Overview

overview

10

Static

static

10

laudovisit...df.msi

windows7-x64

10

laudovisit...df.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    laudovisitabombeirosPdf.msi

  • Size

    2.9MB

  • MD5

    1237a9140ac0333e8f4dff131a18635e

  • SHA1

    ad0621265080d50c2e6f56d6a87a53a448d8d8dd

  • SHA256

    160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4

  • SHA512

    9c5f8621941eac95a00bc2aa8e23ec372a63994b61f287d90777a90c22c9557481fd5bfbb5cb621d2da9a11ae5b623dd73d27dc792842731a5d8f2ba03666742

  • SSDEEP

    49152:F+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:F+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\laudovisitabombeirosPdf.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4036
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1560
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3A9B90BB2D723BFBEC98BA61B380648A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIBBBE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631046 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4288
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIBFB7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631734 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIC5C3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633312 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3388
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSID299.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636578 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3976
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AFA8D5291DAF5E1A8062FB0DBF275E49 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2168
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3148
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000M0aRpIAJ" /AgentId="7014b6e9-b88c-43e1-a545-f5529593dd81"
      2⤵
      • Network Service Discovery
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:656
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F4E50D682364739725EDE6D2BEB324A7 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95D2FA6B-7136-46C3-8E12-D76EB1D358D9}
        3⤵
        • Executes dropped EXE
        PID:3116
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C70AEBC1-8515-40E0-B544-BE13D7CDB502}
        3⤵
        • Executes dropped EXE
        PID:4108
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A1A6B53-3E00-4FA6-AD30-22064C35E345}
        3⤵
        • Executes dropped EXE
        PID:4068
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1FB891D1-6D98-446F-8407-CCFE9359501F}
        3⤵
        • Executes dropped EXE
        PID:5032
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5EBCB237-CCAB-4243-A25C-8C68C16CE948}
        3⤵
        • Executes dropped EXE
        PID:4840
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0833CA4C-2BCF-4A0C-B32E-31A4C562B784}
        3⤵
        • Executes dropped EXE
        PID:116
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B813D3C3-F4BE-47AD-8534-4C37DC13928D}
        3⤵
        • Executes dropped EXE
        PID:2244
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0CBDEBC9-4952-46F2-97B6-4E602CF206CD}
        3⤵
        • Executes dropped EXE
        PID:1344
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C14EDB53-D19F-4CEB-A395-B6B8D03B88E1}
        3⤵
        • Executes dropped EXE
        PID:1172
      • C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe
        C:\Windows\TEMP\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isD59.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D559A2F-A825-4AE9-8FA4-D7EE9E09FCE5}
        3⤵
        • Executes dropped EXE
        PID:1128
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3220
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3376
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1944
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4004
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3108
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3004
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3768
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3664
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3584
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3748
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4716
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4456
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1172
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3412
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:720
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3340
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4812
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1128
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:556
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A0D7AFA-44AB-4B5E-9479-426CB052CBF5}
        3⤵
        • Executes dropped EXE
        PID:3272
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{20273E3D-974D-405A-9C86-343BCDC110BB}
        3⤵
        • Executes dropped EXE
        PID:2504
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F8C805C1-E659-40B2-A0DE-F031ED720AE9}
        3⤵
        • Executes dropped EXE
        PID:3240
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8A04A890-27E5-4FE7-8BC7-1807A9EF4D37}
        3⤵
        • Executes dropped EXE
        PID:2244
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4A74B6B3-D9FC-4922-A94D-7E22BF8CD4CC}
        3⤵
        • Executes dropped EXE
        PID:4072
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{906E9ABC-0764-4EE8-B8FE-647680BE9823}
        3⤵
        • Executes dropped EXE
        PID:4168
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BD17B98D-735C-4127-8299-5704CCCEA341}
        3⤵
        • Executes dropped EXE
        PID:3592
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD3605A1-FC95-49BD-B9EA-510449828504}
        3⤵
        • Executes dropped EXE
        PID:3924
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DECE2AFE-1EC7-4278-BB02-66AF20D27D90}
        3⤵
        • Executes dropped EXE
        PID:3032
      • C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
        C:\Windows\TEMP\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FB532BD-C507-43C0-97B6-B84D0389308D}
        3⤵
        • Executes dropped EXE
        PID:4228
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C74D1762-1671-4E1E-9ABB-66D782A8EAAB}
        3⤵
        • Executes dropped EXE
        PID:3272
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DFD30A52-F692-47C8-B47F-30AD458E4E7E}
        3⤵
        • Executes dropped EXE
        PID:3892
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{027E894E-40D7-4537-A9FB-477AA2656176}
        3⤵
        • Executes dropped EXE
        PID:4716
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40186676-B946-4F0B-984C-AE6C66648FBC}
        3⤵
        • Executes dropped EXE
        PID:5032
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4B37C960-EDC8-4E6B-9BAF-7AC744DA0886}
        3⤵
        • Executes dropped EXE
        PID:4000
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D96219D-0F47-4928-B5A1-1EC7CD8E17B8}
        3⤵
        • Executes dropped EXE
        PID:3696
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C5A6C85-C025-42D0-B441-6E6940732AFB}
        3⤵
        • Executes dropped EXE
        PID:4072
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58092928-BC48-4B27-BFE2-D4AF4A8B2090}
        3⤵
        • Executes dropped EXE
        PID:3664
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{695BB3F5-3DD0-4636-881C-FC0AED95B7AE}
        3⤵
        • Executes dropped EXE
        PID:3496
      • C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe
        C:\Windows\TEMP\{A0C5CE0C-4C42-4FA5-84B6-01FBB806009D}\_is274C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FAE22B19-9A0B-4C76-B03D-4A3ABBCFF59B}
        3⤵
        • Executes dropped EXE
        PID:3560
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4000
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3488
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:1796
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:3436
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4228
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3724
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2312934A-CC32-4E09-B6AC-C899AC803F6B}
            3⤵
            • Executes dropped EXE
            PID:1188
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40DE0913-C413-4C03-808F-90C368A19F53}
            3⤵
            • Executes dropped EXE
            PID:3496
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AD55903D-6318-4814-A823-12524DA37AE2}
            3⤵
            • Executes dropped EXE
            PID:4376
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{555F57C0-5B9F-4124-B682-59994EB15F40}
            3⤵
            • Executes dropped EXE
            PID:3044
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2056EC4C-F5DC-4855-AC21-DDB7E12B3E07}
            3⤵
            • Executes dropped EXE
            PID:3248
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CCB8BD6B-EC24-4329-B7EC-ACCE3DBFB3D1}
            3⤵
            • Executes dropped EXE
            PID:3068
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F2168974-B80D-4229-B29C-4C04394FCB86}
            3⤵
            • Executes dropped EXE
            PID:4672
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9B187D7D-C380-4C00-AEA2-F937AD8C06FD}
            3⤵
            • Executes dropped EXE
            PID:4932
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEFEF572-3BEB-4EBF-B966-9D4630C612B0}
            3⤵
            • Executes dropped EXE
            PID:4984
          • C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe
            C:\Windows\TEMP\{89C7884D-7F6D-444A-A0B8-276E80F5E9F6}\_is395F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA06839C-76E9-4C68-B7C6-BD9B0214820F}
            3⤵
            • Executes dropped EXE
            PID:316
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4376
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6959E924-C9A4-4AE3-88EC-A750E5E2A73B}
            3⤵
            • Executes dropped EXE
            PID:3380
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6849235B-A20B-48B1-B234-079F531F37A2}
            3⤵
            • Executes dropped EXE
            PID:3464
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{823B16B0-AD69-49FC-BC76-18840057626A}
            3⤵
            • Executes dropped EXE
            PID:1012
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C04E06CF-2D2F-4697-828B-BCDB828FA338}
            3⤵
            • Executes dropped EXE
            PID:4620
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13D00E87-B5CF-4FCA-9788-EE34D2009DFF}
            3⤵
            • Executes dropped EXE
            PID:2564
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D2C81DD5-4A01-443B-AA14-8E8FC9C78548}
            3⤵
            • Executes dropped EXE
            PID:4780
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18BBA144-CCA7-4812-AF7D-7731E9C784DA}
            3⤵
            • Executes dropped EXE
            PID:1964
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5F356064-8FEA-45AC-B86F-F5A8ECFB5E5F}
            3⤵
            • Executes dropped EXE
            PID:4940
          • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
            C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2DBAAF91-5F37-4751-885B-48007FCE683D}
            3⤵
              PID:2504
            • C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe
              C:\Windows\TEMP\{5527986D-B3B6-4D80-B7C7-F220696A015F}\_is3C8C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{757526A4-ED76-41B6-A1DF-8EAE761D7AEC}
              3⤵
                PID:3272
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1624
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  4⤵
                    PID:4620
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding A308C968DD2BEEE2B62CD106A39582B4 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5948
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI7B86.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680062 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5952
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI7D1E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680218 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5836
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI7F13.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680703 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5168
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4340
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:6040
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5968
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:6120
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5544
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5796
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIA0BD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240689328 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5232
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                • Drops file in Program Files directory
                PID:1992
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="dc380fc8-56ca-492b-8c17-6654381a00a6"
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5340
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:4964
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4388
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:1972
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "6b7110b5-0cc9-41f9-892e-5af44d183814" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
                2⤵
                • Executes dropped EXE
                PID:2140
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "75209101-ed43-4b0c-b3c3-2352c8e41da9" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
                2⤵
                • Executes dropped EXE
                PID:4744
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "fa8fc6fb-50de-485a-aa61-bd10c6d49853" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000M0aRpIAJ
                2⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3496
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2304
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:4488
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "b369b49f-b441-4a6b-ad2d-0769359c2182" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000M0aRpIAJ
                2⤵
                • Executes dropped EXE
                PID:3388
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "2ca9120f-e9b0-4f80-ba7c-6d68e3fb2447" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000M0aRpIAJ
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2616
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2828
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2560
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4920
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "2137cdb4-5a27-4b45-937c-e3c9cac853a4" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000M0aRpIAJ
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:656
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:4056
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:2516
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "c09b8142-8ee5-4fdc-aff5-84f9d2400c0e" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                2⤵
                • Drops file in Program Files directory
                PID:3116
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:1192
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:4584
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "475d03b6-fdf8-44a1-a3fb-0e2ba717a94a" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                  2⤵
                    PID:3440
                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=77b58d7a119b318a33e08ea25d546a21&rmm_session_pwd_ttl=86400"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:6008
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "7bb1a107-093a-42d9-815f-d807ce681e8c" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                    2⤵
                    • Drops file in System32 directory
                    PID:1840
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                      3⤵
                      • Modifies data under HKEY_USERS
                      PID:5684
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "ca33c653-7b00-4cf9-b476-6a48836fe793" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                    2⤵
                    • Drops file in System32 directory
                    PID:5404
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "6dd70f08-008b-4fbe-bfaf-12ee07a3b326" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                    2⤵
                      PID:5556
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "556d6324-45e5-4a2d-9df5-c6db89e82373" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      PID:5912
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "03138739-062a-4936-b02f-3d3f8579535d" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      PID:5988
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "48e73def-09eb-4aa9-8052-fbef6042df11" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      PID:6020
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "d251f5c1-6e3f-4d17-ad63-46918ccc55fa" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:6128
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "987d7512-ff73-4ddf-979b-5c1c76248fe0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      PID:5160
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "3c91f1b0-fcb2-41fd-9c09-4b50ab59c101" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      • Modifies data under HKEY_USERS
                      PID:5612
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "e2a6a426-e07f-48b5-8a1e-9c061a9b0ccb" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in Program Files directory
                      PID:5652
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "c01a3266-fa8d-4970-9b18-5aecf14b36f5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                      2⤵
                        PID:5752
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                          3⤵
                          • System Time Discovery
                          PID:5368
                          • C:\Program Files\dotnet\dotnet.exe
                            dotnet --list-runtimes
                            4⤵
                            • System Time Discovery
                            PID:5424
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "974a77b3-1049-4247-bcc5-2ccb0100fcf8" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                        2⤵
                          PID:5924
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                        1⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3776
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4912
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                            -h -t
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            PID:1092
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1760
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                              4⤵
                                PID:1960
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:3028
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4024
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                SRUtility.exe -r
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:4576
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:3532
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                4⤵
                                  PID:5592
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ver
                                    5⤵
                                      PID:5368
                                    • C:\Windows\system32\sc.exe
                                      sc query ddmgr
                                      5⤵
                                      • Launches sc.exe
                                      PID:1108
                                    • C:\Windows\system32\sc.exe
                                      sc query lci_proxykmd
                                      5⤵
                                      • Launches sc.exe
                                      PID:5156
                                    • C:\Windows\system32\rundll32.exe
                                      rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                      5⤵
                                      • Drops file in System32 directory
                                      • Checks SCSI registry key(s)
                                      • Modifies data under HKEY_USERS
                                      PID:5548
                            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                              1⤵
                              • Drops file in Program Files directory
                              • Modifies data under HKEY_USERS
                              PID:5980
                              • C:\Windows\System32\sc.exe
                                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                2⤵
                                • Launches sc.exe
                                PID:2116
                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "d0a3524f-022c-42f3-8980-f2a81e5ce98b" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                                2⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:4584
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  3⤵
                                    PID:4592
                                    • C:\Windows\system32\cscript.exe
                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      4⤵
                                      • Modifies data under HKEY_USERS
                                      PID:2220
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "6b29ec0b-2f0f-4b0c-8455-9ea9f5a1e29a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                                  2⤵
                                    PID:5192
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "aafce1cd-2552-4c90-a854-1b6a266ace6b" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                    2⤵
                                      PID:832
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "abeda3d7-e77d-43b9-9f6d-f30b1c45e721" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                                      2⤵
                                        PID:5788
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "53fae776-a861-4113-8488-e97734ed1bf5" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                                        2⤵
                                          PID:3688
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "5422d445-31da-4a50-8f89-b801928dd043" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                                          2⤵
                                            PID:656
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "e700a0bc-50aa-4c3a-9524-e629c67352e6" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                                            2⤵
                                              PID:1200
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                3⤵
                                                • System Time Discovery
                                                PID:5952
                                                • C:\Program Files\dotnet\dotnet.exe
                                                  dotnet --list-runtimes
                                                  4⤵
                                                  • System Time Discovery
                                                  PID:4568
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "ce071275-e760-4e13-ad69-7161371b9ae8" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                                              2⤵
                                                PID:5776
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "7559e82f-294d-4928-96e3-21d32ec48c3e" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                                                2⤵
                                                  PID:4824
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "56ed5a0b-a2a2-4d3c-93f5-d2f6bbc48906" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                                                  2⤵
                                                  • Writes to the Master Boot Record (MBR)
                                                  PID:1548
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "c4dd4396-4650-411e-8994-d205223f4396" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                                                  2⤵
                                                    PID:5864
                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=77b58d7a119b318a33e08ea25d546a21&rmm_session_pwd_ttl=86400"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5176
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "145d1b89-455b-47aa-82d8-4c8676a2a562" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                                                    2⤵
                                                    • Drops file in Program Files directory
                                                    PID:5344
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "cff0f2ba-d75a-43ff-81a6-281571d5791c" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                                                    2⤵
                                                    • Modifies registry class
                                                    PID:552
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "05ef347c-3bdd-4598-843f-55e8b0f57149" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                                                    2⤵
                                                      PID:5312
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "7014b6e9-b88c-43e1-a545-f5529593dd81" "05ef347c-3bdd-4598-843f-55e8b0f57149" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000M0aRpIAJ"
                                                        3⤵
                                                          PID:5544
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 7014b6e9-b88c-43e1-a545-f5529593dd81 "aafce1cd-2552-4c90-a854-1b6a266ace6b" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                                        2⤵
                                                          PID:5140
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                        1⤵
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:5336
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:5524
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "00000000000000F8" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          • Modifies data under HKEY_USERS
                                                          PID:6060
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "00000000000000F8"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:4524
                                                        • C:\Windows\system32\DrvInst.exe
                                                          DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                          2⤵
                                                          • Drops file in Drivers directory
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:5260

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Event Triggered Execution

                                                      2
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Installer Packages

                                                      1
                                                      T1546.016

                                                      Pre-OS Boot

                                                      1
                                                      T1542

                                                      Bootkit

                                                      1
                                                      T1542.003

                                                      Privilege Escalation

                                                      Event Triggered Execution

                                                      2
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Installer Packages

                                                      1
                                                      T1546.016

                                                      Defense Evasion

                                                      Modify Registry

                                                      1
                                                      T1112

                                                      Pre-OS Boot

                                                      1
                                                      T1542

                                                      Bootkit

                                                      1
                                                      T1542.003

                                                      Subvert Trust Controls

                                                      1
                                                      T1553

                                                      Install Root Certificate

                                                      1
                                                      T1553.004

                                                      System Binary Proxy Execution

                                                      1
                                                      T1218

                                                      Msiexec

                                                      1
                                                      T1218.007

                                                      Credential Access

                                                      Discovery

                                                      Network Service Discovery

                                                      1
                                                      T1046

                                                      Peripheral Device Discovery

                                                      2
                                                      T1120

                                                      Query Registry

                                                      4
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Time Discovery

                                                      1
                                                      T1124

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Config.Msi\e57bb04.rbs
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        72e8dc1d39bf604a6269a3568cc09212

                                                        SHA1

                                                        a9bb3b8fed9c426399f44bd95ea4895794ecde05

                                                        SHA256

                                                        452a4268045ccecafa6a352e5206620f9d7f08766cd4a6c54a112cc7c2671463

                                                        SHA512

                                                        f698707bddd37074c5085037e601d71f3f2e3a92d39b412b630b84a3584bd68cd12bec98d0a14dc7e070cc7db029f15d161537885fb4781c7f1a1bdee30eb972

                                                        Download Submit

                                                      • C:\Config.Msi\e57bb09.rbs
                                                        Filesize

                                                        74KB

                                                        MD5

                                                        f1d1878c861c72019875778b4d6e2698

                                                        SHA1

                                                        aa76c5ff2a2da7a63d9b0b6cd24efac6788aa1b5

                                                        SHA256

                                                        4b27ad266ae1cb728389fb6d833438962dfc53f4da1f4dedcc50376767f1e9b5

                                                        SHA512

                                                        d7279d4d0bfcb71fba5ec955d82b5a461a0fe652e0dda6dfeb08aec2b4066b0b29d14004720ae788582bbf5808a868dd8d7b8d5a3ccb3b73b9f01d37c7e18c00

                                                        Download Submit

                                                      • C:\Config.Msi\e57bb0b.rbs
                                                        Filesize

                                                        464B

                                                        MD5

                                                        9b0e3b905c1e190d169e551fe6bbe57f

                                                        SHA1

                                                        47afc4158f1e4b3c5dd674b4f657233e9019b843

                                                        SHA256

                                                        668fb6e2e85954d3dac32671507bdcab58126d6360bb7444a5668f72d6c6ca8e

                                                        SHA512

                                                        ac26fa16cbd37b627295f6dca1204a9eba983ec0659c90f2505c31369eb7ba4539c886e2a0db18dbf1622b00872d288d914f6f0fbdb572a94c2fe7b2d9ac8c12

                                                        Download Submit

                                                      • C:\Config.Msi\e57bb11.rbs
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        49248aea21b36dd8ac5e9cec2ca842a9

                                                        SHA1

                                                        b1ca740ffda3f6fb6eeea007dbced96603b98c7c

                                                        SHA256

                                                        a2e80a7a330243a9f405a659d6ddc60cff5571afd05f10d5313c1c4dcece04fe

                                                        SHA512

                                                        6208a829a109b5e6d2c817faac5d1652ffc64d400c8c8c26cc886023a9e15d2a6f9a5342b8376d7a2f6377482db09e312af7981865232ce08023956e9b19f6c7

                                                        Download Submit

                                                      • C:\Config.Msi\e57bb19.rbs
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        e657d801a1f527a1e2c196660d411658

                                                        SHA1

                                                        097cde6613ae3669c746e3ac0bc217181b6d8e0a

                                                        SHA256

                                                        0b0f578e4e3023b20d180a5093e5557f9795121b0db13927eee98b2871dbfde7

                                                        SHA512

                                                        67111d9b35a37e876e90b6d19ca177cd524e0016e294be967f2d091e089a1da4bd107beb2caac3d080bf48bf4e8de25e7d51f0be5de912ce1d8dc468fb95e754

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3840b31c383fdf49bfd6740d945c9032

                                                        SHA1

                                                        a6f50164a69718bcef4664d7c47534f0d721866a

                                                        SHA256

                                                        1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                        SHA512

                                                        f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                        Filesize

                                                        142KB

                                                        MD5

                                                        477293f80461713d51a98a24023d45e8

                                                        SHA1

                                                        e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                        SHA256

                                                        a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                        SHA512

                                                        23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        b3bb71f9bb4de4236c26578a8fae2dcd

                                                        SHA1

                                                        1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                        SHA256

                                                        e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                        SHA512

                                                        fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                        Filesize

                                                        210KB

                                                        MD5

                                                        c106df1b5b43af3b937ace19d92b42f3

                                                        SHA1

                                                        7670fc4b6369e3fb705200050618acaa5213637f

                                                        SHA256

                                                        2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                        SHA512

                                                        616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                        Filesize

                                                        693KB

                                                        MD5

                                                        2c4d25b7fbd1adfd4471052fa482af72

                                                        SHA1

                                                        fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                        SHA256

                                                        2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                        SHA512

                                                        f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                        Filesize

                                                        157KB

                                                        MD5

                                                        242d415e238789fbc57c5ac7e8ca5d02

                                                        SHA1

                                                        09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                        SHA256

                                                        7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                        SHA512

                                                        ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                        Filesize

                                                        51KB

                                                        MD5

                                                        3180c705182447f4bcc7ce8e2820b25d

                                                        SHA1

                                                        ad6486557819a33d3f29b18d92b43b11707aae6e

                                                        SHA256

                                                        5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                        SHA512

                                                        228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                        Filesize

                                                        12B

                                                        MD5

                                                        dc63026e80d2bb04f71e41916f807e33

                                                        SHA1

                                                        6cda386d2c365f94ea3de41e2390fd916622eb51

                                                        SHA256

                                                        3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                        SHA512

                                                        61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                        Filesize

                                                        173KB

                                                        MD5

                                                        31def444e6135301ea3c38a985341837

                                                        SHA1

                                                        f135be75c721af2d5291cb463cbc22a32467084a

                                                        SHA256

                                                        36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                        SHA512

                                                        bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                        Filesize

                                                        546B

                                                        MD5

                                                        158fb7d9323c6ce69d4fce11486a40a1

                                                        SHA1

                                                        29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                        SHA256

                                                        5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                        SHA512

                                                        7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                        Filesize

                                                        688KB

                                                        MD5

                                                        ba66874c510645c1fb5fe74f85b32e98

                                                        SHA1

                                                        e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                        SHA256

                                                        12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                        SHA512

                                                        44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                        Filesize

                                                        27KB

                                                        MD5

                                                        797c9554ec56fd72ebb3f6f6bef67fb5

                                                        SHA1

                                                        40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                        SHA256

                                                        7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                        SHA512

                                                        4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                        Filesize

                                                        214KB

                                                        MD5

                                                        01807774f043028ec29982a62fa75941

                                                        SHA1

                                                        afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                        SHA256

                                                        9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                        SHA512

                                                        33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                        Filesize

                                                        37KB

                                                        MD5

                                                        efb4712c8713cb05eb7fe7d87a83a55a

                                                        SHA1

                                                        c94d106bba77aecf88540807da89349b50ea5ae7

                                                        SHA256

                                                        30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                        SHA512

                                                        3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                        Filesize

                                                        3.4MB

                                                        MD5

                                                        e010d1f614b1a830482d3df4ba056f24

                                                        SHA1

                                                        5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                        SHA256

                                                        98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                        SHA512

                                                        727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                        Filesize

                                                        389KB

                                                        MD5

                                                        5e3252e0248b484e76fcdbf8b42a645d

                                                        SHA1

                                                        11ae92fd16ac87f6ab755911e85e263253c16516

                                                        SHA256

                                                        01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                        SHA512

                                                        540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        e27f1c9232f4ae2e53f6ecea130da0d4

                                                        SHA1

                                                        846b010e34cea6bc8bd6ee04425eed3fd430f120

                                                        SHA256

                                                        70302fee3681ec4a996523855444dee9300f29b9af9a08a9eae3a374229adba3

                                                        SHA512

                                                        bd5705a7c64dc18b683ef92ba8f75951fb530c05c1d58a631415d4ee3d159fc818004207026c584c9af42813cec6bc643e80125e03548537144496cad14511c7

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        Filesize

                                                        196KB

                                                        MD5

                                                        5f782d0cb0f717ae9dfd1b4da1295f15

                                                        SHA1

                                                        b33575e428e19940f0585c747e054ca70a12d454

                                                        SHA256

                                                        0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                        SHA512

                                                        e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                        Filesize

                                                        55KB

                                                        MD5

                                                        a739b889642ca9ce4ad3a37a3c521604

                                                        SHA1

                                                        18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                        SHA256

                                                        44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                        SHA512

                                                        92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        9d1528a2ce17522f6de064ae2c2b608e

                                                        SHA1

                                                        2f1ce8b589e57ab300bb93dde176689689f75114

                                                        SHA256

                                                        11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                        SHA512

                                                        a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5652.update
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        14ffcf07375b3952bd3f2fe52bb63c14

                                                        SHA1

                                                        ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                        SHA256

                                                        6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                        SHA512

                                                        14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                        Filesize

                                                        8KB

                                                        MD5

                                                        beb92a690487052e22c69322261dbe1c

                                                        SHA1

                                                        13ec26a77e8a35a4b964ba47b7eab1c1f71537cb

                                                        SHA256

                                                        51af2adfcf4792c26c821ebaaf3690693ef042f8d3adc581ad66b0cdd82e88c3

                                                        SHA512

                                                        cd89ba40190daff96b55420002570d659889fed33206807a7920bb969ddc0a92322a371ef8895c8dcb766b88e03b141bddf7dc17203a5ee7bebd4be6fc7c09b0

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                        Filesize

                                                        2B

                                                        MD5

                                                        81051bcc2cf1bedf378224b0a93e2877

                                                        SHA1

                                                        ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                        SHA256

                                                        7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                        SHA512

                                                        1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                        Filesize

                                                        54KB

                                                        MD5

                                                        77c613ffadf1f4b2f50d31eeec83af30

                                                        SHA1

                                                        76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                        SHA256

                                                        2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                        SHA512

                                                        29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                        Filesize

                                                        334KB

                                                        MD5

                                                        b3e14504a48bed32c53ec7aab2cb2c8f

                                                        SHA1

                                                        0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                        SHA256

                                                        adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                        SHA512

                                                        e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                        Filesize

                                                        72KB

                                                        MD5

                                                        749c51599fbf82422791e0df1c1e841c

                                                        SHA1

                                                        bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                        SHA256

                                                        c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                        SHA512

                                                        f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                        Filesize

                                                        50KB

                                                        MD5

                                                        c0f02eaa3eb28659d8f1bcba8de48479

                                                        SHA1

                                                        5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                        SHA256

                                                        6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                        SHA512

                                                        47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                        Filesize

                                                        32KB

                                                        MD5

                                                        f531d3157e9ff57eea92db36c40e283e

                                                        SHA1

                                                        d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                        SHA256

                                                        30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                        SHA512

                                                        27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                        Filesize

                                                        54KB

                                                        MD5

                                                        d11b2139d29e79d795054c3866898b7f

                                                        SHA1

                                                        020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                        SHA256

                                                        11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                        SHA512

                                                        de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                        Filesize

                                                        588KB

                                                        MD5

                                                        17d74c03b6bcbcd88b46fcc58fc79a0d

                                                        SHA1

                                                        bc0316e11c119806907c058d62513eb8ce32288c

                                                        SHA256

                                                        13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                        SHA512

                                                        f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                        Download Submit

                                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                        Filesize

                                                        217B

                                                        MD5

                                                        b9a1432608fa1ebf11f979a1abe0d02c

                                                        SHA1

                                                        301cb86c85765f43913efe4e86fad19690b49ad6

                                                        SHA256

                                                        8a9e192e25b08251912ffd158a095f515aab398dbccbc433d4515e040babdaf3

                                                        SHA512

                                                        63cf637c21f840f59e4ecae6ccd34cf226e6004eac1eaa7322c83e5c40888b1b3a15cef9a9b3738b5621c7675ce6231fa9e6e9ad827295dad1ea54d4c161ce2b

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        1ef7574bc4d8b6034935d99ad884f15b

                                                        SHA1

                                                        110709ab33f893737f4b0567f9495ac60c37667c

                                                        SHA256

                                                        0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                        SHA512

                                                        947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        f512536173e386121b3ebd22aac41a4e

                                                        SHA1

                                                        74ae133215345beaebb7a95f969f34a40dda922a

                                                        SHA256

                                                        a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                        SHA512

                                                        1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                        Filesize

                                                        76KB

                                                        MD5

                                                        b40fe65431b18a52e6452279b88954af

                                                        SHA1

                                                        c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                        SHA256

                                                        800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                        SHA512

                                                        e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                        Filesize

                                                        80KB

                                                        MD5

                                                        3904d0698962e09da946046020cbcb17

                                                        SHA1

                                                        edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                        SHA256

                                                        a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                        SHA512

                                                        c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                        Download Submit

                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                        Filesize

                                                        96KB

                                                        MD5

                                                        49e2e759b682d2c5c2cdfeb746e260de

                                                        SHA1

                                                        159bf62ee4a75d510c53f1e1f68252fd05102bf3

                                                        SHA256

                                                        4dfadfd1aa68c35a963e2b74f9110b7114731a424e5fafc25eee20482e1a087e

                                                        SHA512

                                                        98dfe580d68a88f2da0401dea9de93f4b417a052975dae9986996675e9be59f3e9a6c32c58a8ca27adb593abb03d30fe44f01ae8810a9d2e8c193e0ebc10b8a9

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                        Filesize

                                                        433B

                                                        MD5

                                                        cf5f69533151675ab4f248fbc8cdedeb

                                                        SHA1

                                                        eb736e17118ac79e341b49eb29ea04433e65e66f

                                                        SHA256

                                                        e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                        SHA512

                                                        e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                        Filesize

                                                        717B

                                                        MD5

                                                        ef0a07aec4367a64c16c581da2657aa9

                                                        SHA1

                                                        13011a5abcbadb3424fb6ecee560665556bb1d24

                                                        SHA256

                                                        f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                        SHA512

                                                        35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        362ce475f5d1e84641bad999c16727a0

                                                        SHA1

                                                        6b613c73acb58d259c6379bd820cca6f785cc812

                                                        SHA256

                                                        1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                        SHA512

                                                        7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                        Filesize

                                                        1.9MB

                                                        MD5

                                                        8de5a7a19d882820893d8b911c1710fb

                                                        SHA1

                                                        95cdf5855bc5e454c8944952697ab142f77124f7

                                                        SHA256

                                                        2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                        SHA512

                                                        3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        9a9b1fd85b5f1dcd568a521399a0d057

                                                        SHA1

                                                        34ed149b290a3a94260d889ba50cb286f1795fa6

                                                        SHA256

                                                        88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                        SHA512

                                                        7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                        Filesize

                                                        375KB

                                                        MD5

                                                        3c93b399b417b0d6a232d386e65a8b46

                                                        SHA1

                                                        bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                        SHA256

                                                        29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                        SHA512

                                                        a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                        Filesize

                                                        321KB

                                                        MD5

                                                        d3901e62166e9c42864fe3062cb4d8d5

                                                        SHA1

                                                        c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                        SHA256

                                                        dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                        SHA512

                                                        ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                        Filesize

                                                        814KB

                                                        MD5

                                                        9b1f97a41bfb95f148868b49460d9d04

                                                        SHA1

                                                        768031d5e877e347a249dfdeab7c725df941324b

                                                        SHA256

                                                        09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                        SHA512

                                                        9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                        Filesize

                                                        1.2MB

                                                        MD5

                                                        e74d2a16da1ddb7f9c54f72b8a25897c

                                                        SHA1

                                                        32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                        SHA256

                                                        a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                        SHA512

                                                        52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                        Filesize

                                                        11B

                                                        MD5

                                                        5eda46a55c61b07029e7202f8cf1781c

                                                        SHA1

                                                        862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                        SHA256

                                                        12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                        SHA512

                                                        4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                        Filesize

                                                        12B

                                                        MD5

                                                        5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                        SHA1

                                                        93012724e6cc0a298838aede678806e6c0c6517d

                                                        SHA256

                                                        a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                        SHA512

                                                        890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        b4a865268d5aca5f93bab91d7d83c800

                                                        SHA1

                                                        95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                        SHA256

                                                        5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                        SHA512

                                                        c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        c1b6430395a025a7712f46cada68e3a3

                                                        SHA1

                                                        6ef940bc3587ef4c139e329821827515b7255f2a

                                                        SHA256

                                                        7ac4902aeb57e6209f3e40a0bf3869f63a3ac2aaeb077cf2fe4917a2a9dde74d

                                                        SHA512

                                                        5c35eb7523eabaaa589927bef9b2aa63a42a6677dd0ec15fa587ad85db28e3ab2e6d35d5dba2e89f519372c4951bd83dcd16a8b00b61eb8a158a6a8632e8cea8

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                        Filesize

                                                        48KB

                                                        MD5

                                                        1d43bf210850cae871e5570770f6ed6d

                                                        SHA1

                                                        c7ffa6c754c1fa2cdf8f195cf14f63df93b53d20

                                                        SHA256

                                                        382fc764807c6b6403ad58631204164df286ccd13ff072f6ed3127be8a0c7cf3

                                                        SHA512

                                                        c0a22c992bc429b6f47a815c1fc3ee26c5232cca96ed28d0ce1b09e3be3db0a945cc8566077191b31a1058f585dd98662eeb7c811f4b033cf38fd35f8c9cedef

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                        Filesize

                                                        2.8MB

                                                        MD5

                                                        91453d3e1e2bc9586cf5495073fb3cf7

                                                        SHA1

                                                        09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                        SHA256

                                                        5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                        SHA512

                                                        462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                        Filesize

                                                        2.9MB

                                                        MD5

                                                        384d6da5c34ff401b18f0af41e3a2643

                                                        SHA1

                                                        3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                        SHA256

                                                        0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                        SHA512

                                                        5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                        Filesize

                                                        1.1MB

                                                        MD5

                                                        6c6f85e896655a6eb726482f04c49086

                                                        SHA1

                                                        2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                        SHA256

                                                        e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                        SHA512

                                                        b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                        Filesize

                                                        541B

                                                        MD5

                                                        d0efb0a6d260dbe5d8c91d94b77d7acd

                                                        SHA1

                                                        e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                        SHA256

                                                        7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                        SHA512

                                                        a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                        Filesize

                                                        12B

                                                        MD5

                                                        3d66ae5ed06891e8ce75a39a24070844

                                                        SHA1

                                                        368064119835d4376727a14706c41384446183e8

                                                        SHA256

                                                        73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                        SHA512

                                                        c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                        Filesize

                                                        646KB

                                                        MD5

                                                        7895698867d1ad33934a8553b4806dc5

                                                        SHA1

                                                        32704df55deaff9bf0b4ee0b887541856578938b

                                                        SHA256

                                                        ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                        SHA512

                                                        20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                        Filesize

                                                        3.1MB

                                                        MD5

                                                        85e1898362165fc1315d18abb73c1b37

                                                        SHA1

                                                        289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                        SHA256

                                                        d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                        SHA512

                                                        49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                        Download Submit

                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                        Filesize

                                                        569KB

                                                        MD5

                                                        9614d1da18956de06747c03068208d66

                                                        SHA1

                                                        fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                        SHA256

                                                        dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                        SHA512

                                                        d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                        Download Submit

                                                      • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\876e5578cd624b324d03fee5e75f4ddc
                                                        Filesize

                                                        16KB

                                                        MD5

                                                        b2e89027a140a89b6e3eb4e504e93d96

                                                        SHA1

                                                        f3b1b34874b73ae3032decb97ef96a53a654228f

                                                        SHA256

                                                        5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                        SHA512

                                                        93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                        Download Submit

                                                      • C:\ProgramData\chocolatey\config\chocolatey.config
                                                        Filesize

                                                        809B

                                                        MD5

                                                        8b6737800745d3b99886d013b3392ac3

                                                        SHA1

                                                        bb94da3f294922d9e8d31879f2d145586a182e19

                                                        SHA256

                                                        86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                        SHA512

                                                        654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                        Download Submit

                                                      • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        ed9ada31db035b62c23193e1c6c62b80

                                                        SHA1

                                                        2e33530d123c4d175a8717cde48b5c5dcfe06c5f

                                                        SHA256

                                                        cf0a944653013dc0c36da0c0036f71e6b83f11ebfa8dd425a876f79e3911aeef

                                                        SHA512

                                                        f19380f8ef0b004d98bc98be57743b93b74eb8529c9b2d2fb892a3c829a2dfa868ec77222c33e88b76f0d67cbcf7f8f98a6b7d4b27477a373799de45c05a8409

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                        Filesize

                                                        471B

                                                        MD5

                                                        6ae5c21035bf5034cb63fb2e785d758c

                                                        SHA1

                                                        d4aed3aa8626d0dc49b7fe9b6073cd1773ad8ceb

                                                        SHA256

                                                        251eb310eb807b47bd4093a3170aea35c155fa78e500baa6ca4e2cdeaf0166ff

                                                        SHA512

                                                        cd9f90caca712dd3d4392e319e70ce10971335aba9a670cf631aae1b6f86abe8c58de4bd3a845af0cc4f3c0bb7b0422b405f5c6cd0bfef38f419eaf4eaacf131

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                        Filesize

                                                        727B

                                                        MD5

                                                        dda7e1956de2ae2d4bd35bc0704a2154

                                                        SHA1

                                                        4cee45a879ef15cc7379292df4ea20275549dc30

                                                        SHA256

                                                        f65b87c1bc3b0930729a647c8078a7c5f6ea0fbc8272ad75740167069ccd6fc7

                                                        SHA512

                                                        49427b506f07c4425fa87e2406048341b07b47ba16ab1eb302684c9436fadc1746ca418a8d021b6bdd2f699906e33929986327643fb59ed5fb287af818d757e0

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                        Filesize

                                                        727B

                                                        MD5

                                                        85e4ef53daf9d74a4f483e3575e0182e

                                                        SHA1

                                                        706b05f30e9ca50caa4d2ab06eebde684094f9f8

                                                        SHA256

                                                        a155eddd3fefeb549e9a57df0fe3910f7f66cf43e310dc81fc4a59e2e9529af4

                                                        SHA512

                                                        69e9854a575ce93964777b31caea6167a4291c57482bd342731bb02f04be93450694a75c7ba019ead54f38f25dfb96263111ba33a1db57f77e25cf8ee681f007

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                        Filesize

                                                        400B

                                                        MD5

                                                        35b37a8fd58e86fa7dcd92e09d6151a8

                                                        SHA1

                                                        4ef31a5b0a83221d96e74df1121a0a465e19f112

                                                        SHA256

                                                        c0a08452e5050524623a262e3328817c9efdee7233bff32379c00bd241737829

                                                        SHA512

                                                        068facf539faab60ebe124417147ec152544b9f7365d48fbc4214a29323fbaf5ea00c521de6be83de33d3f2a0b44565bc751e1b7780195d1e9e363f8496abfe1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                        Filesize

                                                        404B

                                                        MD5

                                                        845706cfde0d67c04510695c863c30ac

                                                        SHA1

                                                        2cce61308bb09df9ef8b848bb48f275b266e6437

                                                        SHA256

                                                        1808b815c61813cc1e881a32821cc72ffc9da00d0caaa3c546033eb33f2ad486

                                                        SHA512

                                                        d75cf3a345eea4f2b027b65ef2c81a7cb36828a4cfef8340bae83071f9d3a9343536cbbbbfc2568cb0794d41566cd90573a2752588971e5a6bb3c824cb9ff146

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                        Filesize

                                                        412B

                                                        MD5

                                                        67c72db85955056b5bf0177ac034910c

                                                        SHA1

                                                        0cb82b1a895d6fd04bcd76b667f716d2cde8a9c7

                                                        SHA256

                                                        a308d0a68325fbd6bba0eeb1c73698e9d89c0ef4473191465aff176fbe864136

                                                        SHA512

                                                        c642f070e633bed133c29fbcd2e5ed913f138ea6febe68aaa0f99fb1560502b744d582257b2633b464c3de7a5fcf393af79901deee65393ab3a7fa655b6809e2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                        Filesize

                                                        651B

                                                        MD5

                                                        9bbfe11735bac43a2ed1be18d0655fe2

                                                        SHA1

                                                        61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                        SHA256

                                                        549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                        SHA512

                                                        a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                        Download Submit

                                                      • C:\Windows\Installer\MSI267D.tmp
                                                        Filesize

                                                        4.5MB

                                                        MD5

                                                        2207f96731ce2f9d9327c0baaf4959ef

                                                        SHA1

                                                        f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                        SHA256

                                                        e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                        SHA512

                                                        7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                        Download Submit

                                                      • C:\Windows\Installer\MSI7B86.tmp-\System.Management.dll
                                                        Filesize

                                                        60KB

                                                        MD5

                                                        878e361c41c05c0519bfc72c7d6e141c

                                                        SHA1

                                                        432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                        SHA256

                                                        24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                        SHA512

                                                        59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIBBBE.tmp
                                                        Filesize

                                                        509KB

                                                        MD5

                                                        88d29734f37bdcffd202eafcdd082f9d

                                                        SHA1

                                                        823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                        SHA256

                                                        87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                        SHA512

                                                        1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIBBBE.tmp-\AlphaControlAgentInstallation.dll
                                                        Filesize

                                                        25KB

                                                        MD5

                                                        aa1b9c5c685173fad2dabebeb3171f01

                                                        SHA1

                                                        ed756b1760e563ce888276ff248c734b7dd851fb

                                                        SHA256

                                                        e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                        SHA512

                                                        d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIBBBE.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                        Filesize

                                                        179KB

                                                        MD5

                                                        1a5caea6734fdd07caa514c3f3fb75da

                                                        SHA1

                                                        f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                        SHA256

                                                        cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                        SHA512

                                                        a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIBFB7.tmp-\CustomAction.config
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        bc17e956cde8dd5425f2b2a68ed919f8

                                                        SHA1

                                                        5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                        SHA256

                                                        e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                        SHA512

                                                        02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIBFB7.tmp-\Newtonsoft.Json.dll
                                                        Filesize

                                                        695KB

                                                        MD5

                                                        715a1fbee4665e99e859eda667fe8034

                                                        SHA1

                                                        e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                        SHA256

                                                        c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                        SHA512

                                                        bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                        Download Submit

                                                      • C:\Windows\Installer\MSIC79A.tmp
                                                        Filesize

                                                        211KB

                                                        MD5

                                                        a3ae5d86ecf38db9427359ea37a5f646

                                                        SHA1

                                                        eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                        SHA256

                                                        c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                        SHA512

                                                        96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                        Download Submit

                                                      • C:\Windows\Installer\e57bb03.msi
                                                        Filesize

                                                        2.9MB

                                                        MD5

                                                        1237a9140ac0333e8f4dff131a18635e

                                                        SHA1

                                                        ad0621265080d50c2e6f56d6a87a53a448d8d8dd

                                                        SHA256

                                                        160d67508f3283df11379f4e5dfa87c68ead4fb9e355813b79560d56856012f4

                                                        SHA512

                                                        9c5f8621941eac95a00bc2aa8e23ec372a63994b61f287d90777a90c22c9557481fd5bfbb5cb621d2da9a11ae5b623dd73d27dc792842731a5d8f2ba03666742

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{004cdbda-c685-e841-8955-e5195b52dd02}\lci_proxywddm.cat
                                                        Filesize

                                                        12KB

                                                        MD5

                                                        8e16d54f986dbe98812fd5ec04d434e8

                                                        SHA1

                                                        8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                        SHA256

                                                        7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                        SHA512

                                                        e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{004cdbda-c685-e841-8955-e5195b52dd02}\lci_proxywddm.inf
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        0315a579f5afe989154cb7c6a6376b05

                                                        SHA1

                                                        e352ff670358cf71e0194918dfe47981e9ccbb88

                                                        SHA256

                                                        d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                        SHA512

                                                        c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{004cdbda-c685-e841-8955-e5195b52dd02}\x64\lci_proxyumd.dll
                                                        Filesize

                                                        179KB

                                                        MD5

                                                        4dc11547a5fc28ca8f6965fa21573481

                                                        SHA1

                                                        d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                        SHA256

                                                        e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                        SHA512

                                                        bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{004cdbda-c685-e841-8955-e5195b52dd02}\x64\lci_proxyumd32.dll
                                                        Filesize

                                                        135KB

                                                        MD5

                                                        67ae7b2c36c9c70086b9d41b4515b0a8

                                                        SHA1

                                                        ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                        SHA256

                                                        79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                        SHA512

                                                        4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{004cdbda-c685-e841-8955-e5195b52dd02}\x64\lci_proxywddm.sys
                                                        Filesize

                                                        119KB

                                                        MD5

                                                        b9b0e9b4d93b18b99ece31a819d71d00

                                                        SHA1

                                                        2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                        SHA256

                                                        0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                        SHA512

                                                        465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{35da8556-0fcf-4949-a707-613f4d96ebfc}\lci_iddcx.cat
                                                        Filesize

                                                        10KB

                                                        MD5

                                                        62458e58313475c9a3642a392363e359

                                                        SHA1

                                                        e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                        SHA256

                                                        85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                        SHA512

                                                        49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{35da8556-0fcf-4949-a707-613f4d96ebfc}\lci_iddcx.inf
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        1cec22ca85e1b5a8615774fca59a420b

                                                        SHA1

                                                        049a651751ef38321a1088af6a47c4380f9293fc

                                                        SHA256

                                                        60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                        SHA512

                                                        0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                        Download Submit

                                                      • C:\Windows\System32\DriverStore\Temp\{35da8556-0fcf-4949-a707-613f4d96ebfc}\x64\lci_iddcx.dll
                                                        Filesize

                                                        52KB

                                                        MD5

                                                        01e8bc64139d6b74467330b11331858d

                                                        SHA1

                                                        b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                        SHA256

                                                        148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                        SHA512

                                                        4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                        Download Submit

                                                      • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-19-06-42.dat
                                                        Filesize

                                                        602B

                                                        MD5

                                                        a92f445a6e943a6194c482acff7945f5

                                                        SHA1

                                                        6f145167c43b14829871c58000632712aa1fd327

                                                        SHA256

                                                        722e4019b9f0df9b8da1525b538a7d3a8a42b1a29113a93187f9825cb49af271

                                                        SHA512

                                                        1d94748288e4e4e7acee8effea2a3009916f3279f23c037135a97a2c5bf0639e04c94d7b84ce06bb055db4825c43ff535c83bcb01ef19a98706ce5e9c1d13b35

                                                        Download Submit

                                                      • C:\Windows\Temp\InstallUtil.log
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        5378ef8e1804aa5df9f98b9c797d2f28

                                                        SHA1

                                                        4557bc873e7762d02072d69e49e3eefb32e65f95

                                                        SHA256

                                                        c76d248c736356d3b9e442bdc218cb6744c76093cdd6de74657e7a929fc9ea44

                                                        SHA512

                                                        47e48988be05e806f6c38eb86eeca35ee4a7e639d814065fac6cd8af38dfce9c6fd3f822a9811f192c8f44ba5fc781709ee1aa881beea9a395e4227abe3394ce

                                                        Download Submit

                                                      • C:\Windows\Temp\InstallUtil.log
                                                        Filesize

                                                        708B

                                                        MD5

                                                        b00bf1d80027ecb1e36ab8fcbccdfd09

                                                        SHA1

                                                        5bfb18b5772829b697c6bb65cabe596a3f777eb5

                                                        SHA256

                                                        81890bfb6c14c30245f70214001ec4758f4b44a6b2e6a3b209f3ebdc85fda112

                                                        SHA512

                                                        41ee9a58e6c8d63fe05be75d4550ce40da63b0aa112d6709e2055f1114019c03dcfd7bbbd70a938856c62897aae479d7acc999020cf2d09353464644c3d6ba6f

                                                        Download Submit

                                                      • C:\Windows\Temp\PreVer.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        23246b7cbe2b93eed3b9c057f97e2222

                                                        SHA1

                                                        ac7506dac89564d87eba1f4eb5b5ad80a7ad1e3c

                                                        SHA256

                                                        95f3b3bef10ba1b650de76c815ef771c135fedfa2fe3a193d8b4b8f964240fc6

                                                        SHA512

                                                        d90f224e0451010c9b103031a6787f34929add5499e442a798fb56cecfbcc22ab4829d225e4343d126aaad49b625313725826d2c322bf443c5924d467a09421e

                                                        Download Submit

                                                      • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                        Filesize

                                                        3.2MB

                                                        MD5

                                                        a7ce785b6cd1c9657040ca9b6cbeed10

                                                        SHA1

                                                        4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                        SHA256

                                                        7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                        SHA512

                                                        39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                        Download Submit

                                                      • C:\Windows\Temp\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\ISRT.dll
                                                        Filesize

                                                        427KB

                                                        MD5

                                                        85315ad538fa5af8162f1cd2fce1c99d

                                                        SHA1

                                                        31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                        SHA256

                                                        70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                        SHA512

                                                        877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                        Download Submit

                                                      • C:\Windows\Temp\{D2890AC1-9720-4AF2-8D9B-CB21FB09A2DA}\_isres_0x0409.dll
                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        befe2ef369d12f83c72c5f2f7069dd87

                                                        SHA1

                                                        b89c7f6da1241ed98015dc347e70322832bcbe50

                                                        SHA256

                                                        9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                        SHA512

                                                        760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                        Download Submit

                                                      • C:\Windows\Temp\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\IsConfig.ini
                                                        Filesize

                                                        571B

                                                        MD5

                                                        38370175ce7d8dd5c3581030a9104259

                                                        SHA1

                                                        bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                        SHA256

                                                        ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                        SHA512

                                                        e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                        Download Submit

                                                      • C:\Windows\Temp\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\String1033.txt
                                                        Filesize

                                                        182KB

                                                        MD5

                                                        37a2c4ef0ff41955f1cb884b7790699f

                                                        SHA1

                                                        8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                        SHA256

                                                        6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                        SHA512

                                                        fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                        Download Submit

                                                      • C:\Windows\Temp\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\_is1B44.exe
                                                        Filesize

                                                        179KB

                                                        MD5

                                                        7a1c100df8065815dc34c05abc0c13de

                                                        SHA1

                                                        3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                        SHA256

                                                        e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                        SHA512

                                                        bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                        Download Submit

                                                      • C:\Windows\Temp\{FB79D72D-8239-4BB0-B250-41B242C3F3B2}\setup.inx
                                                        Filesize

                                                        345KB

                                                        MD5

                                                        0376dd5b7e37985ea50e693dc212094c

                                                        SHA1

                                                        02859394164c33924907b85ab0aaddc628c31bf1

                                                        SHA256

                                                        c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                        SHA512

                                                        69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                        Download Submit

                                                      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                        Filesize

                                                        404B

                                                        MD5

                                                        426e08dd0b3411c073f2bc1d10f0b807

                                                        SHA1

                                                        4c956d33c44bfb6cbf59790246f46d1ebf523993

                                                        SHA256

                                                        70572234f9984e402520858f1d8a7e45ec1be8edf8feeb901536dbedfa087855

                                                        SHA512

                                                        704ce8ad43da88d56d9956ceec915cd16a6573844acfbca9ddaad7f0ccf89ce2de587874063fa3ce93f4cb140a02470c79f08d6698200a572afcb56987162787

                                                        Download Submit

                                                      • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                        Filesize

                                                        412B

                                                        MD5

                                                        84a1eec3177c268607294c476d04b59a

                                                        SHA1

                                                        cff86085529d9362a3bc934bf0cb3613db9a11be

                                                        SHA256

                                                        435c74be214822bcc5bf07d80a217a499f5e41637c169e2a34ed03e79ee73a86

                                                        SHA512

                                                        e2661fa3c82c88025900e7ae48b5b40dd169b889ad54bfc2c2831602c6774d34718b25b171af8becd9db6265281504cec7c527c4d6f2ffa3cd94db908b8205ae

                                                        Download Submit

                                                      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                        Filesize

                                                        24.1MB

                                                        MD5

                                                        0701ba2e20b07dca22392d7ae8df5867

                                                        SHA1

                                                        c1f2bcc674b04fae7f80b524b271aa39c8e919a3

                                                        SHA256

                                                        688b06c6133e14f7aa876724edb006b613f29d974c4eaaa4fe1c37e3fe78aa84

                                                        SHA512

                                                        519ac306409bfee370d975cf78e33c3a4d476c8fe495ecd1313caef00e52c2f834f977e57585fd903368cd6b5e77958d0d04e10a14e793e15217bb70ccdf2f73

                                                        Download Submit

                                                      • \??\Volume{f0eec59f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{982a028f-6b9b-4d96-85e2-c9e65403cfa1}_OnDiskSnapshotProp
                                                        Filesize

                                                        6KB

                                                        MD5

                                                        4564df6f0f0e3e20d1bb3cd1ff85a5eb

                                                        SHA1

                                                        bd09f4412ee4b69ec03e2f5244ff0f35bb7b641d

                                                        SHA256

                                                        259812c6af86df1d605a8df4f5ba74f4560891974fe3cc2ca1bbdcf45528410c

                                                        SHA512

                                                        21bf88c89a5e4387be7a57df785803fd7c4063bedf386f6478723160dc40dfd381d41664b9ed049f223fdbdcba7b8203ebadcdbf41a45814603b7ed77f625793

                                                        Download Submit

                                                      • memory/656-162-0x000001B6B2BB0000-0x000001B6B2C48000-memory.dmp

                                                        Filesize

                                                        608KB

                                                        Download

                                                      • memory/656-356-0x000002149AC00000-0x000002149AC3A000-memory.dmp

                                                        Filesize

                                                        232KB

                                                        Download

                                                      • memory/656-166-0x000001B69A2D0000-0x000001B69A2E2000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/656-342-0x0000021481550000-0x00000214815B4000-memory.dmp

                                                        Filesize

                                                        400KB

                                                        Download

                                                      • memory/656-343-0x0000021481F60000-0x0000021481FAA000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/656-344-0x0000021481F30000-0x0000021481F4C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/656-150-0x000001B698700000-0x000001B698728000-memory.dmp

                                                        Filesize

                                                        160KB

                                                        Download

                                                      • memory/656-345-0x000002149A760000-0x000002149A7AC000-memory.dmp

                                                        Filesize

                                                        304KB

                                                        Download

                                                      • memory/656-346-0x000002149A7B0000-0x000002149A7F8000-memory.dmp

                                                        Filesize

                                                        288KB

                                                        Download

                                                      • memory/656-347-0x0000021481F10000-0x0000021481F18000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/656-348-0x0000021481F20000-0x0000021481F2A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/656-349-0x000002149A9E0000-0x000002149AABC000-memory.dmp

                                                        Filesize

                                                        880KB

                                                        Download

                                                      • memory/656-167-0x000001B69A460000-0x000001B69A49C000-memory.dmp

                                                        Filesize

                                                        240KB

                                                        Download

                                                      • memory/656-351-0x0000021481FE0000-0x0000021481FE8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/656-350-0x000002149AAC0000-0x000002149AB72000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/656-352-0x000002149A710000-0x000002149A718000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/656-353-0x000002149A720000-0x000002149A728000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/656-354-0x000002149A970000-0x000002149A9D8000-memory.dmp

                                                        Filesize

                                                        416KB

                                                        Download

                                                      • memory/656-355-0x000002149A930000-0x000002149A95A000-memory.dmp

                                                        Filesize

                                                        168KB

                                                        Download

                                                      • memory/656-357-0x000002149A900000-0x000002149A926000-memory.dmp

                                                        Filesize

                                                        152KB

                                                        Download

                                                      • memory/828-1080-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/828-512-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/828-479-0x0000000003950000-0x0000000003B17000-memory.dmp

                                                        Filesize

                                                        1.8MB

                                                        Download

                                                      • memory/828-1007-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/828-903-0x0000000003990000-0x0000000003B57000-memory.dmp

                                                        Filesize

                                                        1.8MB

                                                        Download

                                                      • memory/828-900-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/828-476-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/828-1043-0x0000000010000000-0x0000000010114000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1092-3256-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1092-3257-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1092-1645-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1092-2447-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1092-2448-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1092-1179-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1092-1647-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1760-1151-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1760-1229-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1760-1150-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1760-1230-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1760-1837-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/1760-1836-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/1840-1355-0x0000017FD1A90000-0x0000017FD1AAC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/1840-1356-0x0000017FEA3B0000-0x0000017FEA462000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/1840-1354-0x0000017FD1230000-0x0000017FD1242000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/1840-1803-0x0000017FEA350000-0x0000017FEA3A4000-memory.dmp

                                                        Filesize

                                                        336KB

                                                        Download

                                                      • memory/2140-278-0x0000016DA3A20000-0x0000016DA3A3C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/2140-277-0x0000016DBC310000-0x0000016DBC3C0000-memory.dmp

                                                        Filesize

                                                        704KB

                                                        Download

                                                      • memory/2140-274-0x0000016DA31B0000-0x0000016DA31E0000-memory.dmp

                                                        Filesize

                                                        192KB

                                                        Download

                                                      • memory/2616-302-0x0000020743270000-0x000002074328C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/2616-301-0x0000020743390000-0x0000020743442000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/2616-300-0x00000207428F0000-0x0000020742906000-memory.dmp

                                                        Filesize

                                                        88KB

                                                        Download

                                                      • memory/2736-82-0x0000000004E20000-0x0000000005174000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                        Download

                                                      • memory/2736-78-0x0000000004D60000-0x0000000004E12000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/2736-81-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download

                                                      • memory/3388-112-0x0000000004DE0000-0x0000000004E46000-memory.dmp

                                                        Filesize

                                                        408KB

                                                        Download

                                                      • memory/4288-41-0x0000000005570000-0x000000000559E000-memory.dmp

                                                        Filesize

                                                        184KB

                                                        Download

                                                      • memory/4288-45-0x00000000055A0000-0x00000000055AC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/4388-194-0x00000175DF340000-0x00000175DF3F2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/4388-195-0x00000175DF430000-0x00000175DF452000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download

                                                      • memory/4388-243-0x00000175DF930000-0x00000175DF968000-memory.dmp

                                                        Filesize

                                                        224KB

                                                        Download

                                                      • memory/4912-1133-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/4912-1351-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/4912-1350-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/4912-1211-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/4912-1210-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/4912-1134-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/5160-1831-0x000002DF3F240000-0x000002DF3F28A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5160-1857-0x000002DF57BD0000-0x000002DF57CAC000-memory.dmp

                                                        Filesize

                                                        880KB

                                                        Download

                                                      • memory/5160-1827-0x000002DF3E870000-0x000002DF3E880000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/5160-1848-0x000002DF3ED10000-0x000002DF3ED2C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5160-1858-0x000002DF57CB0000-0x000002DF57D62000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5404-1802-0x000001A14E6A0000-0x000001A14E6BA000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/5404-1800-0x000001A14E2C0000-0x000001A14E2CA000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/5404-1805-0x000001A167490000-0x000001A167542000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5556-1806-0x00000293953E0000-0x00000293953F0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/5556-1832-0x00000293AE560000-0x00000293AE612000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5556-1842-0x0000029395C70000-0x0000029395C84000-memory.dmp

                                                        Filesize

                                                        80KB

                                                        Download

                                                      • memory/5556-1838-0x00000293AE4A0000-0x00000293AE506000-memory.dmp

                                                        Filesize

                                                        408KB

                                                        Download

                                                      • memory/5556-1823-0x00000293957B0000-0x00000293957D0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5652-1852-0x0000027EB93E0000-0x0000027EB93F0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/5652-1851-0x0000027EB9030000-0x0000027EB9040000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/5652-1853-0x0000027ED2200000-0x0000027ED22B2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5652-1854-0x0000027EB9420000-0x0000027EB9440000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/5752-1850-0x000001E207DC0000-0x000001E207E0A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5752-1855-0x000001E207920000-0x000001E20793C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/5752-1849-0x000001E207520000-0x000001E207532000-memory.dmp

                                                        Filesize

                                                        72KB

                                                        Download

                                                      • memory/5912-1828-0x0000025F72620000-0x0000025F7265A000-memory.dmp

                                                        Filesize

                                                        232KB

                                                        Download

                                                      • memory/5912-1868-0x0000025F73880000-0x0000025F73932000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/5988-1826-0x0000020A2EBE0000-0x0000020A2EC2A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/5988-1820-0x0000020A2E360000-0x0000020A2E36C000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/5988-1840-0x0000020A2EBB0000-0x0000020A2EBCC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/6008-1863-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/6008-1864-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/6008-1844-0x0000000072670000-0x0000000072A3D000-memory.dmp

                                                        Filesize

                                                        3.8MB

                                                        Download

                                                      • memory/6008-1843-0x0000000072A40000-0x0000000072B5C000-memory.dmp

                                                        Filesize

                                                        1.1MB

                                                        Download

                                                      • memory/6020-1867-0x00000252D55D0000-0x00000252D5682000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/6020-1846-0x00000252D5420000-0x00000252D546A000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/6020-1839-0x00000252BCA40000-0x00000252BCA58000-memory.dmp

                                                        Filesize

                                                        96KB

                                                        Download

                                                      • memory/6020-1821-0x00000252BC190000-0x00000252BC1C4000-memory.dmp

                                                        Filesize

                                                        208KB

                                                        Download

                                                      • memory/6020-1869-0x00000252D5690000-0x00000252D576C000-memory.dmp

                                                        Filesize

                                                        880KB

                                                        Download

                                                      • memory/6020-1822-0x00000252BCA70000-0x00000252BCABA000-memory.dmp

                                                        Filesize

                                                        296KB

                                                        Download

                                                      • memory/6020-1825-0x00000252BC590000-0x00000252BC5AC000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/6020-1845-0x00000252BCA20000-0x00000252BCA2A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/6128-1841-0x0000025EC9C10000-0x0000025EC9C28000-memory.dmp

                                                        Filesize

                                                        96KB

                                                        Download

                                                      • memory/6128-1835-0x0000025EB0BC0000-0x0000025EB0BCC000-memory.dmp

                                                        Filesize

                                                        48KB

                                                        Download

                                                      • memory/6128-1847-0x0000025EC9CF0000-0x0000025EC9DA2000-memory.dmp

                                                        Filesize

                                                        712KB

                                                        Download

                                                      • memory/6128-1856-0x0000025EC9C30000-0x0000025EC9C50000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download