Overview

overview

10

Static

static

10

LaudoBombeirosPDF.msi

windows7-x64

10

LaudoBombeirosPDF.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 19:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LaudoBombeirosPDF.msi

  • Size

    2.9MB

  • MD5

    ac205cf1390f2a927596658f0e176321

  • SHA1

    c7b5046e057468f89b3b48d2d5a48e88f1b0f589

  • SHA256

    809e309bf2d7fb660417d229456e24de896161538cd506e49677259c57e50fc4

  • SHA512

    f6495397e23e05500abb91733d188a366a1db5149c099584b04a75a6d7459638d882f74d93f7855c0007a202fe3d0b35124b62453ad0aefbcef401914cc0ad1f

  • SSDEEP

    49152:M+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:M+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LaudoBombeirosPDF.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1680
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2020
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BB41735BD11E180E6A47534A8D4A91B9
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB3B0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628937 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1372
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB71C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629562 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3084
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIBB63.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240630640 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:508
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIC700.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240633609 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3468
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A03A698948EFBA7072B339EA5468A5D3 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:32
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:804
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1120
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4560
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000M0aRpIAJ" /AgentId="e4b2d81c-86de-4107-89db-94815f47c88d"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1444
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C8A69475906BDEA7A122609206B11852 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{19399B21-78A4-42C9-982F-02F84FA75263}
          3⤵
          • Executes dropped EXE
          PID:2132
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7047541B-EF26-4EF3-90BD-D9384EEA0EF1}
          3⤵
          • Executes dropped EXE
          PID:1596
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AE905107-B243-420A-8EFC-971C31571E8C}
          3⤵
          • Executes dropped EXE
          PID:1680
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32CC281A-32AB-4B79-B0AA-8958E53F8234}
          3⤵
          • Executes dropped EXE
          PID:2980
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A00EBF4A-DBBA-45DC-BEA0-F6D5107EA5EA}
          3⤵
          • Executes dropped EXE
          PID:3068
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CFA5D9B5-492A-4138-BB65-1245E15BDF95}
          3⤵
          • Executes dropped EXE
          PID:4128
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8FD8A367-FEE1-476C-89A7-DB0E414945FA}
          3⤵
          • Executes dropped EXE
          PID:3248
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C570AEE-8E13-429B-941D-21FE201F9111}
          3⤵
          • Executes dropped EXE
          PID:2712
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{488F47F1-FBFD-44D5-AE3B-0741059F0895}
          3⤵
          • Executes dropped EXE
          PID:2920
        • C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe
          C:\Windows\TEMP\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isFA2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F31D7AA3-A530-48A1-AE45-3136C39A601A}
          3⤵
          • Executes dropped EXE
          PID:1720
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1592
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2336
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2980
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1360
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1372
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1292
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1284
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3280
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3916
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4792
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2296
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:864
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:2336
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRAgent.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1360
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4708
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              4⤵
                PID:3916
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRChat.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:1720
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2296
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRAudioChat.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:1680
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4060
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill.exe /F /IM SRVirtualDisplay.exe /T
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:3248
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5F67BFC6-00AE-4B1B-9E84-72C4C71618D1}
              3⤵
              • Executes dropped EXE
              PID:2984
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C73E532-5133-46A1-9F7C-5DC9CE332C1F}
              3⤵
              • Executes dropped EXE
              PID:4140
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{584DD839-6D64-4BAA-8FEF-4E199241465B}
              3⤵
              • Executes dropped EXE
              PID:756
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{41FAB7C7-ED17-4E7A-9A7E-FE04D60F16EF}
              3⤵
              • Executes dropped EXE
              PID:4128
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C4F62FF1-F160-4F0D-90AA-41043DC66CC7}
              3⤵
              • Executes dropped EXE
              PID:4124
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0DBABFB-4243-4880-8E52-9E6225063B0B}
              3⤵
              • Executes dropped EXE
              PID:2712
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D11C3FD-8E47-4D9F-A72F-0AC17776E548}
              3⤵
              • Executes dropped EXE
              PID:1120
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EC8FC744-1D09-4EF8-882B-012FE59BDBB3}
              3⤵
              • Executes dropped EXE
              PID:2956
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ABEA7E7A-1DBB-4722-8B9F-87B1625F6BD8}
              3⤵
              • Executes dropped EXE
              PID:388
            • C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
              C:\Windows\TEMP\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{18B98F15-055B-4610-B5AC-8D82EF341B22}
              3⤵
              • Executes dropped EXE
              PID:3944
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E3E896F-6199-4656-931A-9622D1F7A7F4}
              3⤵
              • Executes dropped EXE
              PID:4868
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5BBF82A2-4114-4932-9282-FF79021DD0F0}
              3⤵
              • Executes dropped EXE
              PID:2824
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FCE1C4B0-091A-4149-A28B-D1EFC3EB226E}
              3⤵
              • Executes dropped EXE
              PID:2920
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2915A0EE-79BC-4697-8434-DF46BE48439C}
              3⤵
              • Executes dropped EXE
              PID:2728
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B7E8221E-4469-4ECA-A9FC-677B3B8DBF3A}
              3⤵
              • Executes dropped EXE
              PID:1292
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1C11E7DD-B321-423D-BCF3-C3E44BF301D8}
              3⤵
              • Executes dropped EXE
              PID:3572
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5602439E-0F9E-4872-890E-A47057D8661B}
              3⤵
              • Executes dropped EXE
              PID:1120
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3FD045BC-3625-4E3C-AEFB-24A98C32A3E1}
              3⤵
              • Executes dropped EXE
              PID:2144
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4975C3DE-2391-42B2-84C9-65B82E97BDBD}
              3⤵
              • Executes dropped EXE
              PID:2516
            • C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe
              C:\Windows\TEMP\{01234451-7B39-4FE3-AA3D-E6758D003DB1}\_is18A6.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B15ED2F1-DE52-46D6-8196-11DDD5AE4F62}
              3⤵
              • Executes dropped EXE
              PID:4216
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1120
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:376
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3016
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                4⤵
                  PID:2424
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                  4⤵
                    PID:756
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2144
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4057D4A4-12EC-4D5D-A5D5-D9929420BEF9}
                  3⤵
                  • Executes dropped EXE
                  PID:2364
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E5ABBE2-84BB-4533-9B37-61B37EB641E6}
                  3⤵
                  • Executes dropped EXE
                  PID:3924
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{473314C0-2645-479C-90D7-B16827E3D198}
                  3⤵
                  • Executes dropped EXE
                  PID:1708
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0FE15BB9-A358-46AB-B787-466196E26F2C}
                  3⤵
                  • Executes dropped EXE
                  PID:2692
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F679DDB-4EC6-48B7-B4D5-EB5F0BAC3EFB}
                  3⤵
                  • Executes dropped EXE
                  PID:1840
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE22CD1C-B553-47D4-8B31-CC62344D1073}
                  3⤵
                  • Executes dropped EXE
                  PID:3704
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D30ED344-0C53-429C-9E58-97CE83699A61}
                  3⤵
                  • Executes dropped EXE
                  PID:508
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB0D0D6F-3760-49CB-8C0C-8B1ECCB2EB0E}
                  3⤵
                  • Executes dropped EXE
                  PID:4960
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA52BCFE-87A0-4C8C-BD61-304507F6C8E4}
                  3⤵
                  • Executes dropped EXE
                  PID:804
                • C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe
                  C:\Windows\TEMP\{ACC9B922-C909-4855-AE03-F8D5C5619B6F}\_is2C6E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B143C7DA-A98A-4045-9BA0-5A5D4CB2395E}
                  3⤵
                  • Executes dropped EXE
                  PID:3068
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3572
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0A96B04F-DE75-4C15-B285-CE65FD811760}
                  3⤵
                  • Executes dropped EXE
                  PID:5020
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4EE21972-07CE-4127-8399-0AF555C71C27}
                  3⤵
                  • Executes dropped EXE
                  PID:1708
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3175CD9B-AB98-4671-AFAC-4BEBBA7C32B8}
                  3⤵
                  • Executes dropped EXE
                  PID:4140
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{669CEE45-76E2-4120-8E79-0194D2728B37}
                  3⤵
                  • Executes dropped EXE
                  PID:1840
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1AD603D7-AA55-4EC5-ACFA-A547A4D02203}
                  3⤵
                  • Executes dropped EXE
                  PID:1728
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CAB93FC-83F2-493B-8FE6-BBF9CC6A82C1}
                  3⤵
                  • Executes dropped EXE
                  PID:2364
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52DA4DF1-41C2-4359-B571-82F488DC502C}
                  3⤵
                  • Executes dropped EXE
                  PID:3660
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA23F716-21E9-468D-8D83-FC1D6EFE9F93}
                  3⤵
                  • Executes dropped EXE
                  PID:4968
                • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                  C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{418B2DE3-4C3C-4356-B1E1-57FDF40EB394}
                  3⤵
                    PID:4644
                  • C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe
                    C:\Windows\TEMP\{081BBA6F-B93C-40A4-969D-4EEF2CFD626E}\_is3103.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4BA67439-595B-4363-A99D-1D6E399E33A7}
                    3⤵
                      PID:1680
                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:3704
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        4⤵
                          PID:1728
                    • C:\Windows\syswow64\MsiExec.exe
                      C:\Windows\syswow64\MsiExec.exe -Embedding 45A6D4A5D0F8D7E80C4DC45F3FAC81F2 E Global\MSI0000
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:5480
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI6D6D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240676265 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                        3⤵
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5196
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI6E78.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240676468 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                        3⤵
                        • Blocklisted process makes network request
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:6004
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI7119.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240677125 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                        3⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4996
                      • C:\Windows\SysWOW64\NET.exe
                        "NET" STOP AteraAgent
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4904
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 STOP AteraAgent
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5832
                      • C:\Windows\SysWOW64\TaskKill.exe
                        "TaskKill.exe" /f /im AteraAgent.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        PID:5924
                      • C:\Windows\syswow64\NET.exe
                        "NET" STOP AteraAgent
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4844
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 STOP AteraAgent
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5940
                      • C:\Windows\syswow64\TaskKill.exe
                        "TaskKill.exe" /f /im AteraAgent.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        PID:5288
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSI91B9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240685468 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                        3⤵
                        • Blocklisted process makes network request
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4320
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                      2⤵
                      • Drops file in System32 directory
                      PID:6024
                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="ea69ce2a-4309-4801-a579-a1b46522d674"
                      2⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:1604
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1060
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                    1⤵
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:5116
                    • C:\Windows\System32\sc.exe
                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                      2⤵
                      • Launches sc.exe
                      PID:3212
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e4b2d81c-86de-4107-89db-94815f47c88d "b95e3549-ca13-4eaf-8311-3d7a35294746" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      PID:3520
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e4b2d81c-86de-4107-89db-94815f47c88d "703084ad-d89b-47be-807b-3b3fef1a3b77" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      PID:2732
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e4b2d81c-86de-4107-89db-94815f47c88d "108b92f7-d1ab-47de-a9ee-99afd663b456" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      PID:4248
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e4b2d81c-86de-4107-89db-94815f47c88d "2730d6ea-97d6-458f-8e35-d223fe2031d7" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:4708
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4308
                        • C:\Windows\system32\cscript.exe
                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          4⤵
                          • Modifies data under HKEY_USERS
                          PID:4304
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" e4b2d81c-86de-4107-89db-94815f47c88d "8c3ce4be-deeb-4380-8501-da90e7ce7a5c" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4764
                      • C:\Windows\TEMP\SplashtopStreamer.exe
                        "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4852
                        • C:\Windows\Temp\unpack\PreVerCheck.exe
                          "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3056
                          • C:\Windows\SysWOW64\msiexec.exe
                            msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:1536
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" e4b2d81c-86de-4107-89db-94815f47c88d "0308ed0d-dda1-4818-b242-e54bb95e757b" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000M0aRpIAJ
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3964
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                    1⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of WriteProcessMemory
                    PID:3332
                    • C:\Windows\System32\sc.exe
                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                      2⤵
                      • Launches sc.exe
                      PID:2284
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e4b2d81c-86de-4107-89db-94815f47c88d "ea1fff60-3d58-4726-9574-c3f092eee49f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                      2⤵
                      • Drops file in Program Files directory
                      PID:620
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        3⤵
                          PID:1284
                          • C:\Windows\system32\cscript.exe
                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            4⤵
                            • Modifies data under HKEY_USERS
                            PID:5636
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" e4b2d81c-86de-4107-89db-94815f47c88d "f413fc8b-9932-4a39-bd56-01125489dcf3" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                        2⤵
                        • Drops file in Program Files directory
                        PID:4960
                        • C:\Windows\SYSTEM32\msiexec.exe
                          "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                          3⤵
                            PID:5504
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" e4b2d81c-86de-4107-89db-94815f47c88d "051b41ca-f684-48d8-a624-87c6cc7d9862" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                          2⤵
                            PID:3252
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=078b1723cb1ceec2ffde8221e59327f7&rmm_session_pwd_ttl=86400"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5300
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" e4b2d81c-86de-4107-89db-94815f47c88d "5f2ccba5-ea87-4799-9e8a-362636777a97" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            • Modifies registry class
                            PID:5728
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e4b2d81c-86de-4107-89db-94815f47c88d "c77521bf-540f-46f8-8b4b-1f27cdb09840" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            PID:5844
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" e4b2d81c-86de-4107-89db-94815f47c88d "ab1a923f-d70e-469e-b75a-91e47d415949" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            PID:6080
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" e4b2d81c-86de-4107-89db-94815f47c88d "5a200260-20bd-421a-8f56-c373e85b8f78" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                            2⤵
                            • Drops file in System32 directory
                            PID:6092
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" e4b2d81c-86de-4107-89db-94815f47c88d "037534a2-78ac-4fee-a388-fdd5ee81cdf9" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                            2⤵
                              PID:6104
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" e4b2d81c-86de-4107-89db-94815f47c88d "2d66cc91-fe41-438e-b227-3ad8d9c9668e" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                              2⤵
                              • Drops file in System32 directory
                              PID:2372
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" e4b2d81c-86de-4107-89db-94815f47c88d "bb40820d-91f7-407c-9c40-b5a04c8a7a35" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                              2⤵
                              • Drops file in System32 directory
                              PID:3852
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                3⤵
                                • System Time Discovery
                                PID:5472
                                • C:\Program Files\dotnet\dotnet.exe
                                  dotnet --list-runtimes
                                  4⤵
                                  • System Time Discovery
                                  PID:3124
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" e4b2d81c-86de-4107-89db-94815f47c88d "2e92453f-e101-42db-b780-10199db3c5bc" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                              2⤵
                              • Writes to the Master Boot Record (MBR)
                              • Modifies data under HKEY_USERS
                              PID:1388
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" e4b2d81c-86de-4107-89db-94815f47c88d "97b517e5-96fe-478c-9cba-331b031c5a56" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                              2⤵
                              • Drops file in System32 directory
                              PID:5540
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" e4b2d81c-86de-4107-89db-94815f47c88d "a12034c2-922c-4c44-8862-fa70900d8a8e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                              2⤵
                                PID:3032
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" e4b2d81c-86de-4107-89db-94815f47c88d "e15b8806-849d-4939-af2a-725b9763482e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                                2⤵
                                • Drops file in System32 directory
                                PID:5784
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1648
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1968
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                  -h
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3248
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4140
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                    4⤵
                                      PID:1284
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2516
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1120
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                      SRUtility.exe -r
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1612
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5524
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                      4⤵
                                        PID:2932
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ver
                                          5⤵
                                            PID:912
                                          • C:\Windows\system32\sc.exe
                                            sc query ddmgr
                                            5⤵
                                            • Launches sc.exe
                                            PID:3044
                                          • C:\Windows\system32\sc.exe
                                            sc query lci_proxykmd
                                            5⤵
                                            • Launches sc.exe
                                            PID:5756
                                          • C:\Windows\system32\rundll32.exe
                                            rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                            5⤵
                                            • Drops file in Windows directory
                                            • Checks SCSI registry key(s)
                                            • Modifies data under HKEY_USERS
                                            PID:5940
                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                    1⤵
                                    • Drops file in Program Files directory
                                    • Modifies data under HKEY_USERS
                                    PID:5956
                                    • C:\Windows\System32\sc.exe
                                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                      2⤵
                                      • Launches sc.exe
                                      PID:2604
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" e4b2d81c-86de-4107-89db-94815f47c88d "5aee6f10-0b6e-4324-ae84-35462ea25e1a" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000M0aRpIAJ
                                      2⤵
                                        PID:3056
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          3⤵
                                            PID:6076
                                            • C:\Windows\system32\cscript.exe
                                              cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                              4⤵
                                              • Modifies data under HKEY_USERS
                                              PID:636
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" e4b2d81c-86de-4107-89db-94815f47c88d "4f4a9280-ced7-4293-a7aa-a645c6860e12" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000M0aRpIAJ
                                          2⤵
                                            PID:5540
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" e4b2d81c-86de-4107-89db-94815f47c88d "807a4ab4-c624-4a29-a74e-a9030fda39dc" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000M0aRpIAJ
                                            2⤵
                                              PID:5128
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" e4b2d81c-86de-4107-89db-94815f47c88d "d038ac54-8949-4d21-809c-822a46f3aee1" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000M0aRpIAJ
                                              2⤵
                                                PID:5324
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" e4b2d81c-86de-4107-89db-94815f47c88d "ed18aa53-c60f-478c-ba74-e9c2f322a4af" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                                2⤵
                                                  PID:5192
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" e4b2d81c-86de-4107-89db-94815f47c88d "098be15b-b0ca-4b48-b9c0-19cdd8ad5a15" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000M0aRpIAJ
                                                  2⤵
                                                    PID:5272
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" e4b2d81c-86de-4107-89db-94815f47c88d "238085d9-1148-4979-a2a6-a458268d6830" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000M0aRpIAJ
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:2500
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" e4b2d81c-86de-4107-89db-94815f47c88d "6dadf4b5-3359-464b-944d-c02f1bf23e61" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000M0aRpIAJ
                                                    2⤵
                                                      PID:5140
                                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=078b1723cb1ceec2ffde8221e59327f7&rmm_session_pwd_ttl=86400"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5560
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" e4b2d81c-86de-4107-89db-94815f47c88d "0cae7839-4dcc-429e-aa55-4c83331d34cc" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000M0aRpIAJ
                                                      2⤵
                                                        PID:4344
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" e4b2d81c-86de-4107-89db-94815f47c88d "be83601f-331a-44a9-99b0-1666531e64c6" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000M0aRpIAJ
                                                        2⤵
                                                          PID:1572
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                            3⤵
                                                            • System Time Discovery
                                                            PID:5964
                                                            • C:\Program Files\dotnet\dotnet.exe
                                                              dotnet --list-runtimes
                                                              4⤵
                                                              • System Time Discovery
                                                              PID:536
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" e4b2d81c-86de-4107-89db-94815f47c88d "9f7cf9ce-1259-4c3a-b69c-bee54e40d9c5" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000M0aRpIAJ
                                                          2⤵
                                                            PID:6080
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" e4b2d81c-86de-4107-89db-94815f47c88d "224a919f-21da-4eef-a323-a06f4f2d5a58" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000M0aRpIAJ
                                                            2⤵
                                                              PID:5696
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" e4b2d81c-86de-4107-89db-94815f47c88d "880cedd1-536d-4a38-9980-278bfe4f11f0" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000M0aRpIAJ
                                                              2⤵
                                                              • Modifies registry class
                                                              PID:5720
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" e4b2d81c-86de-4107-89db-94815f47c88d "ed18aa53-c60f-478c-ba74-e9c2f322a4af" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000M0aRpIAJ
                                                              2⤵
                                                                PID:6044
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" e4b2d81c-86de-4107-89db-94815f47c88d "f5aa24e0-59c9-4167-b722-aac9acaf0723" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000M0aRpIAJ
                                                                2⤵
                                                                  PID:2728
                                                                  • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                    "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "e4b2d81c-86de-4107-89db-94815f47c88d" "f5aa24e0-59c9-4167-b722-aac9acaf0723" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000M0aRpIAJ"
                                                                    3⤵
                                                                      PID:3356
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                  1⤵
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:3604
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Checks SCSI registry key(s)
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2948
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000017C" "WinSta0\Default" "0000000000000150" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                    2⤵
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Checks SCSI registry key(s)
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2484
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000178"
                                                                    2⤵
                                                                    • Drops file in Drivers directory
                                                                    • Drops file in System32 directory
                                                                    • Checks SCSI registry key(s)
                                                                    PID:1028
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                    2⤵
                                                                    • Drops file in Drivers directory
                                                                    • Checks SCSI registry key(s)
                                                                    PID:5960

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Event Triggered Execution

                                                                2
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Installer Packages

                                                                1
                                                                T1546.016

                                                                Pre-OS Boot

                                                                1
                                                                T1542

                                                                Bootkit

                                                                1
                                                                T1542.003

                                                                Privilege Escalation

                                                                Event Triggered Execution

                                                                2
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Installer Packages

                                                                1
                                                                T1546.016

                                                                Defense Evasion

                                                                Modify Registry

                                                                1
                                                                T1112

                                                                Pre-OS Boot

                                                                1
                                                                T1542

                                                                Bootkit

                                                                1
                                                                T1542.003

                                                                Subvert Trust Controls

                                                                1
                                                                T1553

                                                                Install Root Certificate

                                                                1
                                                                T1553.004

                                                                System Binary Proxy Execution

                                                                1
                                                                T1218

                                                                Msiexec

                                                                1
                                                                T1218.007

                                                                Credential Access

                                                                Discovery

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Query Registry

                                                                4
                                                                T1012

                                                                System Information Discovery

                                                                3
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Config.Msi\e57b334.rbs
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  d5b6dd7bcce67e3c9cd4b09b044cf895

                                                                  SHA1

                                                                  99da19f007c18cc5705a6b31506d72ab00c51f94

                                                                  SHA256

                                                                  ab249731b25c26743dbe5a1485013cfb5a63e6959ceaf54825d344d681576d30

                                                                  SHA512

                                                                  ace0a9a33a30178ce5fa926d28b4d3091e777d647ef7ee0bc714866194c0a10131af02fb21ca5cf63b0fe23ec7b28cd988eefd066df61a891c191660f5fc42b0

                                                                  Download Submit

                                                                • C:\Config.Msi\e57b339.rbs
                                                                  Filesize

                                                                  74KB

                                                                  MD5

                                                                  eda48f579ab764eb180fbe7a8e33cebc

                                                                  SHA1

                                                                  463c0a87f36d3d032077c2aa0459cfd04a7e6cdc

                                                                  SHA256

                                                                  dcf71622b7d74c9efd076deb5758caa9e01012a929716be882a334122975edc1

                                                                  SHA512

                                                                  4190b6c8cc727c0ca4e6157886db8361e47dcabd77d5f0e142c492280f7338e95998d3d8f069adb5d4d4fbb16b8492f410d8090007f876ef2c1f6c580eb9f29b

                                                                  Download Submit

                                                                • C:\Config.Msi\e57b33b.rbs
                                                                  Filesize

                                                                  464B

                                                                  MD5

                                                                  01396d28e2a7e9b1c0a09c7856600bab

                                                                  SHA1

                                                                  261107e54fdf92e0c5ae1ba1a231530834c06e9f

                                                                  SHA256

                                                                  b50e84f38d38fa08536b70a1306da68bd2517849ab5891d13be27f9ce6ff880f

                                                                  SHA512

                                                                  4381fc584b5430e18fdb1c172eca024d224597da8788455526a618afe950b9c183e28f323cf065c3fac51c8f8852eed79de6550f5bcd7e6c0442f02f7d81831e

                                                                  Download Submit

                                                                • C:\Config.Msi\e57b341.rbs
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  9f2066967a388169d010eeafff4149c6

                                                                  SHA1

                                                                  7fdaa6919f704d48c0bc84b9e2e544721e943501

                                                                  SHA256

                                                                  66d3fd248d87f6beded03aae575afb28f236a8089e94419d08b1c64bab86c3d8

                                                                  SHA512

                                                                  f7a2f06402cf8c021c9bc18f1972ef141428a39d02d415ba57bb9d546060b89ccbaaab6cb9d6ce6b89b1c5b9bc51a6cae87e5e7f82f8a1448cc9258dfe98cc10

                                                                  Download Submit

                                                                • C:\Config.Msi\e57b349.rbs
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  923e70a749a34d09aeca63a45521edf2

                                                                  SHA1

                                                                  2a9b55519e93d1a572273b8559d69c028d65ca75

                                                                  SHA256

                                                                  40918e92b8bb87817c9556e23391509c684543e375cd3a3d8f4a5d7a8d65d919

                                                                  SHA512

                                                                  98d1f37b2f5cba7a03333f8decbf5d1f7f514f4b2185e39c46ea14a39a3adbccf0e4e02ec50895fdb9cc0954a594784931725b43c8fcbf14eb0f9f564e98b899

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  337079222a6f6c6edf58f3f981ff20ae

                                                                  SHA1

                                                                  1f705fc0faa84c69e1fe936b34783b301323e255

                                                                  SHA256

                                                                  ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                                  SHA512

                                                                  ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                  Filesize

                                                                  142KB

                                                                  MD5

                                                                  477293f80461713d51a98a24023d45e8

                                                                  SHA1

                                                                  e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                  SHA256

                                                                  a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                  SHA512

                                                                  23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  b3bb71f9bb4de4236c26578a8fae2dcd

                                                                  SHA1

                                                                  1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                  SHA256

                                                                  e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                  SHA512

                                                                  fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                  Filesize

                                                                  210KB

                                                                  MD5

                                                                  c106df1b5b43af3b937ace19d92b42f3

                                                                  SHA1

                                                                  7670fc4b6369e3fb705200050618acaa5213637f

                                                                  SHA256

                                                                  2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                  SHA512

                                                                  616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                  Filesize

                                                                  693KB

                                                                  MD5

                                                                  2c4d25b7fbd1adfd4471052fa482af72

                                                                  SHA1

                                                                  fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                  SHA256

                                                                  2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                  SHA512

                                                                  f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                  Filesize

                                                                  157KB

                                                                  MD5

                                                                  242d415e238789fbc57c5ac7e8ca5d02

                                                                  SHA1

                                                                  09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                                  SHA256

                                                                  7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                                  SHA512

                                                                  ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                  Filesize

                                                                  51KB

                                                                  MD5

                                                                  3180c705182447f4bcc7ce8e2820b25d

                                                                  SHA1

                                                                  ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                  SHA256

                                                                  5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                  SHA512

                                                                  228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  dc63026e80d2bb04f71e41916f807e33

                                                                  SHA1

                                                                  6cda386d2c365f94ea3de41e2390fd916622eb51

                                                                  SHA256

                                                                  3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                                  SHA512

                                                                  61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                  Filesize

                                                                  173KB

                                                                  MD5

                                                                  31def444e6135301ea3c38a985341837

                                                                  SHA1

                                                                  f135be75c721af2d5291cb463cbc22a32467084a

                                                                  SHA256

                                                                  36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                                  SHA512

                                                                  bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                  Filesize

                                                                  546B

                                                                  MD5

                                                                  158fb7d9323c6ce69d4fce11486a40a1

                                                                  SHA1

                                                                  29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                  SHA256

                                                                  5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                  SHA512

                                                                  7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                  Filesize

                                                                  94KB

                                                                  MD5

                                                                  9d8b5941ea5b905e8197a175ef2b15a9

                                                                  SHA1

                                                                  86a078e94b5578ec4125f50f78c8518a8ce1d086

                                                                  SHA256

                                                                  c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d

                                                                  SHA512

                                                                  fab5fe82873862ce8ed1a427482093cca307f6663e9f6497fdc244ce461312872d419ff274cdca0c496414c28681901f335c9911b95d2a7c112d30e32d74e498

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                  Filesize

                                                                  688KB

                                                                  MD5

                                                                  ba66874c510645c1fb5fe74f85b32e98

                                                                  SHA1

                                                                  e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                                  SHA256

                                                                  12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                                  SHA512

                                                                  44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                  Filesize

                                                                  27KB

                                                                  MD5

                                                                  797c9554ec56fd72ebb3f6f6bef67fb5

                                                                  SHA1

                                                                  40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                  SHA256

                                                                  7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                  SHA512

                                                                  4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                  Filesize

                                                                  214KB

                                                                  MD5

                                                                  01807774f043028ec29982a62fa75941

                                                                  SHA1

                                                                  afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                  SHA256

                                                                  9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                  SHA512

                                                                  33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                  Filesize

                                                                  37KB

                                                                  MD5

                                                                  efb4712c8713cb05eb7fe7d87a83a55a

                                                                  SHA1

                                                                  c94d106bba77aecf88540807da89349b50ea5ae7

                                                                  SHA256

                                                                  30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                  SHA512

                                                                  3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                  Filesize

                                                                  3.4MB

                                                                  MD5

                                                                  e010d1f614b1a830482d3df4ba056f24

                                                                  SHA1

                                                                  5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                  SHA256

                                                                  98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                  SHA512

                                                                  727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                  Filesize

                                                                  389KB

                                                                  MD5

                                                                  5e3252e0248b484e76fcdbf8b42a645d

                                                                  SHA1

                                                                  11ae92fd16ac87f6ab755911e85e263253c16516

                                                                  SHA256

                                                                  01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                  SHA512

                                                                  540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  903842ecf9075ecfb8705ff8b489773b

                                                                  SHA1

                                                                  37f81933d50399ff9291f4e46937074a59e86741

                                                                  SHA256

                                                                  8627281a85d9856cbe8dfbe44fb95ea03c0d51d220565ad7f444aa9cdae71ce7

                                                                  SHA512

                                                                  ec7a61eff48b39f792cc6317be47e44ea36d3cbc8284d366f607de0368a0ef6a1371e2186a39c45298631f9189e095bbfacb19b1ed8fa19f860ad57f860ce107

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                  Filesize

                                                                  196KB

                                                                  MD5

                                                                  5f782d0cb0f717ae9dfd1b4da1295f15

                                                                  SHA1

                                                                  b33575e428e19940f0585c747e054ca70a12d454

                                                                  SHA256

                                                                  0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                                  SHA512

                                                                  e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                  Filesize

                                                                  55KB

                                                                  MD5

                                                                  a739b889642ca9ce4ad3a37a3c521604

                                                                  SHA1

                                                                  18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                                  SHA256

                                                                  44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                                  SHA512

                                                                  92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  9d1528a2ce17522f6de064ae2c2b608e

                                                                  SHA1

                                                                  2f1ce8b589e57ab300bb93dde176689689f75114

                                                                  SHA256

                                                                  11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                  SHA512

                                                                  a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5844.update
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  14ffcf07375b3952bd3f2fe52bb63c14

                                                                  SHA1

                                                                  ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                  SHA256

                                                                  6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                  SHA512

                                                                  14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  56090beeb8cb57fe48668af61750522b

                                                                  SHA1

                                                                  e615e09da442277898a94fe5ad1b556c72719c92

                                                                  SHA256

                                                                  61cd92fe339aa5237c7925b0714702f64e5663c6b1747669f2fcfa1420e18830

                                                                  SHA512

                                                                  9007c5c68801f07062788eb947d8aa90320134ab0fe760462d18d6ab862642ca8b66b071b42d4ecd9303b7bbd761a91754febc27acc0d49886a245c9fc737d65

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                  Filesize

                                                                  2B

                                                                  MD5

                                                                  81051bcc2cf1bedf378224b0a93e2877

                                                                  SHA1

                                                                  ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                  SHA256

                                                                  7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                  SHA512

                                                                  1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                  Filesize

                                                                  54KB

                                                                  MD5

                                                                  77c613ffadf1f4b2f50d31eeec83af30

                                                                  SHA1

                                                                  76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                  SHA256

                                                                  2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                  SHA512

                                                                  29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                  Filesize

                                                                  334KB

                                                                  MD5

                                                                  b3e14504a48bed32c53ec7aab2cb2c8f

                                                                  SHA1

                                                                  0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                                  SHA256

                                                                  adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                                  SHA512

                                                                  e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                  Filesize

                                                                  72KB

                                                                  MD5

                                                                  749c51599fbf82422791e0df1c1e841c

                                                                  SHA1

                                                                  bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                                  SHA256

                                                                  c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                                  SHA512

                                                                  f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                  Filesize

                                                                  50KB

                                                                  MD5

                                                                  c0f02eaa3eb28659d8f1bcba8de48479

                                                                  SHA1

                                                                  5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                                  SHA256

                                                                  6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                                  SHA512

                                                                  47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                  Filesize

                                                                  32KB

                                                                  MD5

                                                                  f531d3157e9ff57eea92db36c40e283e

                                                                  SHA1

                                                                  d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                                  SHA256

                                                                  30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                                  SHA512

                                                                  27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                  Filesize

                                                                  54KB

                                                                  MD5

                                                                  d11b2139d29e79d795054c3866898b7f

                                                                  SHA1

                                                                  020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                                  SHA256

                                                                  11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                                  SHA512

                                                                  de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                  Filesize

                                                                  588KB

                                                                  MD5

                                                                  17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                  SHA1

                                                                  bc0316e11c119806907c058d62513eb8ce32288c

                                                                  SHA256

                                                                  13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                  SHA512

                                                                  f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                  Download Submit

                                                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                  Filesize

                                                                  217B

                                                                  MD5

                                                                  a8a58b0bd6cd323540477c1e81f83a45

                                                                  SHA1

                                                                  32ff937edbff5fb269425f446e47878b47425c20

                                                                  SHA256

                                                                  a57097c2cb6be110a7cdef2014fd19c7ea1e56313a94763707571938fb4df8d1

                                                                  SHA512

                                                                  d7751b45e7d619dd6be6db04cf96ce92055b4d58281d2f0d890455c48dd7836bff64be292d3c53fd1e93c4232ea81b0f723fa7893f1a25db1c8145fbd9542f0c

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  1ef7574bc4d8b6034935d99ad884f15b

                                                                  SHA1

                                                                  110709ab33f893737f4b0567f9495ac60c37667c

                                                                  SHA256

                                                                  0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                  SHA512

                                                                  947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  f512536173e386121b3ebd22aac41a4e

                                                                  SHA1

                                                                  74ae133215345beaebb7a95f969f34a40dda922a

                                                                  SHA256

                                                                  a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                  SHA512

                                                                  1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                  Filesize

                                                                  76KB

                                                                  MD5

                                                                  b40fe65431b18a52e6452279b88954af

                                                                  SHA1

                                                                  c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                  SHA256

                                                                  800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                  SHA512

                                                                  e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                  Download Submit

                                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                  Filesize

                                                                  80KB

                                                                  MD5

                                                                  3904d0698962e09da946046020cbcb17

                                                                  SHA1

                                                                  edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                  SHA256

                                                                  a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                  SHA512

                                                                  c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                  Filesize

                                                                  287B

                                                                  MD5

                                                                  fcad4da5d24f95ebf38031673ddbcdb8

                                                                  SHA1

                                                                  3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                                  SHA256

                                                                  7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                                  SHA512

                                                                  1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                  Filesize

                                                                  717B

                                                                  MD5

                                                                  ef0a07aec4367a64c16c581da2657aa9

                                                                  SHA1

                                                                  13011a5abcbadb3424fb6ecee560665556bb1d24

                                                                  SHA256

                                                                  f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                                  SHA512

                                                                  35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  362ce475f5d1e84641bad999c16727a0

                                                                  SHA1

                                                                  6b613c73acb58d259c6379bd820cca6f785cc812

                                                                  SHA256

                                                                  1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                  SHA512

                                                                  7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                  Filesize

                                                                  1.9MB

                                                                  MD5

                                                                  8de5a7a19d882820893d8b911c1710fb

                                                                  SHA1

                                                                  95cdf5855bc5e454c8944952697ab142f77124f7

                                                                  SHA256

                                                                  2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                                  SHA512

                                                                  3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  9a9b1fd85b5f1dcd568a521399a0d057

                                                                  SHA1

                                                                  34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                  SHA256

                                                                  88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                  SHA512

                                                                  7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                  Filesize

                                                                  375KB

                                                                  MD5

                                                                  3c93b399b417b0d6a232d386e65a8b46

                                                                  SHA1

                                                                  bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                                  SHA256

                                                                  29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                                  SHA512

                                                                  a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                  Filesize

                                                                  321KB

                                                                  MD5

                                                                  d3901e62166e9c42864fe3062cb4d8d5

                                                                  SHA1

                                                                  c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                  SHA256

                                                                  dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                  SHA512

                                                                  ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                  Filesize

                                                                  814KB

                                                                  MD5

                                                                  9b1f97a41bfb95f148868b49460d9d04

                                                                  SHA1

                                                                  768031d5e877e347a249dfdeab7c725df941324b

                                                                  SHA256

                                                                  09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                  SHA512

                                                                  9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                  Filesize

                                                                  1.2MB

                                                                  MD5

                                                                  e74d2a16da1ddb7f9c54f72b8a25897c

                                                                  SHA1

                                                                  32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                  SHA256

                                                                  a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                  SHA512

                                                                  52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                  Filesize

                                                                  11B

                                                                  MD5

                                                                  5eda46a55c61b07029e7202f8cf1781c

                                                                  SHA1

                                                                  862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                  SHA256

                                                                  12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                  SHA512

                                                                  4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                                  SHA1

                                                                  93012724e6cc0a298838aede678806e6c0c6517d

                                                                  SHA256

                                                                  a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                                  SHA512

                                                                  890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  4a35efe8ffce2eabd974471546d9d577

                                                                  SHA1

                                                                  1ee3163fae860e8be156ed3673e4b0189c8b097c

                                                                  SHA256

                                                                  6b4b53d8f9fca54b407e910f916ed8f3cfc840199f2b52e90c0b8d67fd356204

                                                                  SHA512

                                                                  6fba60c2730aa7bf642eb53dd7a4d354556722d15ba34eedf1e90dd079c52e41b53eee134362f5bbba059dc7fbffa3b05405e8bf441547783618d233e24bec44

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                  Filesize

                                                                  48KB

                                                                  MD5

                                                                  a5a65fa5a45aaae8d46c292de91eed53

                                                                  SHA1

                                                                  70eea3b626eacdbd45354fe7ab32a15547876975

                                                                  SHA256

                                                                  6e111a41eddccdcd1a89ab3ccaa32b7f984b196af09a11d6f925b7c82c2080e4

                                                                  SHA512

                                                                  2b06d83f3dfd68cc164d3c1f8e658b78e06276a8ccd2bb70e1216e7d0fe82184dbab1c3ed9485b2b814a434d4612f757502f68d1059c687735c012f5f1b1c580

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                  Filesize

                                                                  2.8MB

                                                                  MD5

                                                                  91453d3e1e2bc9586cf5495073fb3cf7

                                                                  SHA1

                                                                  09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                                  SHA256

                                                                  5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                                  SHA512

                                                                  462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  384d6da5c34ff401b18f0af41e3a2643

                                                                  SHA1

                                                                  3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                                  SHA256

                                                                  0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                                  SHA512

                                                                  5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  6c6f85e896655a6eb726482f04c49086

                                                                  SHA1

                                                                  2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                  SHA256

                                                                  e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                  SHA512

                                                                  b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                  Filesize

                                                                  541B

                                                                  MD5

                                                                  d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                  SHA1

                                                                  e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                  SHA256

                                                                  7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                  SHA512

                                                                  a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                                  Filesize

                                                                  12B

                                                                  MD5

                                                                  3d66ae5ed06891e8ce75a39a24070844

                                                                  SHA1

                                                                  368064119835d4376727a14706c41384446183e8

                                                                  SHA256

                                                                  73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                                  SHA512

                                                                  c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                  Filesize

                                                                  646KB

                                                                  MD5

                                                                  7895698867d1ad33934a8553b4806dc5

                                                                  SHA1

                                                                  32704df55deaff9bf0b4ee0b887541856578938b

                                                                  SHA256

                                                                  ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                                  SHA512

                                                                  20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                  Filesize

                                                                  3.1MB

                                                                  MD5

                                                                  85e1898362165fc1315d18abb73c1b37

                                                                  SHA1

                                                                  289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                                  SHA256

                                                                  d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                                  SHA512

                                                                  49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                                  Download Submit

                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                  Filesize

                                                                  569KB

                                                                  MD5

                                                                  9614d1da18956de06747c03068208d66

                                                                  SHA1

                                                                  fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                                  SHA256

                                                                  dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                                  SHA512

                                                                  d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                                  Download Submit

                                                                • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\81dd384c72737e4802046c4632697033
                                                                  Filesize

                                                                  16KB

                                                                  MD5

                                                                  b2e89027a140a89b6e3eb4e504e93d96

                                                                  SHA1

                                                                  f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                  SHA256

                                                                  5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                  SHA512

                                                                  93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                  Download Submit

                                                                • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                  Filesize

                                                                  809B

                                                                  MD5

                                                                  8b6737800745d3b99886d013b3392ac3

                                                                  SHA1

                                                                  bb94da3f294922d9e8d31879f2d145586a182e19

                                                                  SHA256

                                                                  86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                  SHA512

                                                                  654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                  Download Submit

                                                                • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  a219070502fe0a2cf7aa5a4c32303248

                                                                  SHA1

                                                                  618bc6ad4891789a7f0caa9dc956bdcfad8ab7c8

                                                                  SHA256

                                                                  9ec8770f08f264d87fd35a926b2069bba24ec361b12edf32ba1f8d12111e6bf0

                                                                  SHA512

                                                                  6d08100185e7c1e99314a55652c9c35da6ec18f53e00d203f2f28a1f95578ae2df1a40acc0ceb2201f1a189c74596034afb438bb9d5302e978a2429dfddd4ecf

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                  Filesize

                                                                  471B

                                                                  MD5

                                                                  6ae5c21035bf5034cb63fb2e785d758c

                                                                  SHA1

                                                                  d4aed3aa8626d0dc49b7fe9b6073cd1773ad8ceb

                                                                  SHA256

                                                                  251eb310eb807b47bd4093a3170aea35c155fa78e500baa6ca4e2cdeaf0166ff

                                                                  SHA512

                                                                  cd9f90caca712dd3d4392e319e70ce10971335aba9a670cf631aae1b6f86abe8c58de4bd3a845af0cc4f3c0bb7b0422b405f5c6cd0bfef38f419eaf4eaacf131

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                  Filesize

                                                                  727B

                                                                  MD5

                                                                  dda7e1956de2ae2d4bd35bc0704a2154

                                                                  SHA1

                                                                  4cee45a879ef15cc7379292df4ea20275549dc30

                                                                  SHA256

                                                                  f65b87c1bc3b0930729a647c8078a7c5f6ea0fbc8272ad75740167069ccd6fc7

                                                                  SHA512

                                                                  49427b506f07c4425fa87e2406048341b07b47ba16ab1eb302684c9436fadc1746ca418a8d021b6bdd2f699906e33929986327643fb59ed5fb287af818d757e0

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  Filesize

                                                                  727B

                                                                  MD5

                                                                  85e4ef53daf9d74a4f483e3575e0182e

                                                                  SHA1

                                                                  706b05f30e9ca50caa4d2ab06eebde684094f9f8

                                                                  SHA256

                                                                  a155eddd3fefeb549e9a57df0fe3910f7f66cf43e310dc81fc4a59e2e9529af4

                                                                  SHA512

                                                                  69e9854a575ce93964777b31caea6167a4291c57482bd342731bb02f04be93450694a75c7ba019ead54f38f25dfb96263111ba33a1db57f77e25cf8ee681f007

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                  Filesize

                                                                  400B

                                                                  MD5

                                                                  5446ed1f61684d02a2be0a7effbc94e6

                                                                  SHA1

                                                                  2024a3bcce76aaa5c76e1070e1edd82e48e53dbc

                                                                  SHA256

                                                                  51eb43f91454603a0c1098c36cd1c2f47171a4ba3b242e33e1579314e72bedc9

                                                                  SHA512

                                                                  fb25feb56f4ea102f5949c69d745ba536d91bed97c517bd1ad2521f2503592f53079e78ae2ece9eae12b6d219620cc6863da8914136083828f1847a24b4a4cc6

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                  Filesize

                                                                  404B

                                                                  MD5

                                                                  55a20f591906a25776b9919add4822aa

                                                                  SHA1

                                                                  bf0e2562004037480351388238d84e7d388a36f7

                                                                  SHA256

                                                                  965a555a0ec7412dc5e70cadbe679565c85a98f45c9440c10902c45a41b17327

                                                                  SHA512

                                                                  29efdc00ee104d86ff9c3b8d284ce0ad51b80643316c1f97b3c11593c1a569d24a67db8824017c531d2184001c99a6ed3ec9e2101e286f79413b5790aecebb9f

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  Filesize

                                                                  412B

                                                                  MD5

                                                                  ae5d011d4f90ee88e160ba91ab4d2679

                                                                  SHA1

                                                                  451ddd4a5b0b33eef26524c72ef5b60f14807485

                                                                  SHA256

                                                                  df7a5ee737d6648f5938639026ffdb079bca394d4f24bda69b55f03ec3cbb9c0

                                                                  SHA512

                                                                  e2351eb1c4521f372b12ec0effd754251300956b71b7800b9de19aaaa6e812435d88a991dd6a2c912c33c19d02efb91bedf3eea175fa3f2e3e0805bc01dc26e9

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                  Filesize

                                                                  651B

                                                                  MD5

                                                                  9bbfe11735bac43a2ed1be18d0655fe2

                                                                  SHA1

                                                                  61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                  SHA256

                                                                  549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                  SHA512

                                                                  a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSI17C7.tmp
                                                                  Filesize

                                                                  4.5MB

                                                                  MD5

                                                                  2207f96731ce2f9d9327c0baaf4959ef

                                                                  SHA1

                                                                  f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                                  SHA256

                                                                  e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                                  SHA512

                                                                  7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSI6D6D.tmp-\System.Management.dll
                                                                  Filesize

                                                                  60KB

                                                                  MD5

                                                                  878e361c41c05c0519bfc72c7d6e141c

                                                                  SHA1

                                                                  432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                  SHA256

                                                                  24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                  SHA512

                                                                  59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIB3B0.tmp
                                                                  Filesize

                                                                  509KB

                                                                  MD5

                                                                  88d29734f37bdcffd202eafcdd082f9d

                                                                  SHA1

                                                                  823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                  SHA256

                                                                  87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                  SHA512

                                                                  1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIB3B0.tmp-\AlphaControlAgentInstallation.dll
                                                                  Filesize

                                                                  25KB

                                                                  MD5

                                                                  aa1b9c5c685173fad2dabebeb3171f01

                                                                  SHA1

                                                                  ed756b1760e563ce888276ff248c734b7dd851fb

                                                                  SHA256

                                                                  e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                  SHA512

                                                                  d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIB3B0.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                  Filesize

                                                                  179KB

                                                                  MD5

                                                                  1a5caea6734fdd07caa514c3f3fb75da

                                                                  SHA1

                                                                  f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                  SHA256

                                                                  cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                  SHA512

                                                                  a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIB71C.tmp-\CustomAction.config
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  bc17e956cde8dd5425f2b2a68ed919f8

                                                                  SHA1

                                                                  5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                  SHA256

                                                                  e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                  SHA512

                                                                  02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIB71C.tmp-\Newtonsoft.Json.dll
                                                                  Filesize

                                                                  695KB

                                                                  MD5

                                                                  715a1fbee4665e99e859eda667fe8034

                                                                  SHA1

                                                                  e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                  SHA256

                                                                  c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                  SHA512

                                                                  bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                  Download Submit

                                                                • C:\Windows\Installer\MSIBD1A.tmp
                                                                  Filesize

                                                                  211KB

                                                                  MD5

                                                                  a3ae5d86ecf38db9427359ea37a5f646

                                                                  SHA1

                                                                  eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                  SHA256

                                                                  c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                  SHA512

                                                                  96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                  Download Submit

                                                                • C:\Windows\Installer\e57b333.msi
                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  ac205cf1390f2a927596658f0e176321

                                                                  SHA1

                                                                  c7b5046e057468f89b3b48d2d5a48e88f1b0f589

                                                                  SHA256

                                                                  809e309bf2d7fb660417d229456e24de896161538cd506e49677259c57e50fc4

                                                                  SHA512

                                                                  f6495397e23e05500abb91733d188a366a1db5149c099584b04a75a6d7459638d882f74d93f7855c0007a202fe3d0b35124b62453ad0aefbcef401914cc0ad1f

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{18bfb6c3-c2ef-5643-8273-ff8f73c51c03}\lci_proxywddm.cat
                                                                  Filesize

                                                                  12KB

                                                                  MD5

                                                                  8e16d54f986dbe98812fd5ec04d434e8

                                                                  SHA1

                                                                  8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                  SHA256

                                                                  7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                  SHA512

                                                                  e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{18bfb6c3-c2ef-5643-8273-ff8f73c51c03}\lci_proxywddm.inf
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  0315a579f5afe989154cb7c6a6376b05

                                                                  SHA1

                                                                  e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                  SHA256

                                                                  d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                  SHA512

                                                                  c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{18bfb6c3-c2ef-5643-8273-ff8f73c51c03}\x64\lci_proxyumd.dll
                                                                  Filesize

                                                                  179KB

                                                                  MD5

                                                                  4dc11547a5fc28ca8f6965fa21573481

                                                                  SHA1

                                                                  d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                  SHA256

                                                                  e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                  SHA512

                                                                  bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{18bfb6c3-c2ef-5643-8273-ff8f73c51c03}\x64\lci_proxyumd32.dll
                                                                  Filesize

                                                                  135KB

                                                                  MD5

                                                                  67ae7b2c36c9c70086b9d41b4515b0a8

                                                                  SHA1

                                                                  ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                  SHA256

                                                                  79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                  SHA512

                                                                  4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{18bfb6c3-c2ef-5643-8273-ff8f73c51c03}\x64\lci_proxywddm.sys
                                                                  Filesize

                                                                  119KB

                                                                  MD5

                                                                  b9b0e9b4d93b18b99ece31a819d71d00

                                                                  SHA1

                                                                  2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                  SHA256

                                                                  0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                  SHA512

                                                                  465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{a4f4156d-30f0-f542-b67b-fc51e3c42e43}\lci_iddcx.cat
                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  62458e58313475c9a3642a392363e359

                                                                  SHA1

                                                                  e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                  SHA256

                                                                  85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                  SHA512

                                                                  49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{a4f4156d-30f0-f542-b67b-fc51e3c42e43}\lci_iddcx.inf
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  1cec22ca85e1b5a8615774fca59a420b

                                                                  SHA1

                                                                  049a651751ef38321a1088af6a47c4380f9293fc

                                                                  SHA256

                                                                  60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                  SHA512

                                                                  0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                  Download Submit

                                                                • C:\Windows\System32\DriverStore\Temp\{a4f4156d-30f0-f542-b67b-fc51e3c42e43}\x64\lci_iddcx.dll
                                                                  Filesize

                                                                  52KB

                                                                  MD5

                                                                  01e8bc64139d6b74467330b11331858d

                                                                  SHA1

                                                                  b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                  SHA256

                                                                  148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                  SHA512

                                                                  4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                  Download Submit

                                                                • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-19-17-43.dat
                                                                  Filesize

                                                                  602B

                                                                  MD5

                                                                  d7699b3de883e99688d2b40db6f1068b

                                                                  SHA1

                                                                  71fa48c90cd6e939e1d6f21a4fa204a9ab669823

                                                                  SHA256

                                                                  9954b7bb4c60be6d59f12a653a17aa0d2961085ae1861eb1de0f8151d57942a4

                                                                  SHA512

                                                                  e334affbf240c86933c7d9170476fd7bcaa3c2bc911a53ebda28fa97ae10f8e609e347177206688ef79939836adfa5f8fc13c040885c7f2a8a9d00a5f09222f1

                                                                  Download Submit

                                                                • C:\Windows\Temp\InstallUtil.log
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  d5a2e43c19873585fade6dda450f2177

                                                                  SHA1

                                                                  c7cf7761e14bd1d6a1a333405bed53f4cf33b44c

                                                                  SHA256

                                                                  b6bfda7ac528fc1dbfccf5f80bfeafaf03c9419539666f31bdaf02901ed3513d

                                                                  SHA512

                                                                  b099b23a6de26c88d0df7ba4a2064f845d5fbf61928c8c0cef012fbf539cc6c38f35c0cfec34b2c0f25085dc2ca7f385046d26c6ff691172d7394e4d307eeda4

                                                                  Download Submit

                                                                • C:\Windows\Temp\PreVer.log
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  ec3ace3b4491b7ab83f3d27421534174

                                                                  SHA1

                                                                  b0525e7f4eac5f8668b62674874ad432d8670700

                                                                  SHA256

                                                                  56831924c738be30df1e9404e14de17216af04fcbe0a9ffd24a160011e5f66d5

                                                                  SHA512

                                                                  84bf35892864d7a1564bd6ca9852f123787474a0f0a279a51269a0c5c72463c751be1380181c055efec67adaa33387c0aa3076d88c9602b405f005a85795a88d

                                                                  Download Submit

                                                                • C:\Windows\Temp\unpack.log
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  d7c7c02c15b75557da98d409b4c2198a

                                                                  SHA1

                                                                  1bd8cf1080ad0ca5d4bf9183415486a992b49031

                                                                  SHA256

                                                                  96dd3494f605b667b469e50220113fd1c640f259604ffee8e3ef241f4174da54

                                                                  SHA512

                                                                  7a2ae6ffdf9212fd42b0340581d25c41795b31992ce1105c4442598a77aa9c1b80475484fabddd0ea27cac1a58b4e5d257f14c7c9ba673b38fbbe116fd1dcc91

                                                                  Download Submit

                                                                • C:\Windows\Temp\unpack.log
                                                                  Filesize

                                                                  4KB

                                                                  MD5

                                                                  291df720c995da2dc11cdce031171f1c

                                                                  SHA1

                                                                  e1fa49cbc386b6541577979ecdaf9f51d9835df3

                                                                  SHA256

                                                                  0ae5d9b877f11e4b55a3448d4a15cf246351265a8482d08a300f77466c64ae4f

                                                                  SHA512

                                                                  d7e3153362d471c8f4b96d0a876bdeb1415cb7805251581db079c78ad112e5237d38ecd104ace6e4a6c2c7f693844f5353defa1025dbf9edc7291a29d04399e7

                                                                  Download Submit

                                                                • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                  Filesize

                                                                  3.2MB

                                                                  MD5

                                                                  a7ce785b6cd1c9657040ca9b6cbeed10

                                                                  SHA1

                                                                  4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                                  SHA256

                                                                  7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                                  SHA512

                                                                  39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                                  Download Submit

                                                                • C:\Windows\Temp\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\IsConfig.ini
                                                                  Filesize

                                                                  571B

                                                                  MD5

                                                                  38370175ce7d8dd5c3581030a9104259

                                                                  SHA1

                                                                  bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                                  SHA256

                                                                  ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                                  SHA512

                                                                  e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                                  Download Submit

                                                                • C:\Windows\Temp\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\String1033.txt
                                                                  Filesize

                                                                  182KB

                                                                  MD5

                                                                  37a2c4ef0ff41955f1cb884b7790699f

                                                                  SHA1

                                                                  8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                                  SHA256

                                                                  6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                                  SHA512

                                                                  fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                                  Download Submit

                                                                • C:\Windows\Temp\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\_is962.exe
                                                                  Filesize

                                                                  179KB

                                                                  MD5

                                                                  7a1c100df8065815dc34c05abc0c13de

                                                                  SHA1

                                                                  3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                  SHA256

                                                                  e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                  SHA512

                                                                  bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                  Download Submit

                                                                • C:\Windows\Temp\{D26E4C1C-8F23-4B9C-9760-EBC6835D3A01}\setup.inx
                                                                  Filesize

                                                                  345KB

                                                                  MD5

                                                                  0376dd5b7e37985ea50e693dc212094c

                                                                  SHA1

                                                                  02859394164c33924907b85ab0aaddc628c31bf1

                                                                  SHA256

                                                                  c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                  SHA512

                                                                  69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                  Download Submit

                                                                • C:\Windows\Temp\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\ISRT.dll
                                                                  Filesize

                                                                  427KB

                                                                  MD5

                                                                  85315ad538fa5af8162f1cd2fce1c99d

                                                                  SHA1

                                                                  31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                  SHA256

                                                                  70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                  SHA512

                                                                  877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                  Download Submit

                                                                • C:\Windows\Temp\{F1F54B4A-2C77-40AD-8062-AC5E915C6AD4}\_isres_0x0409.dll
                                                                  Filesize

                                                                  1.8MB

                                                                  MD5

                                                                  befe2ef369d12f83c72c5f2f7069dd87

                                                                  SHA1

                                                                  b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                  SHA256

                                                                  9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                  SHA512

                                                                  760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                  Download Submit

                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                  Filesize

                                                                  404B

                                                                  MD5

                                                                  7c1083e2c9680d9619da304217b5832a

                                                                  SHA1

                                                                  4b4a3d643b5ffe534a07e03d1cfb4cc09b03bef2

                                                                  SHA256

                                                                  4176173c28219111ffb0fe8e048abec6a122b21477f5a616366da627356df658

                                                                  SHA512

                                                                  bbc548f4ff30d272d5779c2dd28c4bccf8bd9390e1a532d737c6141529fb7917ea7e822b4819422ac177c1079e37bb4fe6ad5575dd2a330db52a0481c1c2c305

                                                                  Download Submit

                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                  Filesize

                                                                  412B

                                                                  MD5

                                                                  63744c0ac22e919f71d9682e9fc1d326

                                                                  SHA1

                                                                  fbb8bb6eae17cbbb5ce5a8597264191a4c688800

                                                                  SHA256

                                                                  c4968eb3850ea6ea091baeb17c87ad128837adac77b83bca475c6ac1282b2364

                                                                  SHA512

                                                                  bf9d85bc9925908ca5fdcf404449932b2bddc4dd02dc8076c59e4dc48730757e121e416b55a771ef24db9e428f5e414140e3169fb277f6c8223e6b24f6695ec0

                                                                  Download Submit

                                                                • memory/508-110-0x0000000005200000-0x0000000005266000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/1372-39-0x0000000004F30000-0x0000000004F5E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1372-43-0x0000000004F10000-0x0000000004F1C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/1444-148-0x0000020A2D2F0000-0x0000020A2D318000-memory.dmp

                                                                  Filesize

                                                                  160KB

                                                                  Download

                                                                • memory/1444-165-0x0000020A2EF00000-0x0000020A2EF3C000-memory.dmp

                                                                  Filesize

                                                                  240KB

                                                                  Download

                                                                • memory/1444-164-0x0000020A2D6F0000-0x0000020A2D702000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/1444-160-0x0000020A47900000-0x0000020A47998000-memory.dmp

                                                                  Filesize

                                                                  608KB

                                                                  Download

                                                                • memory/1968-1133-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1968-1260-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1968-1797-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1968-1796-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1968-2169-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1968-2170-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/1968-1132-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/1968-1259-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/2372-1768-0x0000029A60B90000-0x0000029A60BAC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/2372-1760-0x0000029A606F0000-0x0000029A606FC000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/2372-1761-0x0000029A610D0000-0x0000029A6111A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/2372-1801-0x0000029A79A50000-0x0000029A79B00000-memory.dmp

                                                                  Filesize

                                                                  704KB

                                                                  Download

                                                                • memory/3084-76-0x0000000005460000-0x0000000005512000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/3084-80-0x0000000005520000-0x0000000005874000-memory.dmp

                                                                  Filesize

                                                                  3.3MB

                                                                  Download

                                                                • memory/3084-79-0x00000000053F0000-0x0000000005412000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/3248-3265-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3248-2365-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/3248-1146-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/3248-2364-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3248-3266-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/3248-1148-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3248-1799-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/3368-476-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3368-987-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3368-903-0x00000000038C0000-0x0000000003A87000-memory.dmp

                                                                  Filesize

                                                                  1.8MB

                                                                  Download

                                                                • memory/3368-900-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3368-512-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3368-1079-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/3368-479-0x0000000003880000-0x0000000003A47000-memory.dmp

                                                                  Filesize

                                                                  1.8MB

                                                                  Download

                                                                • memory/3520-272-0x000001820F350000-0x000001820F380000-memory.dmp

                                                                  Filesize

                                                                  192KB

                                                                  Download

                                                                • memory/3520-277-0x000001820FBC0000-0x000001820FBDC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/3520-275-0x000001820FDB0000-0x000001820FE60000-memory.dmp

                                                                  Filesize

                                                                  704KB

                                                                  Download

                                                                • memory/3852-1800-0x0000025EDC530000-0x0000025EDC60C000-memory.dmp

                                                                  Filesize

                                                                  880KB

                                                                  Download

                                                                • memory/3852-1793-0x0000025EDC390000-0x0000025EDC442000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/3852-1767-0x0000025EDC120000-0x0000025EDC16A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/3852-1759-0x0000025EC3050000-0x0000025EC3062000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/3852-1778-0x0000025EC39A0000-0x0000025EC39BC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/3964-353-0x000001437C430000-0x000001437C4E2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/3964-366-0x000001437D0F0000-0x000001437D12A000-memory.dmp

                                                                  Filesize

                                                                  232KB

                                                                  Download

                                                                • memory/3964-359-0x000001437C270000-0x000001437C29A000-memory.dmp

                                                                  Filesize

                                                                  168KB

                                                                  Download

                                                                • memory/3964-367-0x000001437C2A0000-0x000001437C2C6000-memory.dmp

                                                                  Filesize

                                                                  152KB

                                                                  Download

                                                                • memory/3964-356-0x000001437C100000-0x000001437C108000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/3964-355-0x000001437C0F0000-0x000001437C0F8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/3964-354-0x000001437C0E0000-0x000001437C0E8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/3964-357-0x000001437C2E0000-0x000001437C348000-memory.dmp

                                                                  Filesize

                                                                  416KB

                                                                  Download

                                                                • memory/3964-351-0x000001437C350000-0x000001437C42C000-memory.dmp

                                                                  Filesize

                                                                  880KB

                                                                  Download

                                                                • memory/3964-346-0x000001437C060000-0x000001437C0A8000-memory.dmp

                                                                  Filesize

                                                                  288KB

                                                                  Download

                                                                • memory/3964-343-0x0000014363300000-0x000001436334A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/3964-347-0x00000143632C0000-0x00000143632C8000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/3964-345-0x000001437C010000-0x000001437C05C000-memory.dmp

                                                                  Filesize

                                                                  304KB

                                                                  Download

                                                                • memory/3964-348-0x00000143632F0000-0x00000143632FA000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/3964-344-0x00000143632D0000-0x00000143632EC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/3964-342-0x0000014362EA0000-0x0000014362F04000-memory.dmp

                                                                  Filesize

                                                                  400KB

                                                                  Download

                                                                • memory/4140-1775-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4140-1144-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4140-1145-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/4140-1798-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/4140-1819-0x0000000072810000-0x000000007292C000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                  Download

                                                                • memory/4140-1820-0x0000000072440000-0x000000007280D000-memory.dmp

                                                                  Filesize

                                                                  3.8MB

                                                                  Download

                                                                • memory/4764-300-0x000002BEEFEA0000-0x000002BEEFEB6000-memory.dmp

                                                                  Filesize

                                                                  88KB

                                                                  Download

                                                                • memory/4764-302-0x000002BEF0810000-0x000002BEF082C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/4764-301-0x000002BEF1010000-0x000002BEF10C2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/4960-1257-0x000002AB8FC30000-0x000002AB8FC42000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/4960-1258-0x000002AB90580000-0x000002AB9059C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/4960-1265-0x000002AB90670000-0x000002AB90722000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/4960-1776-0x000002AB90730000-0x000002AB90784000-memory.dmp

                                                                  Filesize

                                                                  336KB

                                                                  Download

                                                                • memory/5116-195-0x000001E371D90000-0x000001E371E42000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5116-241-0x000001E372290000-0x000001E3722C8000-memory.dmp

                                                                  Filesize

                                                                  224KB

                                                                  Download

                                                                • memory/5116-205-0x000001E371CD0000-0x000001E371CF2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/5540-1771-0x00000214E7400000-0x00000214E7466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/5540-1762-0x00000214E6B00000-0x00000214E6B10000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/5540-1772-0x00000214E6ED0000-0x00000214E6EE4000-memory.dmp

                                                                  Filesize

                                                                  80KB

                                                                  Download

                                                                • memory/5540-1766-0x00000214FFD40000-0x00000214FFDF2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5540-1765-0x00000214E6EB0000-0x00000214E6ED0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/5728-1770-0x0000027F07200000-0x0000027F07220000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/5728-1747-0x0000027F06880000-0x0000027F0688C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                  Download

                                                                • memory/5728-1755-0x0000027F071E0000-0x0000027F071F8000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                  Download

                                                                • memory/5728-1757-0x0000027F1FA20000-0x0000027F1FAD2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5784-1785-0x0000020E7B8E0000-0x0000020E7B9BC000-memory.dmp

                                                                  Filesize

                                                                  880KB

                                                                  Download

                                                                • memory/5784-1783-0x0000020E62E10000-0x0000020E62E2C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/5784-1781-0x0000020E625E0000-0x0000020E625F0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/5784-1782-0x0000020E7B6B0000-0x0000020E7B6FA000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/5784-1794-0x0000020E7B9C0000-0x0000020E7BA72000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/5844-1756-0x000001BBF2660000-0x000001BBF2670000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/5844-1764-0x000001BBF2AE0000-0x000001BBF2AF0000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                  Download

                                                                • memory/5844-1779-0x000001BBF2EB0000-0x000001BBF2ED0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/5844-1774-0x000001BBF3800000-0x000001BBF38B2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/6080-1788-0x000001CAF51D0000-0x000001CAF5282000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/6080-1795-0x000001CAF5C40000-0x000001CAF5C88000-memory.dmp

                                                                  Filesize

                                                                  288KB

                                                                  Download

                                                                • memory/6080-1789-0x000001CAF5120000-0x000001CAF513C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/6080-1748-0x000001CAF4040000-0x000001CAF407A000-memory.dmp

                                                                  Filesize

                                                                  232KB

                                                                  Download

                                                                • memory/6092-1803-0x00000264AC540000-0x00000264AC5F2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download

                                                                • memory/6092-1780-0x0000026493BD0000-0x0000026493C1A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/6092-1773-0x0000026493A40000-0x0000026493A58000-memory.dmp

                                                                  Filesize

                                                                  96KB

                                                                  Download

                                                                • memory/6092-1769-0x0000026493510000-0x000002649352C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/6092-1758-0x0000026493550000-0x000002649359A000-memory.dmp

                                                                  Filesize

                                                                  296KB

                                                                  Download

                                                                • memory/6092-1749-0x0000026493130000-0x0000026493164000-memory.dmp

                                                                  Filesize

                                                                  208KB

                                                                  Download

                                                                • memory/6092-1777-0x0000026493530000-0x000002649353A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/6104-1754-0x000002B168570000-0x000002B16858A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/6104-1752-0x000002B167C00000-0x000002B167C0A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                  Download

                                                                • memory/6104-1802-0x000002B169510000-0x000002B169A38000-memory.dmp

                                                                  Filesize

                                                                  5.2MB

                                                                  Download

                                                                • memory/6104-1763-0x000002B168E20000-0x000002B168ED2000-memory.dmp

                                                                  Filesize

                                                                  712KB

                                                                  Download