc19c114c5e596010469a9ec7506f232bd54ea

                                                            SHA512

                                                            33db8f977c69a52d2fad1be2d521bc3d5e991565d5e350a2dfc4dee1cdad936c3c54d7d3e1df60d4feea91a246e534bbe7be3bc40a7cda89a04fec18bc5e7892

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            433B

                                                            MD5

                                                            cf5f69533151675ab4f248fbc8cdedeb

                                                            SHA1

                                                            eb736e17118ac79e341b49eb29ea04433e65e66f

                                                            SHA256

                                                            e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                            SHA512

                                                            e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            717B

                                                            MD5

                                                            ef0a07aec4367a64c16c581da2657aa9

                                                            SHA1

                                                            13011a5abcbadb3424fb6ecee560665556bb1d24

                                                            SHA256

                                                            f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                            SHA512

                                                            35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            362ce475f5d1e84641bad999c16727a0

                                                            SHA1

                                                            6b613c73acb58d259c6379bd820cca6f785cc812

                                                            SHA256

                                                            1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                            SHA512

                                                            7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                            Filesize

                                                            1.9MB

                                                            MD5

                                                            e0b94ce5d948f332b6bcb4661b73611b

                                                            SHA1

                                                            a9272bd639ff5f25f44b3a31c5cb919f0d40c4d3

                                                            SHA256

                                                            a27b758c00eab6777ac9571ef4fcdb80abaccbc4eb6fa5ff8e5ec33c08ffbc37

                                                            SHA512

                                                            17b5df8ea6ccbb64839e5d223ed388a3bb54c0a7974e05e285361e36489d63f9e4a5f0da21cdf86c58dbe80903e8cb288817291dce4c7e98e8e8ce8a0b912b46

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            9a9b1fd85b5f1dcd568a521399a0d057

                                                            SHA1

                                                            34ed149b290a3a94260d889ba50cb286f1795fa6

                                                            SHA256

                                                            88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                            SHA512

                                                            7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                            Filesize

                                                            375KB

                                                            MD5

                                                            3c93b399b417b0d6a232d386e65a8b46

                                                            SHA1

                                                            bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                            SHA256

                                                            29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                            SHA512

                                                            a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                            Filesize

                                                            321KB

                                                            MD5

                                                            d3901e62166e9c42864fe3062cb4d8d5

                                                            SHA1

                                                            c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                            SHA256

                                                            dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                            SHA512

                                                            ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                            Filesize

                                                            814KB

                                                            MD5

                                                            9b1f97a41bfb95f148868b49460d9d04

                                                            SHA1

                                                            768031d5e877e347a249dfdeab7c725df941324b

                                                            SHA256

                                                            09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                            SHA512

                                                            9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            e74d2a16da1ddb7f9c54f72b8a25897c

                                                            SHA1

                                                            32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                            SHA256

                                                            a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                            SHA512

                                                            52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                            Filesize

                                                            11B

                                                            MD5

                                                            5eda46a55c61b07029e7202f8cf1781c

                                                            SHA1

                                                            862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                            SHA256

                                                            12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                            SHA512

                                                            4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                            Filesize

                                                            12B

                                                            MD5

                                                            5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                            SHA1

                                                            93012724e6cc0a298838aede678806e6c0c6517d

                                                            SHA256

                                                            a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                            SHA512

                                                            890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            b4a865268d5aca5f93bab91d7d83c800

                                                            SHA1

                                                            95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                            SHA256

                                                            5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                            SHA512

                                                            c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            eb021744cc68cb65ef3469779e515950

                                                            SHA1

                                                            c5a7a891fa50001ed68b4d42ed5811f3fd6f4be3

                                                            SHA256

                                                            4e1226766a83aa95930be83951ab1ce2e8a78d69756330bfe26d6b80a3059e90

                                                            SHA512

                                                            07352aead25f5be09795c49b319c0498e1f93b6f7f81a4eb6c97af3f0f8b54137fbf6c3919de044afa514fed782f469cb1bff1f80a67e221f75a430efe2e0b67

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            d7eae8c5cf761b96c68bd497c5a5e01f

                                                            SHA1

                                                            1a59992c8b3c5ef560c26647bd7acf65e00d86be

                                                            SHA256

                                                            0423ef371a492509bc8e449cb802b9a1113bebd6d4fddafb2007a4b69ec3d6c8

                                                            SHA512

                                                            d4b648ca683efb0d59d53dbaa81aa9893cf33bab3ff7c90dfb5ec021e38ed19094a8ba4d7f62c04a69bf19c468096ee76fd6632e5241599bcb033e174e0b26c2

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                            Filesize

                                                            2.8MB

                                                            MD5

                                                            91453d3e1e2bc9586cf5495073fb3cf7

                                                            SHA1

                                                            09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                            SHA256

                                                            5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                            SHA512

                                                            462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            384d6da5c34ff401b18f0af41e3a2643

                                                            SHA1

                                                            3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                            SHA256

                                                            0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                            SHA512

                                                            5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            6c6f85e896655a6eb726482f04c49086

                                                            SHA1

                                                            2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                            SHA256

                                                            e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                            SHA512

                                                            b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                            Filesize

                                                            541B

                                                            MD5

                                                            d0efb0a6d260dbe5d8c91d94b77d7acd

                                                            SHA1

                                                            e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                            SHA256

                                                            7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                            SHA512

                                                            a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                            Filesize

                                                            12B

                                                            MD5

                                                            3d66ae5ed06891e8ce75a39a24070844

                                                            SHA1

                                                            368064119835d4376727a14706c41384446183e8

                                                            SHA256

                                                            73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                            SHA512

                                                            c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                            Filesize

                                                            646KB

                                                            MD5

                                                            7895698867d1ad33934a8553b4806dc5

                                                            SHA1

                                                            32704df55deaff9bf0b4ee0b887541856578938b

                                                            SHA256

                                                            ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                            SHA512

                                                            20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                            Filesize

                                                            3.1MB

                                                            MD5

                                                            85e1898362165fc1315d18abb73c1b37

                                                            SHA1

                                                            289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                            SHA256

                                                            d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                            SHA512

                                                            49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                            Filesize

                                                            569KB

                                                            MD5

                                                            9614d1da18956de06747c03068208d66

                                                            SHA1

                                                            fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                            SHA256

                                                            dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                            SHA512

                                                            d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                            Download Submit

                                                          • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\fd56c16dae29003e0cd7bfc377ac6b74
                                                            Filesize

                                                            16KB

                                                            MD5

                                                            b2e89027a140a89b6e3eb4e504e93d96

                                                            SHA1

                                                            f3b1b34874b73ae3032decb97ef96a53a654228f

                                                            SHA256

                                                            5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                            SHA512

                                                            93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                            Download Submit

                                                          • C:\ProgramData\chocolatey\config\chocolatey.config
                                                            Filesize

                                                            809B

                                                            MD5

                                                            8b6737800745d3b99886d013b3392ac3

                                                            SHA1

                                                            bb94da3f294922d9e8d31879f2d145586a182e19

                                                            SHA256

                                                            86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                            SHA512

                                                            654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                            Download Submit

                                                          • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            4e30ee84fb3f751fd1c0569351009675

                                                            SHA1

                                                            915826fb4fa17edf4ffe8a927caf7f02e1956885

                                                            SHA256

                                                            f5e0fc4368839ab0edbb3d10f4210cc6982c5eea65fb9522fabcf464a62438ed

                                                            SHA512

                                                            c17ef0c6e3c29267ccd058342855217e2746b56496db46be6e1dc4e58841eafec09327270393cdd70f98751c979727215627a655056e0c982e837dd4305d508c

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            Filesize

                                                            471B

                                                            MD5

                                                            646afabf478eda786a8d5e0dee389b34

                                                            SHA1

                                                            eac4daeba634957d051073a55e3b9a7c80991cba

                                                            SHA256

                                                            ccb28545fc0777dc459b1e9c1b1eae508ffd640c399b8b93de03dee6ab1e9903

                                                            SHA512

                                                            5b0770ce768d8aad0e5031bbc73c00a4ebbda78a43a77a20b7a4acc49acdd985e08f3b6bc631b25dde7e45edd81d51acd35a8f03ddd250f67deb8f613708ac94

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            727B

                                                            MD5

                                                            dda7e1956de2ae2d4bd35bc0704a2154

                                                            SHA1

                                                            4cee45a879ef15cc7379292df4ea20275549dc30

                                                            SHA256

                                                            f65b87c1bc3b0930729a647c8078a7c5f6ea0fbc8272ad75740167069ccd6fc7

                                                            SHA512

                                                            49427b506f07c4425fa87e2406048341b07b47ba16ab1eb302684c9436fadc1746ca418a8d021b6bdd2f699906e33929986327643fb59ed5fb287af818d757e0

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            727B

                                                            MD5

                                                            85e4ef53daf9d74a4f483e3575e0182e

                                                            SHA1

                                                            706b05f30e9ca50caa4d2ab06eebde684094f9f8

                                                            SHA256

                                                            a155eddd3fefeb549e9a57df0fe3910f7f66cf43e310dc81fc4a59e2e9529af4

                                                            SHA512

                                                            69e9854a575ce93964777b31caea6167a4291c57482bd342731bb02f04be93450694a75c7ba019ead54f38f25dfb96263111ba33a1db57f77e25cf8ee681f007

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            Filesize

                                                            400B

                                                            MD5

                                                            258eb484dea70290f2ee04a01db70435

                                                            SHA1

                                                            f152a753d1fb4cdccab943636edc0bfc955c8b73

                                                            SHA256

                                                            dc8c75fab80bf4bf288aa4cd69e8feaf87fdd6a5bca6b8267065268174cfaff7

                                                            SHA512

                                                            97cf55205a0c1e7637632ebc15e0cb90efa4b9b06833894adc7650dbad8c2d4d8c66a345308b42dea7b5681978abd6b0696ccef9b627621584f10ec5fcfb352e

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            404B

                                                            MD5

                                                            627652fa89113719e599a3012bb76ee1

                                                            SHA1

                                                            52d68575a4c36fab275fddf5b0612ba3f58371ec

                                                            SHA256

                                                            ff52dff39af74fda602f3c6de9bcca7ab524681846e7ceb22d1cd3c29acb76a8

                                                            SHA512

                                                            ff35354ffa30b2f8ea189a052ae0d7af041f8040b32e77a5b2cebb1b65115b551255fe884e2df4ef6076a618561bf053b46f13635f4ae4e4977abe4bb50647a5

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            412B

                                                            MD5

                                                            dc20a4d5f9cc5ee960e998c9b4255124

                                                            SHA1

                                                            404fee55e056d8e2cd993f9a5b7b9e9e027553b4

                                                            SHA256

                                                            7017cf7116b3c07cc3cf09978ce65cba1a93cf8b18dc58f064ac37c459b49e6c

                                                            SHA512

                                                            eaaf3b81dca64ab221f2376b676c5eca5843a27a1b87a7dfebf007126260a2b92a30283dce1ba9c635e1ced01e95f6519ab369d6d1d19242fa29ee95868986ea

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                            Filesize

                                                            651B

                                                            MD5

                                                            9bbfe11735bac43a2ed1be18d0655fe2

                                                            SHA1

                                                            61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                            SHA256

                                                            549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                            SHA512

                                                            a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                            Download Submit

                                                          • C:\Windows\Installer\MSI339C.tmp
                                                            Filesize

                                                            4.5MB

                                                            MD5

                                                            2207f96731ce2f9d9327c0baaf4959ef

                                                            SHA1

                                                            f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                            SHA256

                                                            e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                            SHA512

                                                            7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                            Download Submit

                                                          • C:\Windows\Installer\MSI826C.tmp-\System.Management.dll
                                                            Filesize

                                                            60KB

                                                            MD5

                                                            878e361c41c05c0519bfc72c7d6e141c

                                                            SHA1

                                                            432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                            SHA256

                                                            24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                            SHA512

                                                            59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC69C.tmp
                                                            Filesize

                                                            509KB

                                                            MD5

                                                            88d29734f37bdcffd202eafcdd082f9d

                                                            SHA1

                                                            823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                            SHA256

                                                            87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                            SHA512

                                                            1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC69C.tmp-\AlphaControlAgentInstallation.dll
                                                            Filesize

                                                            25KB

                                                            MD5

                                                            aa1b9c5c685173fad2dabebeb3171f01

                                                            SHA1

                                                            ed756b1760e563ce888276ff248c734b7dd851fb

                                                            SHA256

                                                            e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                            SHA512

                                                            d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC69C.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            1a5caea6734fdd07caa514c3f3fb75da

                                                            SHA1

                                                            f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                            SHA256

                                                            cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                            SHA512

                                                            a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC94C.tmp-\CustomAction.config
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            bc17e956cde8dd5425f2b2a68ed919f8

                                                            SHA1

                                                            5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                            SHA256

                                                            e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                            SHA512

                                                            02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIC94C.tmp-\Newtonsoft.Json.dll
                                                            Filesize

                                                            695KB

                                                            MD5

                                                            715a1fbee4665e99e859eda667fe8034

                                                            SHA1

                                                            e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                            SHA256

                                                            c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                            SHA512

                                                            bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                            Download Submit

                                                          • C:\Windows\Installer\MSICFE7.tmp
                                                            Filesize

                                                            211KB

                                                            MD5

                                                            a3ae5d86ecf38db9427359ea37a5f646

                                                            SHA1

                                                            eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                            SHA256

                                                            c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                            SHA512

                                                            96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                            Download Submit

                                                          • C:\Windows\Installer\e57c5ff.msi
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            16a2d0c6e475bc422bf93644bef37e3a

                                                            SHA1

                                                            f81d7cebf47a0df8e55501ef8edb2ff9fbf8c78d

                                                            SHA256

                                                            99943cbf5119b45787f6d349e0c8f65768360253e00451b9050923bfe4618e06

                                                            SHA512

                                                            77fd886d244569e7074b87c48666e1b568fee6b8cde708f81b7b99e60744d7abe35bfaf46540a42f9cdc86d65cc84ae089d55567c702e608c0de7dbed628f79f

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{0e2abd6a-6d83-6543-ac78-0e8189c68bdb}\lci_iddcx.cat
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            62458e58313475c9a3642a392363e359

                                                            SHA1

                                                            e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                            SHA256

                                                            85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                            SHA512

                                                            49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{0e2abd6a-6d83-6543-ac78-0e8189c68bdb}\lci_iddcx.inf
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            1cec22ca85e1b5a8615774fca59a420b

                                                            SHA1

                                                            049a651751ef38321a1088af6a47c4380f9293fc

                                                            SHA256

                                                            60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                            SHA512

                                                            0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{0e2abd6a-6d83-6543-ac78-0e8189c68bdb}\x64\lci_iddcx.dll
                                                            Filesize

                                                            52KB

                                                            MD5

                                                            01e8bc64139d6b74467330b11331858d

                                                            SHA1

                                                            b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                            SHA256

                                                            148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                            SHA512

                                                            4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{8e027c73-c36a-4a4c-82e3-3d08bc74c8f7}\lci_proxywddm.cat
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            8e16d54f986dbe98812fd5ec04d434e8

                                                            SHA1

                                                            8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                            SHA256

                                                            7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                            SHA512

                                                            e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{8e027c73-c36a-4a4c-82e3-3d08bc74c8f7}\lci_proxywddm.inf
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            0315a579f5afe989154cb7c6a6376b05

                                                            SHA1

                                                            e352ff670358cf71e0194918dfe47981e9ccbb88

                                                            SHA256

                                                            d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                            SHA512

                                                            c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{8e027c73-c36a-4a4c-82e3-3d08bc74c8f7}\x64\lci_proxyumd.dll
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            4dc11547a5fc28ca8f6965fa21573481

                                                            SHA1

                                                            d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                            SHA256

                                                            e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                            SHA512

                                                            bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{8e027c73-c36a-4a4c-82e3-3d08bc74c8f7}\x64\lci_proxyumd32.dll
                                                            Filesize

                                                            135KB

                                                            MD5

                                                            67ae7b2c36c9c70086b9d41b4515b0a8

                                                            SHA1

                                                            ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                            SHA256

                                                            79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                            SHA512

                                                            4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{8e027c73-c36a-4a4c-82e3-3d08bc74c8f7}\x64\lci_proxywddm.sys
                                                            Filesize

                                                            119KB

                                                            MD5

                                                            b9b0e9b4d93b18b99ece31a819d71d00

                                                            SHA1

                                                            2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                            SHA256

                                                            0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                            SHA512

                                                            465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                            Download Submit

                                                          • C:\Windows\System32\InstallUtil.InstallLog
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            bbe625903f24392c2a25bedce9fabd66

                                                            SHA1

                                                            5980c02f4570b749bcc0bed56ee9ff0dde1b1ec2

                                                            SHA256

                                                            fac60b5633a0094427f5c5916611912330def57e1418040216be71ee928d69bc

                                                            SHA512

                                                            480f79d8dfe1555431e2579b8b8fdbdbe5e0f064c316dc5caba50976436850ba6d2b413477096e97f0c5c76a21a6e38eefbf46b6e8e2f08ffe875fa3279062c6

                                                            Download Submit

                                                          • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-01-01-47.dat
                                                            Filesize

                                                            602B

                                                            MD5

                                                            c9be1c78c54cf550d5a2d07e6a25244f

                                                            SHA1

                                                            b67053068bb4dda32df38a3f2efebfd8e709af96

                                                            SHA256

                                                            17373b116e5ec1351c781f8f615f9978e5365ea087a645517e5add94853b5c10

                                                            SHA512

                                                            b907ac5e3bcd1b407f69026f43ae906f461f7ca34556ad74574d44fe0fe6e8e7ccd380a09f1054caf058def7ecd87a7d9b631d3c42458139b5313333c664fa94

                                                            Download Submit

                                                          • C:\Windows\Temp\InstallUtil.log
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            28b8a284e1bae0fd0e15910147d46409

                                                            SHA1

                                                            261386eb2e3c21f983430ee33bc9eafb021f67d1

                                                            SHA256

                                                            cb7b9ac8cddcf6e0f685ae93f9aba9a8661f26486711a281a6fe9460c6aab83c

                                                            SHA512

                                                            08399ad8d3ffb6004570dde67eaf5ea03e9813afecaf8ee2b966f51883fc5ac4df85acec293e8214fc8f8903b00394db15ad4efefce8dbc3bbfc441273336eb8

                                                            Download Submit

                                                          • C:\Windows\Temp\PreVer.log
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            7d9a1d0a9d48d015e829eef9ec80e024

                                                            SHA1

                                                            1367307f9014509fb37c8f0d6e8f8c20d51584e2

                                                            SHA256

                                                            36f87f2a1eea7ee3c100e40523735c7f7366edf50f89ee6268789a2e69aee422

                                                            SHA512

                                                            ecb7403901bdfbbe479754904883301307856fc2f6ee1bdda227c7dd8797d10ab2c4fbd9c9a5b2c055b1f60fb2cdeb40735b8141575c4b06e92b61d854752673

                                                            Download Submit

                                                          • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                            Filesize

                                                            3.2MB

                                                            MD5

                                                            a7ce785b6cd1c9657040ca9b6cbeed10

                                                            SHA1

                                                            4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                            SHA256

                                                            7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                            SHA512

                                                            39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                            Download Submit

                                                          • C:\Windows\Temp\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\IsConfig.ini
                                                            Filesize

                                                            571B

                                                            MD5

                                                            38370175ce7d8dd5c3581030a9104259

                                                            SHA1

                                                            bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                            SHA256

                                                            ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                            SHA512

                                                            e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                            Download Submit

                                                          • C:\Windows\Temp\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\String1033.txt
                                                            Filesize

                                                            182KB

                                                            MD5

                                                            37a2c4ef0ff41955f1cb884b7790699f

                                                            SHA1

                                                            8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                            SHA256

                                                            6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                            SHA512

                                                            fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                            Download Submit

                                                          • C:\Windows\Temp\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\_is294E.exe
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            7a1c100df8065815dc34c05abc0c13de

                                                            SHA1

                                                            3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                            SHA256

                                                            e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                            SHA512

                                                            bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                            Download Submit

                                                          • C:\Windows\Temp\{4EF8BD82-DB0C-4303-93A1-F0DC422629B1}\setup.inx
                                                            Filesize

                                                            345KB

                                                            MD5

                                                            0376dd5b7e37985ea50e693dc212094c

                                                            SHA1

                                                            02859394164c33924907b85ab0aaddc628c31bf1

                                                            SHA256

                                                            c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                            SHA512

                                                            69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                            Download Submit

                                                          • C:\Windows\Temp\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\ISRT.dll
                                                            Filesize

                                                            427KB

                                                            MD5

                                                            85315ad538fa5af8162f1cd2fce1c99d

                                                            SHA1

                                                            31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                            SHA256

                                                            70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                            SHA512

                                                            877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                            Download Submit

                                                          • C:\Windows\Temp\{9F59DA0A-36DB-4797-AE81-D6977A7590F3}\_isres_0x0409.dll
                                                            Filesize

                                                            1.8MB

                                                            MD5

                                                            befe2ef369d12f83c72c5f2f7069dd87

                                                            SHA1

                                                            b89c7f6da1241ed98015dc347e70322832bcbe50

                                                            SHA256

                                                            9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                            SHA512

                                                            760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                            Download Submit

                                                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            404B

                                                            MD5

                                                            59e1d8d90e9ea0b4b577365c487cfd4e

                                                            SHA1

                                                            6f0e327c8830f2c74014a9a7c2de8f7e15f7716a

                                                            SHA256

                                                            65037abee38da15517168fdc2a5bf6851f251e2461e60e57fb18c2754b94be31

                                                            SHA512

                                                            53a3b29353219a2febf88907d33ae2f77d8c03cc60f16b841b00702ddc2534535fc1559776dd00b37efaf420e0f8d7a397e987f9c1059dc971e9beef41771258

                                                            Download Submit

                                                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            412B

                                                            MD5

                                                            bf0ffedf08be9304f04c6a83c41bbb14

                                                            SHA1

                                                            5046248acaef569719f3346d2d1bb6b3dfb0aed9

                                                            SHA256

                                                            2c356fa95356f5796bfb9d0941bac1aea98bcc575118824cfc24f47421f3341d

                                                            SHA512

                                                            68579b35f8c1bf328540cc05f30d92e27383cc0c44dbd7af6d324407e751629411215381299a3dfb3c3b534b121c05b727bb9378c0840f4f03938e3d80b7fac0

                                                            Download Submit

                                                          • \??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d0a1ab4f-1f45-4f30-8533-48918fca3d45}_OnDiskSnapshotProp
                                                            Filesize

                                                            6KB

                                                            MD5

                                                            10f8005a092e852ed15c71ca09220748

                                                            SHA1

                                                            5eab043930a2fdab654b90e4b8977870808414ac

                                                            SHA256

                                                            b22d53a7609cae9caac7aa5d7a660de8ac585a91177222855cb48843ad2940b1

                                                            SHA512

                                                            89efd057a315b59b25f416a3ec7ae3642f57d720e4c9f144c41469145af0c07ec5486dbdc5d3c98a87831c796af9f5623b5c83b742e48d6273c2c18aa6419b35

                                                            Download Submit

                                                          • memory/536-1814-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/536-1179-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/536-2171-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/536-1813-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/536-1587-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/536-1584-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/536-2170-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/536-1178-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/676-110-0x0000000004DF0000-0x0000000004E56000-memory.dmp

                                                            Filesize

                                                            408KB

                                                            Download

                                                          • memory/1380-1507-0x000001D59DB50000-0x000001D59DB5A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/1380-1521-0x000001D59DFE0000-0x000001D59DFFA000-memory.dmp

                                                            Filesize

                                                            104KB

                                                            Download

                                                          • memory/1380-1652-0x000001D5B6DC0000-0x000001D5B6E72000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1380-1784-0x000001D5B73B0000-0x000001D5B78D8000-memory.dmp

                                                            Filesize

                                                            5.2MB

                                                            Download

                                                          • memory/1464-1774-0x0000022E42D40000-0x0000022E42D5C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/1464-1773-0x0000022E42D90000-0x0000022E42DDA000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/1464-1772-0x0000022E29D00000-0x0000022E29D0C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/1836-483-0x0000016952200000-0x0000016952208000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1836-484-0x0000016952220000-0x0000016952228000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1836-485-0x0000016952230000-0x0000016952238000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1836-482-0x000001696ACB0000-0x000001696AD62000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1836-481-0x000001696AD90000-0x000001696AE6C000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/1836-479-0x0000016951D40000-0x0000016951D48000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1836-480-0x0000016951D70000-0x0000016951D7A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/1836-478-0x000001696AA80000-0x000001696AAC8000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/1836-486-0x000001696AE70000-0x000001696AED8000-memory.dmp

                                                            Filesize

                                                            416KB

                                                            Download

                                                          • memory/1836-487-0x000001696AB00000-0x000001696AB2A000-memory.dmp

                                                            Filesize

                                                            168KB

                                                            Download

                                                          • memory/1836-488-0x000001696AF20000-0x000001696AF5A000-memory.dmp

                                                            Filesize

                                                            232KB

                                                            Download

                                                          • memory/1836-489-0x000001696AAD0000-0x000001696AAF6000-memory.dmp

                                                            Filesize

                                                            152KB

                                                            Download

                                                          • memory/2140-344-0x0000022030480000-0x000002203049C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/2140-345-0x0000022048D60000-0x0000022048DAC000-memory.dmp

                                                            Filesize

                                                            304KB

                                                            Download

                                                          • memory/2140-343-0x0000022048CC0000-0x0000022048D0A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/2140-342-0x000002202FBC0000-0x000002202FC24000-memory.dmp

                                                            Filesize

                                                            400KB

                                                            Download

                                                          • memory/2264-277-0x000001EF61C70000-0x000001EF61C8C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/2264-275-0x000001EF7A890000-0x000001EF7A940000-memory.dmp

                                                            Filesize

                                                            704KB

                                                            Download

                                                          • memory/2264-272-0x000001EF616E0000-0x000001EF61710000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/2676-1799-0x000001DAD0740000-0x000001DAD0766000-memory.dmp

                                                            Filesize

                                                            152KB

                                                            Download

                                                          • memory/2880-192-0x0000026C19F70000-0x0000026C1A022000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/2880-196-0x0000026C19F00000-0x0000026C19F22000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/2880-241-0x0000026C1A4C0000-0x0000026C1A4F8000-memory.dmp

                                                            Filesize

                                                            224KB

                                                            Download

                                                          • memory/2932-301-0x000001B9B0620000-0x000001B9B06D2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/2932-300-0x000001B9974A0000-0x000001B9974B6000-memory.dmp

                                                            Filesize

                                                            88KB

                                                            Download

                                                          • memory/2932-302-0x000001B9978A0000-0x000001B9978BC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/3436-160-0x00000237C32C0000-0x00000237C3358000-memory.dmp

                                                            Filesize

                                                            608KB

                                                            Download

                                                          • memory/3436-165-0x00000237AA9A0000-0x00000237AA9DC000-memory.dmp

                                                            Filesize

                                                            240KB

                                                            Download

                                                          • memory/3436-148-0x00000237A8D80000-0x00000237A8DA8000-memory.dmp

                                                            Filesize

                                                            160KB

                                                            Download

                                                          • memory/3436-164-0x00000237A9180000-0x00000237A9192000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/3832-80-0x0000000005650000-0x00000000059A4000-memory.dmp

                                                            Filesize

                                                            3.3MB

                                                            Download

                                                          • memory/3832-79-0x0000000005450000-0x0000000005472000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/3832-76-0x0000000005590000-0x0000000005642000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4340-43-0x0000000004FE0000-0x0000000004FEC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/4340-39-0x0000000004FA0000-0x0000000004FCE000-memory.dmp

                                                            Filesize

                                                            184KB

                                                            Download

                                                          • memory/4684-1475-0x0000020671660000-0x0000020671712000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4684-1469-0x0000020670D60000-0x0000020670D7C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/4684-1460-0x0000020670510000-0x0000020670522000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/4684-1775-0x0000020670E10000-0x0000020670E64000-memory.dmp

                                                            Filesize

                                                            336KB

                                                            Download

                                                          • memory/4768-3252-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4768-2448-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4768-2447-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4768-1184-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4768-1185-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4768-3253-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4772-1780-0x00000175ED310000-0x00000175ED32C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/4772-1777-0x00000175EDBF0000-0x00000175EDCA2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4772-1785-0x00000175EDB80000-0x00000175EDBC8000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/4772-1497-0x00000175ECA00000-0x00000175ECA3A000-memory.dmp

                                                            Filesize

                                                            232KB

                                                            Download

                                                          • memory/4892-941-0x00000000036C0000-0x0000000003887000-memory.dmp

                                                            Filesize

                                                            1.8MB

                                                            Download

                                                          • memory/4892-938-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4892-1081-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4892-1045-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4892-550-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4892-435-0x0000000003680000-0x0000000003847000-memory.dmp

                                                            Filesize

                                                            1.8MB

                                                            Download

                                                          • memory/4892-432-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4892-1118-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4896-1186-0x00000000735E0000-0x00000000736FC000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4896-1200-0x0000000073210000-0x00000000735DD000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/5340-1770-0x000001C11E280000-0x000001C11E298000-memory.dmp

                                                            Filesize

                                                            96KB

                                                            Download

                                                          • memory/5340-1769-0x000001C11D900000-0x000001C11D90C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/5340-1781-0x000001C11E2A0000-0x000001C11E2C0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/5340-1771-0x000001C136AD0000-0x000001C136B82000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5592-1681-0x00000174A1D90000-0x00000174A1E42000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5592-1738-0x00000174A1CE0000-0x00000174A1D46000-memory.dmp

                                                            Filesize

                                                            408KB

                                                            Download

                                                          • memory/5592-1746-0x00000174A1C70000-0x00000174A1C84000-memory.dmp

                                                            Filesize

                                                            80KB

                                                            Download

                                                          • memory/5592-1611-0x00000174A13F0000-0x00000174A1400000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/5592-1648-0x00000174A1890000-0x00000174A18B0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/5872-1796-0x0000011AA8DE0000-0x0000011AA8E2A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5872-1793-0x0000011AA8550000-0x0000011AA8562000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/5872-1800-0x0000011AA8940000-0x0000011AA895C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5956-1655-0x0000021257890000-0x00000212578AC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5956-1654-0x0000021270100000-0x000002127014A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5956-1653-0x0000021257020000-0x0000021257054000-memory.dmp

                                                            Filesize

                                                            208KB

                                                            Download

                                                          • memory/5956-1656-0x0000021257A00000-0x0000021257A18000-memory.dmp

                                                            Filesize

                                                            96KB

                                                            Download

                                                          • memory/5956-1804-0x00000212704B0000-0x0000021270512000-memory.dmp

                                                            Filesize

                                                            392KB

                                                            Download

                                                          • memory/5956-1794-0x00000212703F0000-0x00000212704A2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5956-1677-0x00000212702E0000-0x000002127032A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5956-1657-0x00000212578B0000-0x00000212578BA000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/5956-1805-0x0000021270350000-0x000002127036C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5956-1801-0x0000021270590000-0x000002127066C000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/5980-1779-0x000002A12E5E0000-0x000002A12E6BC000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/5980-1768-0x000002A115A60000-0x000002A115A7C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5980-1795-0x000002A12E6C0000-0x000002A12E772000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5980-1802-0x000002A115A80000-0x000002A115A88000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/5980-1728-0x000002A115A90000-0x000002A115ADA000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5980-1688-0x000002A115220000-0x000002A115230000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/6024-1778-0x000001BA559B0000-0x000001BA559C0000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/6024-1776-0x000001BA55520000-0x000001BA55530000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/6024-1786-0x000001BA6E6C0000-0x000001BA6E772000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/6024-1797-0x000001BA55D80000-0x000001BA55DA0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download