Overview

overview

10

Static

static

10

17a8deead8...91.msi

windows7-x64

10

17a8deead8...91.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 02:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17a8deead8891bf0f89d9445088e3e85205d48c506d5067b3b3abcd31b746e91.msi

  • Size

    2.9MB

  • MD5

    b3d7566d73cdfc73d57d9318b24f578a

  • SHA1

    f48955ca77e0753c806accb5a70f0540bbbddef3

  • SHA256

    17a8deead8891bf0f89d9445088e3e85205d48c506d5067b3b3abcd31b746e91

  • SHA512

    81cda0355af774f7a3c7d21303b2d2c06f0689a94f9a4d81ccbed98b486c630f7afcdde51668f71e5908696550d51a2ca6934eaaa08a1eae180d11a3ec469259

  • SSDEEP

    49152:u+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:u+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\17a8deead8891bf0f89d9445088e3e85205d48c506d5067b3b3abcd31b746e91.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:396
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2244
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8427B96A69265888D6E6CFA1389C7C3F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIA836.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240625968 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4172
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIAAC8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240626390 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIB160.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628062 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2504
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIBD4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631171 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4996
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AA43F0C732D02EDA1F102F8CF7AD8C43 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2756
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:828
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000N6lNHIAZ" /AgentId="0a2fc8b3-7414-4057-92d0-30029e0464db"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:2432
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 639489D19D2555FD6A001F404AEB49FC E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:4428
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{329588C2-9542-4FAA-A800-CE125401F4F0}
        3⤵
        • Executes dropped EXE
        PID:2608
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF082378-2CC4-4946-A8DB-7D270B5344EA}
        3⤵
        • Executes dropped EXE
        PID:1884
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D630A8D3-BC66-44F9-AD3F-C83D4D00F2F6}
        3⤵
        • Executes dropped EXE
        PID:1196
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9AFA45B0-E276-48CA-870C-E4C11EFB471D}
        3⤵
        • Executes dropped EXE
        PID:224
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6F07C17B-5115-4664-AECE-2BCB69F42FA0}
        3⤵
        • Executes dropped EXE
        PID:3116
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E49BA84-27DB-4B9D-AAF3-20030DDF3028}
        3⤵
        • Executes dropped EXE
        PID:4652
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A85A3C59-3938-4B0B-A73B-3EF19CBBCA69}
        3⤵
        • Executes dropped EXE
        PID:4136
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1638C775-942D-4743-A8E7-7BB1E200520A}
        3⤵
        • Executes dropped EXE
        PID:3496
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D590550B-3540-4CF5-92A0-3E4D99888CAB}
        3⤵
        • Executes dropped EXE
        PID:2176
      • C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe
        C:\Windows\TEMP\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isF685.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B057A179-463E-448D-A36B-F35F8FB98C4E}
        3⤵
        • Executes dropped EXE
        PID:3536
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4776
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4528
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3920
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1708
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:824
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2648
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1884
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4996
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3308
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3276
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3756
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4396
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1592
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1720
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3728
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4068
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{803B2F31-C2EE-4628-B3A7-26FD34CDCCA9}
        3⤵
        • Executes dropped EXE
        PID:4936
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF8930BF-19FE-4328-8FB9-D1E8A062AA6A}
        3⤵
        • Executes dropped EXE
        PID:1720
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7576ACF3-FF87-4FFD-B1E7-83BEF4255962}
        3⤵
        • Executes dropped EXE
        PID:1444
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{225E7698-5DE2-4B42-A5FA-7FC5468703CE}
        3⤵
        • Executes dropped EXE
        PID:364
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99AE1884-2424-401D-8D0C-6DAB4B4FE9BF}
        3⤵
        • Executes dropped EXE
        PID:3744
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C3CB57FE-BBDD-41C0-BB90-EFFCF8E11E38}
        3⤵
        • Executes dropped EXE
        PID:2692
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B1F1E048-4E03-4BE6-9F8D-CE2E17CC542F}
        3⤵
        • Executes dropped EXE
        PID:4856
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91063830-5169-4923-8F46-EA29795E4747}
        3⤵
        • Executes dropped EXE
        PID:3472
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C89D6647-4D8F-476E-8B17-0E339FEA0F90}
        3⤵
        • Executes dropped EXE
        PID:4136
      • C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
        C:\Windows\TEMP\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6FAC6FA3-1A66-46D2-B391-19010A02F481}
        3⤵
        • Executes dropped EXE
        PID:2500
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{164B8C2B-9BCD-414E-8F0B-FC1ACF868E15}
        3⤵
        • Executes dropped EXE
        PID:4372
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{592C95B8-A260-435F-90DD-6FDB0E115763}
        3⤵
        • Executes dropped EXE
        PID:4380
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{380D1CBB-9BA7-4E47-AFED-7126E6168251}
        3⤵
        • Executes dropped EXE
        PID:3472
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D5612742-8912-4EE0-A241-8944B12E087A}
        3⤵
        • Executes dropped EXE
        PID:4684
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94EF087C-5EF9-4EED-B655-241EB9AE1F63}
        3⤵
        • Executes dropped EXE
        PID:2500
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FE61FB86-27B7-4FF9-B26B-1EB32572D329}
        3⤵
        • Executes dropped EXE
        PID:3116
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2902B76D-851F-482D-8D78-FC64C34C33E5}
        3⤵
        • Executes dropped EXE
        PID:3908
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{02E64476-E05B-44D0-813D-726F08B1EE0D}
        3⤵
        • Executes dropped EXE
        PID:4396
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0273E98F-7D36-49DE-A5F4-40E38AD60075}
        3⤵
        • Executes dropped EXE
        PID:4372
      • C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe
        C:\Windows\TEMP\{2FD7865C-8C56-4773-9DBC-23607A1A70AE}\_isD0D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{53307180-9081-4E7D-9D95-ADD750B069CE}
        3⤵
        • Executes dropped EXE
        PID:4380
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2432
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4700
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3768
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:2864
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:220
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4772
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40FDD5C7-82C8-41D7-8A0B-C8D052E59D1D}
            3⤵
            • Executes dropped EXE
            PID:4908
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FB1BF6F0-1B90-4E44-90E8-D20DC5309372}
            3⤵
            • Executes dropped EXE
            PID:220
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{06338980-AE89-4648-8C03-F76D96A86109}
            3⤵
            • Executes dropped EXE
            PID:4856
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6FC4DE26-A001-4CED-B14A-273747C9F69E}
            3⤵
            • Executes dropped EXE
            PID:5060
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B7276C8C-6AFF-4C5A-807E-99A1574852E6}
            3⤵
            • Executes dropped EXE
            PID:3592
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C71FCB96-9C4E-4725-AF52-A7BA7241D8CC}
            3⤵
            • Executes dropped EXE
            PID:2376
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F0DB1E6-C923-47AB-8E41-6F46B276CFE3}
            3⤵
            • Executes dropped EXE
            PID:4140
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D78DA384-F822-452D-8958-9DDB44BB7EB1}
            3⤵
            • Executes dropped EXE
            PID:3908
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9106575-8E23-4F5F-894C-1A71AA36E309}
            3⤵
            • Executes dropped EXE
            PID:3464
          • C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe
            C:\Windows\TEMP\{7D35C5B1-5986-466F-8DB0-718F8E544DAC}\_is1F2F.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CEC64789-C31D-4439-AE1B-F0738C9CFDD8}
            3⤵
            • Executes dropped EXE
            PID:2436
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4024
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A864BA4C-8B03-42C0-9614-A6A4A6A26A68}
            3⤵
            • Executes dropped EXE
            PID:3464
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E4FFFFF-0249-4D78-A814-9C76B8DC56E2}
            3⤵
            • Executes dropped EXE
            PID:5060
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DF35B83-ECC2-40B8-918D-9D635A73E7CF}
            3⤵
            • Executes dropped EXE
            PID:4148
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{20CE40E2-DD21-44CD-BADB-28897221F491}
            3⤵
            • Executes dropped EXE
            PID:2176
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D22F0F62-96E6-4F81-AEFE-30043C660653}
            3⤵
            • Executes dropped EXE
            PID:4692
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{62E65906-AA4C-474B-A80C-C2339B49F79C}
            3⤵
            • Executes dropped EXE
            PID:1196
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C55946A5-0BED-428C-BACC-F20F188E6E37}
            3⤵
            • Executes dropped EXE
            PID:1808
          • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
            C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CBA00ADF-39AF-4FAB-BBA6-57BCF8DA6DA5}
            3⤵
              PID:4164
            • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
              C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11CD38A6-B9A2-4882-919B-B4C22C7340A7}
              3⤵
                PID:3388
              • C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe
                C:\Windows\TEMP\{A3D0D6AC-71CB-4537-9542-00BFD3E43200}\_is224D.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{65CF9BAA-3D06-4DB3-A23D-6599F6674B65}
                3⤵
                  PID:3172
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4692
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 96E21A58209F5A53766FB17F82FC5DF9 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5140
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI5DEC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240672515 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5264
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI5FA3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240672656 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:6008
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI61E6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240673250 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3376
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5932
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5220
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5436
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4352
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5984
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:4780
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI813F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240681265 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:5360
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:2668
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="273dd5aa-1c33-4325-9b75-0d470cb79797"
                2⤵
                • Modifies data under HKEY_USERS
                PID:5572
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:4952
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3652
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:1052
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "24ea6e1b-8e20-42ee-980a-fead334f932d" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000N6lNHIAZ
                2⤵
                • Executes dropped EXE
                PID:4908
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "c678863f-cbfe-48fb-abb7-6117ea92ad85" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000N6lNHIAZ
                2⤵
                • Executes dropped EXE
                PID:4624
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "184b13c3-1cbd-4874-9395-7555959eaebe" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000N6lNHIAZ
                2⤵
                • Executes dropped EXE
                PID:1956
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "e63ef74b-de65-4ade-b034-1db89b3deb7b" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000N6lNHIAZ
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3308
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1224
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:5068
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "2f908156-7dff-4cd0-8237-b2fdbb65cb38" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000N6lNHIAZ
                2⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:508
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4820
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3524
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:4552
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "747950b3-b6e5-46eb-85cf-8d319bbc474a" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000N6lNHIAZ
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3372
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3232
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:364
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "747950b3-b6e5-46eb-85cf-8d319bbc474a" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000N6lNHIAZ
                2⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1428
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "e0e60911-bea3-4075-bb76-0614f309fffc" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000N6lNHIAZ
                2⤵
                • Drops file in Program Files directory
                PID:4428
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:5216
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:5372
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "1cd37f8d-3467-484e-9bdf-04eb72797a89" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000N6lNHIAZ
                  2⤵
                  • Writes to the Master Boot Record (MBR)
                  • Modifies data under HKEY_USERS
                  PID:2112
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "5035b301-ac79-4d49-befc-31bf4a3dd5a9" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000N6lNHIAZ
                  2⤵
                    PID:3768
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                      3⤵
                        PID:6076
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "dacc145a-be5a-4c9f-b6cd-39e3e76814f1" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000N6lNHIAZ
                      2⤵
                      • Drops file in System32 directory
                      PID:5660
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "90dc604b-a203-44da-942b-852c0748b686" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000N6lNHIAZ
                      2⤵
                      • Drops file in System32 directory
                      PID:5752
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "b68918fa-69aa-41fd-b86f-29a1b4757954" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000N6lNHIAZ
                      2⤵
                      • Drops file in System32 directory
                      PID:5880
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "3753335a-9d66-44ba-be52-1705dbc88234" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000N6lNHIAZ
                      2⤵
                      • Drops file in System32 directory
                      PID:5900
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "3d837daa-7acb-45f7-82c9-f6dc91990aeb" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000N6lNHIAZ
                      2⤵
                        PID:6124
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "bf0e75e0-7463-48ec-973f-5c2629e87b56" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000N6lNHIAZ
                        2⤵
                          PID:5492
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=3de39cd34666706c42de907a5b96bc48&rmm_session_pwd_ttl=86400"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5392
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "6de83544-6546-4a4a-a582-12c32a8a708a" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000N6lNHIAZ
                          2⤵
                          • Modifies registry class
                          PID:5420
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "853c222c-ef6c-4102-aed1-d4c35868f86c" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000N6lNHIAZ
                          2⤵
                          • Drops file in System32 directory
                          PID:5180
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "6722cddb-e0f7-4e45-86a5-93fc5a1546ba" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000N6lNHIAZ
                          2⤵
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          PID:5620
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "34cb61fc-10b9-4f24-b939-395c7d0116c5" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000N6lNHIAZ
                          2⤵
                            PID:5744
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "21dbe569-888e-4791-858d-856d090e2e76" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000N6lNHIAZ
                            2⤵
                            • Drops file in System32 directory
                            PID:2612
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:5244
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:5844
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4136
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4160
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:4068
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1224
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:4056
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:4116
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:3564
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3004
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious use of SetWindowsHookEx
                                PID:4932
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:5512
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:3372
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:3064
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:3652
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        • Checks SCSI registry key(s)
                                        • Modifies data under HKEY_USERS
                                        PID:4448
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:1168
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:5436
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "892744d3-a3c8-47b0-96c0-8edf4b68baf6" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000N6lNHIAZ
                                  2⤵
                                    PID:3940
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "29770167-0552-4c19-870b-da33fb6d8a82" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000N6lNHIAZ
                                    2⤵
                                    • Modifies data under HKEY_USERS
                                    PID:756
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "98df253f-5bbe-4ea4-9a1f-019ff3cb4153" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000N6lNHIAZ
                                    2⤵
                                    • Drops file in Program Files directory
                                    PID:4780
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      3⤵
                                        PID:780
                                        • C:\Windows\system32\cscript.exe
                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                          4⤵
                                          • Modifies data under HKEY_USERS
                                          PID:5496
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "f95dd283-7d96-4e55-b858-5dbf5838fd6b" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000N6lNHIAZ
                                      2⤵
                                        PID:3156
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "f8445f32-4878-4556-a4eb-1ba23e3cabfa" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000N6lNHIAZ
                                        2⤵
                                          PID:5532
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "bafa1dae-8464-409d-a264-3de0aa6bdb91" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000N6lNHIAZ
                                          2⤵
                                            PID:5980
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "bb567c7e-b89b-4d0d-8013-99156db69dfa" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000N6lNHIAZ
                                            2⤵
                                              PID:1932
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "3c9d747f-1210-4166-ae47-1f7fca549fb0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000N6lNHIAZ
                                              2⤵
                                                PID:5684
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                  3⤵
                                                  • System Time Discovery
                                                  PID:1776
                                                  • C:\Program Files\dotnet\dotnet.exe
                                                    dotnet --list-runtimes
                                                    4⤵
                                                    • System Time Discovery
                                                    PID:1860
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "1fa7ebde-6738-4a62-a259-cd38d131c13b" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000N6lNHIAZ
                                                2⤵
                                                  PID:4992
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "ebdcd3eb-6c63-4586-93ca-e8f772454640" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000N6lNHIAZ
                                                  2⤵
                                                    PID:2944
                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=3de39cd34666706c42de907a5b96bc48&rmm_session_pwd_ttl=86400"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4948
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "8a636c71-b1af-4dd2-b992-5b0a02ef7af3" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000N6lNHIAZ
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:1876
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "f2a3f32d-3b88-447b-84be-10d21625a189" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000N6lNHIAZ
                                                    2⤵
                                                      PID:448
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "0a2fc8b3-7414-4057-92d0-30029e0464db" "f2a3f32d-3b88-447b-84be-10d21625a189" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000N6lNHIAZ"
                                                        3⤵
                                                          PID:5508
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "726ff0d8-0331-49cb-933d-113fef0da78f" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000N6lNHIAZ
                                                        2⤵
                                                          PID:4072
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "ed836a3e-1f1e-4942-80b6-e20d206da816" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000N6lNHIAZ
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies registry class
                                                          PID:5660
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0a2fc8b3-7414-4057-92d0-30029e0464db "29770167-0552-4c19-870b-da33fb6d8a82" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000N6lNHIAZ
                                                          2⤵
                                                            PID:1260
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                          1⤵
                                                          • Drops file in Windows directory
                                                          • Checks SCSI registry key(s)
                                                          PID:5616
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000140" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:5976
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000150" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                            2⤵
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            • Modifies data under HKEY_USERS
                                                            PID:4600
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000150"
                                                            2⤵
                                                            • Drops file in Drivers directory
                                                            • Drops file in System32 directory
                                                            • Checks SCSI registry key(s)
                                                            PID:5392
                                                          • C:\Windows\system32\DrvInst.exe
                                                            DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                            2⤵
                                                            • Drops file in Drivers directory
                                                            • Drops file in Windows directory
                                                            • Checks SCSI registry key(s)
                                                            PID:5448

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Persistence

                                                        Event Triggered Execution

                                                        2
                                                        T1546

                                                        Component Object Model Hijacking

                                                        1
                                                        T1546.015

                                                        Installer Packages

                                                        1
                                                        T1546.016

                                                        Pre-OS Boot

                                                        1
                                                        T1542

                                                        Bootkit

                                                        1
                                                        T1542.003

                                                        Privilege Escalation

                                                        Event Triggered Execution

                                                        2
                                                        T1546

                                                        Component Object Model Hijacking

                                                        1
                                                        T1546.015

                                                        Installer Packages

                                                        1
                                                        T1546.016

                                                        Defense Evasion

                                                        Modify Registry

                                                        1
                                                        T1112

                                                        Pre-OS Boot

                                                        1
                                                        T1542

                                                        Bootkit

                                                        1
                                                        T1542.003

                                                        Subvert Trust Controls

                                                        1
                                                        T1553

                                                        Install Root Certificate

                                                        1
                                                        T1553.004

                                                        System Binary Proxy Execution

                                                        1
                                                        T1218

                                                        Msiexec

                                                        1
                                                        T1218.007

                                                        Credential Access

                                                        Discovery

                                                        Peripheral Device Discovery

                                                        2
                                                        T1120

                                                        Query Registry

                                                        4
                                                        T1012

                                                        System Information Discovery

                                                        3
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        System Time Discovery

                                                        1
                                                        T1124

                                                        Lateral Movement

                                                        Collection

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Config.Msi\e57a7ba.rbs
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          88b44ea213b3fc45ab060be800c43089

                                                          SHA1

                                                          599ad743dd7d6b18ac32872b940d180975f97e2e

                                                          SHA256

                                                          0cd76d6601cc32a14684caff324cff3e34a0f2a5e603b1a2132ea5af8acaa58a

                                                          SHA512

                                                          5450068c06ab2a1fd452fb5b2be7dcda147dfa899b4a7ce8d099931b0135eb514a563bd61ae50b2f17d46402458232c71593910dadbd093eead62cdca9ebf2e8

                                                          Download Submit

                                                        • C:\Config.Msi\e57a7bf.rbs
                                                          Filesize

                                                          74KB

                                                          MD5

                                                          d8694c285aa0116a3d6bb2dcfd7614e8

                                                          SHA1

                                                          b5902f23db3b0249bf83d612bf3f4a09cf1058b5

                                                          SHA256

                                                          6dbda801fde96100274cdedd1670a1505f28a4d7fc6de8954a9fef86ef90eedb

                                                          SHA512

                                                          737039589e3b608e14bc188ad8b551f2db3ece2f2b2bcf37db122c027f6afa9b6b0cf81c520bc18bd5cbe3a704caee860c00f76ecb6e7ccc9cb815a245d54053

                                                          Download Submit

                                                        • C:\Config.Msi\e57a7c1.rbs
                                                          Filesize

                                                          464B

                                                          MD5

                                                          112aef6c1ef8552835a4a1dd66ad0c56

                                                          SHA1

                                                          52774117fe7f985002ec86532dd9a3e3984c1306

                                                          SHA256

                                                          36bc34c463df45948c6c55ef4515bfbca17c6b7858b16b7ae54a70ff884aff08

                                                          SHA512

                                                          13ad0ed51d2d2bf2fe34939b05c96ae5818177e08469b639f3a6f545800f4265d73cb3e341b34d70c7f17919c6802078c43e0bf37a90ea377caab6b37ccdd390

                                                          Download Submit

                                                        • C:\Config.Msi\e57a7c7.rbs
                                                          Filesize

                                                          9KB

                                                          MD5

                                                          16b3c5c481289c95210599106dbc248d

                                                          SHA1

                                                          6af5402b00ebc8256b91ecd7e71caad142109d59

                                                          SHA256

                                                          cc2f022cd50384173d2267b4ebe71abb1bca58fdb96540dc79437afea26a5d31

                                                          SHA512

                                                          e7ecb39cb8f32c9b5f42142cdf8f78f4298158eaabf38e3a0b278f9d070b1f327c5b34be22525e5a2d32de8d38038b811eb88e89240a5cd1b7b7cdd9f12c7c99

                                                          Download Submit

                                                        • C:\Config.Msi\e57a7cf.rbs
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          ce9db44be77c99630729cf74986bd1ac

                                                          SHA1

                                                          39fee1f9f071f2233745de21807e587e8b6a2d89

                                                          SHA256

                                                          d365a006148d8cfe3d600fa4a0d8546292a3555a5a430b28c26f33ae912ed54c

                                                          SHA512

                                                          509c0e918d08d1e7f1302936a8c77022b55771695dfa1d6bce325bb1f7f033d0d8150549793143e7d533f9c6f2a4c05794d9e756b7b0d4275d3f5e38d2ad7b4d

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          337079222a6f6c6edf58f3f981ff20ae

                                                          SHA1

                                                          1f705fc0faa84c69e1fe936b34783b301323e255

                                                          SHA256

                                                          ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                          SHA512

                                                          ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                          Filesize

                                                          142KB

                                                          MD5

                                                          477293f80461713d51a98a24023d45e8

                                                          SHA1

                                                          e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                          SHA256

                                                          a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                          SHA512

                                                          23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          b3bb71f9bb4de4236c26578a8fae2dcd

                                                          SHA1

                                                          1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                          SHA256

                                                          e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                          SHA512

                                                          fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                          Filesize

                                                          210KB

                                                          MD5

                                                          c106df1b5b43af3b937ace19d92b42f3

                                                          SHA1

                                                          7670fc4b6369e3fb705200050618acaa5213637f

                                                          SHA256

                                                          2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                          SHA512

                                                          616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                          Filesize

                                                          693KB

                                                          MD5

                                                          2c4d25b7fbd1adfd4471052fa482af72

                                                          SHA1

                                                          fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                          SHA256

                                                          2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                          SHA512

                                                          f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                          Filesize

                                                          157KB

                                                          MD5

                                                          242d415e238789fbc57c5ac7e8ca5d02

                                                          SHA1

                                                          09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                          SHA256

                                                          7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                          SHA512

                                                          ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                          Filesize

                                                          51KB

                                                          MD5

                                                          3180c705182447f4bcc7ce8e2820b25d

                                                          SHA1

                                                          ad6486557819a33d3f29b18d92b43b11707aae6e

                                                          SHA256

                                                          5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                          SHA512

                                                          228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                          Filesize

                                                          12B

                                                          MD5

                                                          dc63026e80d2bb04f71e41916f807e33

                                                          SHA1

                                                          6cda386d2c365f94ea3de41e2390fd916622eb51

                                                          SHA256

                                                          3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                          SHA512

                                                          61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                          Filesize

                                                          173KB

                                                          MD5

                                                          31def444e6135301ea3c38a985341837

                                                          SHA1

                                                          f135be75c721af2d5291cb463cbc22a32467084a

                                                          SHA256

                                                          36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                          SHA512

                                                          bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                          Filesize

                                                          546B

                                                          MD5

                                                          158fb7d9323c6ce69d4fce11486a40a1

                                                          SHA1

                                                          29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                          SHA256

                                                          5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                          SHA512

                                                          7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                          Filesize

                                                          688KB

                                                          MD5

                                                          ba66874c510645c1fb5fe74f85b32e98

                                                          SHA1

                                                          e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                          SHA256

                                                          12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                          SHA512

                                                          44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                          Filesize

                                                          27KB

                                                          MD5

                                                          797c9554ec56fd72ebb3f6f6bef67fb5

                                                          SHA1

                                                          40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                          SHA256

                                                          7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                          SHA512

                                                          4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                          Filesize

                                                          214KB

                                                          MD5

                                                          01807774f043028ec29982a62fa75941

                                                          SHA1

                                                          afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                          SHA256

                                                          9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                          SHA512

                                                          33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                          Filesize

                                                          37KB

                                                          MD5

                                                          efb4712c8713cb05eb7fe7d87a83a55a

                                                          SHA1

                                                          c94d106bba77aecf88540807da89349b50ea5ae7

                                                          SHA256

                                                          30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                          SHA512

                                                          3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                          Filesize

                                                          3.4MB

                                                          MD5

                                                          e010d1f614b1a830482d3df4ba056f24

                                                          SHA1

                                                          5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                          SHA256

                                                          98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                          SHA512

                                                          727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                          Filesize

                                                          389KB

                                                          MD5

                                                          5e3252e0248b484e76fcdbf8b42a645d

                                                          SHA1

                                                          11ae92fd16ac87f6ab755911e85e263253c16516

                                                          SHA256

                                                          01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                          SHA512

                                                          540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                          Filesize

                                                          56KB

                                                          MD5

                                                          3d1f0484675c4ddbb652e556e8e38014

                                                          SHA1

                                                          4787a4e1f3653fd361e41417a5b98c549d4e4b03

                                                          SHA256

                                                          d9e605539b01eab5ec113dc08afe9cc6c0073840574cc929513abab74b6af06a

                                                          SHA512

                                                          a5586c55628a57c6bccedb8c8ecb1458692963aecfc0b3832a0062f2c87f8ce97b5a432edc2eed8d87d4341a048a9b68a8a3d66c171cd9784d7b7b279c900797

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                          Filesize

                                                          196KB

                                                          MD5

                                                          5f782d0cb0f717ae9dfd1b4da1295f15

                                                          SHA1

                                                          b33575e428e19940f0585c747e054ca70a12d454

                                                          SHA256

                                                          0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                          SHA512

                                                          e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                          Filesize

                                                          55KB

                                                          MD5

                                                          a739b889642ca9ce4ad3a37a3c521604

                                                          SHA1

                                                          18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                          SHA256

                                                          44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                          SHA512

                                                          92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                          Filesize

                                                          9KB

                                                          MD5

                                                          9d1528a2ce17522f6de064ae2c2b608e

                                                          SHA1

                                                          2f1ce8b589e57ab300bb93dde176689689f75114

                                                          SHA256

                                                          11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                          SHA512

                                                          a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5620.update
                                                          Filesize

                                                          9KB

                                                          MD5

                                                          14ffcf07375b3952bd3f2fe52bb63c14

                                                          SHA1

                                                          ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                          SHA256

                                                          6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                          SHA512

                                                          14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          e59fdb7e4dc0859eb3172f1f81b5c9e2

                                                          SHA1

                                                          52851fc6142aef0f6c93c48b0257323d12e834a1

                                                          SHA256

                                                          2baf917d9667f938e59b7ce8d8682a156d572f0bf131384dc10e524286b74efc

                                                          SHA512

                                                          a80dbd67010919866377392d599d5f6e29ff7d6a209bde127ba70c4f691e4b045f363a4c24e79036d8616552c9aed5f608c66296058379c7fdafc183a48581ce

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                          Filesize

                                                          2B

                                                          MD5

                                                          81051bcc2cf1bedf378224b0a93e2877

                                                          SHA1

                                                          ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                          SHA256

                                                          7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                          SHA512

                                                          1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                          Filesize

                                                          54KB

                                                          MD5

                                                          77c613ffadf1f4b2f50d31eeec83af30

                                                          SHA1

                                                          76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                          SHA256

                                                          2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                          SHA512

                                                          29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                          Filesize

                                                          334KB

                                                          MD5

                                                          b3e14504a48bed32c53ec7aab2cb2c8f

                                                          SHA1

                                                          0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                          SHA256

                                                          adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                          SHA512

                                                          e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                          Filesize

                                                          72KB

                                                          MD5

                                                          749c51599fbf82422791e0df1c1e841c

                                                          SHA1

                                                          bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                          SHA256

                                                          c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                          SHA512

                                                          f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                          Filesize

                                                          50KB

                                                          MD5

                                                          c0f02eaa3eb28659d8f1bcba8de48479

                                                          SHA1

                                                          5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                          SHA256

                                                          6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                          SHA512

                                                          47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                          Filesize

                                                          32KB

                                                          MD5

                                                          f531d3157e9ff57eea92db36c40e283e

                                                          SHA1

                                                          d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                          SHA256

                                                          30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                          SHA512

                                                          27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                          Filesize

                                                          54KB

                                                          MD5

                                                          d11b2139d29e79d795054c3866898b7f

                                                          SHA1

                                                          020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                          SHA256

                                                          11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                          SHA512

                                                          de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                          Filesize

                                                          588KB

                                                          MD5

                                                          17d74c03b6bcbcd88b46fcc58fc79a0d

                                                          SHA1

                                                          bc0316e11c119806907c058d62513eb8ce32288c

                                                          SHA256

                                                          13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                          SHA512

                                                          f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                          Download Submit

                                                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                          Filesize

                                                          216B

                                                          MD5

                                                          c57e9fb93df91566636187ae80b9631b

                                                          SHA1

                                                          1b07f08ed65236c7a0a40ca414156764312d6758

                                                          SHA256

                                                          c76b07153d6f9858ba7178c788e1c6e5a06986142f20a5b4bdf08c12c0f9c61e

                                                          SHA512

                                                          70b152d2e72c162440a530ad14a06df5fa36db3fe776167c2319d2800774321ec0a04de7710e7b7b0da937f529b8028b5092947a61ed5d571f87d49fe6240c3b

                                                          Download Submit

                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                          Filesize

                                                          9KB

                                                          MD5

                                                          1ef7574bc4d8b6034935d99ad884f15b

                                                          SHA1

                                                          110709ab33f893737f4b0567f9495ac60c37667c

                                                          SHA256

                                                          0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                          SHA512

                                                          947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                          Download Submit

                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                          Filesize

                                                          10KB

                                                          MD5

                                                          f512536173e386121b3ebd22aac41a4e

                                                          SHA1

                                                          74ae133215345beaebb7a95f969f34a40dda922a

                                                          SHA256

                                                          a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                          SHA512

                                                          1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                          Download Submit

                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                          Filesize

                                                          76KB

                                                          MD5

                                                          b40fe65431b18a52e6452279b88954af

                                                          SHA1

                                                          c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                          SHA256

                                                          800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                          SHA512

                                                          e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                          Download Submit

                                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                          Filesize

                                                          80KB

                                                          MD5

                                                          3904d0698962e09da946046020cbcb17

                                                          SHA1

                                                          edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                          SHA256

                                                          a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                          SHA512

                                                          c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                          Filesize

                                                          321B

                                                          MD5

                                                          e27388e8bddf99c59e899e3b6257dc8e

                                                          SHA1

                                                          6540cf5cbf3790840ec3a9d5644106895a98523a

                                                          SHA256

                                                          85839872a437e67907189ce9e7523c91c700472bb150ee39db06c3dfb91e4cf1

                                                          SHA512

                                                          36d0a63a1785999c2b6f38c701662b66fa14da92120929e39bee561749a036920181e5f8db512e51e9050c61c41f0b2ddce4bed1d932d8a5821972a9242ec062

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                          Filesize

                                                          717B

                                                          MD5

                                                          ef0a07aec4367a64c16c581da2657aa9

                                                          SHA1

                                                          13011a5abcbadb3424fb6ecee560665556bb1d24

                                                          SHA256

                                                          f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                          SHA512

                                                          35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                          Filesize

                                                          7KB

                                                          MD5

                                                          362ce475f5d1e84641bad999c16727a0

                                                          SHA1

                                                          6b613c73acb58d259c6379bd820cca6f785cc812

                                                          SHA256

                                                          1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                          SHA512

                                                          7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                          Filesize

                                                          1.9MB

                                                          MD5

                                                          8de5a7a19d882820893d8b911c1710fb

                                                          SHA1

                                                          95cdf5855bc5e454c8944952697ab142f77124f7

                                                          SHA256

                                                          2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                          SHA512

                                                          3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          9a9b1fd85b5f1dcd568a521399a0d057

                                                          SHA1

                                                          34ed149b290a3a94260d889ba50cb286f1795fa6

                                                          SHA256

                                                          88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                          SHA512

                                                          7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                          Filesize

                                                          375KB

                                                          MD5

                                                          3c93b399b417b0d6a232d386e65a8b46

                                                          SHA1

                                                          bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                          SHA256

                                                          29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                          SHA512

                                                          a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                          Filesize

                                                          321KB

                                                          MD5

                                                          d3901e62166e9c42864fe3062cb4d8d5

                                                          SHA1

                                                          c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                          SHA256

                                                          dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                          SHA512

                                                          ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                          Filesize

                                                          814KB

                                                          MD5

                                                          9b1f97a41bfb95f148868b49460d9d04

                                                          SHA1

                                                          768031d5e877e347a249dfdeab7c725df941324b

                                                          SHA256

                                                          09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                          SHA512

                                                          9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                          Filesize

                                                          1.2MB

                                                          MD5

                                                          e74d2a16da1ddb7f9c54f72b8a25897c

                                                          SHA1

                                                          32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                          SHA256

                                                          a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                          SHA512

                                                          52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                          Filesize

                                                          11B

                                                          MD5

                                                          5eda46a55c61b07029e7202f8cf1781c

                                                          SHA1

                                                          862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                          SHA256

                                                          12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                          SHA512

                                                          4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                          Filesize

                                                          12B

                                                          MD5

                                                          5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                          SHA1

                                                          93012724e6cc0a298838aede678806e6c0c6517d

                                                          SHA256

                                                          a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                          SHA512

                                                          890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                          Filesize

                                                          48KB

                                                          MD5

                                                          7b126509624d6c8606264c64bd306c44

                                                          SHA1

                                                          32df7af1524cfdd121ca72e4a72f07f2915ed929

                                                          SHA256

                                                          267fb02a9aba1b8ed93273fc6ab2a56b086a8296d1f9ed6d8122102443407127

                                                          SHA512

                                                          bfbde8f9cfa60daef716bd4c55185f2f76aa62b48c99bb0538396ba39ff152c0eadac985fcd1f348d4a63993fe8c3cde8ef4908a1631ee01bc1bc2b1e09c5782

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                          Filesize

                                                          48KB

                                                          MD5

                                                          50566010ffd08cdefbe73de4dd61202f

                                                          SHA1

                                                          2ca7c9c3c1ca58046a6bd6ffdb09cbb2293af870

                                                          SHA256

                                                          bf842670f7a8e24a5ccaffcab9664a5b318c1c95ac0ab7b01cb5644e3e8bb939

                                                          SHA512

                                                          a511551765dbfbafd4942c3f46a6e4efad3d725fbe3d8a82c642bcbe9340d0e0151ea7580024d951e7c0ab1bfa8d7f6d34cf63824dab89a3e53828a1b946e73d

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                          Filesize

                                                          2.8MB

                                                          MD5

                                                          91453d3e1e2bc9586cf5495073fb3cf7

                                                          SHA1

                                                          09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                          SHA256

                                                          5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                          SHA512

                                                          462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          384d6da5c34ff401b18f0af41e3a2643

                                                          SHA1

                                                          3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                          SHA256

                                                          0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                          SHA512

                                                          5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          6c6f85e896655a6eb726482f04c49086

                                                          SHA1

                                                          2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                          SHA256

                                                          e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                          SHA512

                                                          b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                          Filesize

                                                          541B

                                                          MD5

                                                          d0efb0a6d260dbe5d8c91d94b77d7acd

                                                          SHA1

                                                          e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                          SHA256

                                                          7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                          SHA512

                                                          a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                          Filesize

                                                          12B

                                                          MD5

                                                          3d66ae5ed06891e8ce75a39a24070844

                                                          SHA1

                                                          368064119835d4376727a14706c41384446183e8

                                                          SHA256

                                                          73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                          SHA512

                                                          c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                          Filesize

                                                          646KB

                                                          MD5

                                                          7895698867d1ad33934a8553b4806dc5

                                                          SHA1

                                                          32704df55deaff9bf0b4ee0b887541856578938b

                                                          SHA256

                                                          ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                          SHA512

                                                          20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                          Filesize

                                                          3.1MB

                                                          MD5

                                                          85e1898362165fc1315d18abb73c1b37

                                                          SHA1

                                                          289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                          SHA256

                                                          d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                          SHA512

                                                          49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                          Download Submit

                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                          Filesize

                                                          569KB

                                                          MD5

                                                          9614d1da18956de06747c03068208d66

                                                          SHA1

                                                          fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                          SHA256

                                                          dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                          SHA512

                                                          d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                          Download Submit

                                                        • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\dd0bbd27db81bf55ce3b6a6cb2dbc872
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          b2e89027a140a89b6e3eb4e504e93d96

                                                          SHA1

                                                          f3b1b34874b73ae3032decb97ef96a53a654228f

                                                          SHA256

                                                          5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                          SHA512

                                                          93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                          Download Submit

                                                        • C:\ProgramData\chocolatey\config\chocolatey.config
                                                          Filesize

                                                          809B

                                                          MD5

                                                          8b6737800745d3b99886d013b3392ac3

                                                          SHA1

                                                          bb94da3f294922d9e8d31879f2d145586a182e19

                                                          SHA256

                                                          86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                          SHA512

                                                          654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                          Download Submit

                                                        • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                          Filesize

                                                          7KB

                                                          MD5

                                                          1297126959fccbbed0d34d4e11a997dd

                                                          SHA1

                                                          df23ba7358680a3f9ab00321fdaf41f392988318

                                                          SHA256

                                                          b148af9539c7c90abe1e5cbc70d98789766d4954d3829fb2eee5b3fb7e7934e3

                                                          SHA512

                                                          12b261b20b1725828344f69acaa81d22774b5ef3d2df654d452504aa7f05696c34e97141fe23a451f2c21852e2d7ccb9b8e5455574e21e6b46f22734458316b5

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                          Filesize

                                                          471B

                                                          MD5

                                                          6ae5c21035bf5034cb63fb2e785d758c

                                                          SHA1

                                                          d4aed3aa8626d0dc49b7fe9b6073cd1773ad8ceb

                                                          SHA256

                                                          251eb310eb807b47bd4093a3170aea35c155fa78e500baa6ca4e2cdeaf0166ff

                                                          SHA512

                                                          cd9f90caca712dd3d4392e319e70ce10971335aba9a670cf631aae1b6f86abe8c58de4bd3a845af0cc4f3c0bb7b0422b405f5c6cd0bfef38f419eaf4eaacf131

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          Filesize

                                                          727B

                                                          MD5

                                                          29dd7378778c44788bac45d70ea7b440

                                                          SHA1

                                                          7a3c5e30c0c9a9be505b18fd2c24422d5e3dbe56

                                                          SHA256

                                                          69354ff510301b85c14cc1ecd0e5b3c98308b820cfbce483389a7b9a437f67d5

                                                          SHA512

                                                          9e67bee1ae05b0f2408210a6662926cc9da6ee2864820a4704adffae9dd78b80e79ee32e83f5a5e35bed9603e82795a38570d56cc93384b82dc6254940079fe7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          Filesize

                                                          727B

                                                          MD5

                                                          eb9a1d98cc4b6ac3d674a6621df5a758

                                                          SHA1

                                                          5e9bc182d48b8e86a61d8a3f4b5add9c88da6800

                                                          SHA256

                                                          20d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7

                                                          SHA512

                                                          1054d82e5e1b2f2c1416d31f01ff2c172aca8dcc31a622cdd959f918b78a474bd9b40a9b7316122a8262fac24d6236860e2eadd665030a61d56c5c0a153f81c7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                          Filesize

                                                          400B

                                                          MD5

                                                          ad781ab361b2064e10790b6280426a0e

                                                          SHA1

                                                          32b8fa7bc83321311461abfbeb4a859c47c0ea3a

                                                          SHA256

                                                          efc339c756f6c7c00f2be27a16fdbfe020e8bd22e432d643e974730cb8fdaef0

                                                          SHA512

                                                          390fe4547066ae7baae34670ea859ed4f4946f764dc571a7d538ee063811a5a0c41c7255423bd8c11c30dba8a1052972ce904b94fce35b0fd02c62173b74a5e6

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          Filesize

                                                          404B

                                                          MD5

                                                          8bc124f6cd8da5a4f63f37f2495f651a

                                                          SHA1

                                                          8c7e62be14c88a26298fa344bbb501795cb9d40c

                                                          SHA256

                                                          b95457791278ba7384d0f8b15fabf6e2b0b4c0e3a44b7e36c0215461a71364fc

                                                          SHA512

                                                          7f22487e86b825ae3290beb174e1636c2300622c784da54910e5440d1d09bc8f70b1d9f52410fbc4f1a0fd8aad9dc758f844058f0595e9cff8ac81b1cf9b30c7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          Filesize

                                                          412B

                                                          MD5

                                                          4dad811badc927fa2b946126c067f6d5

                                                          SHA1

                                                          edb029c60876c8e3582b9fe5d2c7340284f254c9

                                                          SHA256

                                                          157f6eded995b5fa673cc55885ea8f1b63f32f2b4ce837c550fe81d9ad25d7f5

                                                          SHA512

                                                          57c471fdd6b50059d8baa62de16c9d4dda3f54eeb444e3f710090a3941adddd5d29a45125e542ae5d6f538e375124fd0553a0287c0bcd90fa3fe3c81cf06a223

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                          Filesize

                                                          651B

                                                          MD5

                                                          9bbfe11735bac43a2ed1be18d0655fe2

                                                          SHA1

                                                          61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                          SHA256

                                                          549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                          SHA512

                                                          a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                          Download Submit

                                                        • C:\Windows\Installer\MSI5DEC.tmp-\System.Management.dll
                                                          Filesize

                                                          60KB

                                                          MD5

                                                          878e361c41c05c0519bfc72c7d6e141c

                                                          SHA1

                                                          432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                          SHA256

                                                          24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                          SHA512

                                                          59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIA836.tmp
                                                          Filesize

                                                          509KB

                                                          MD5

                                                          88d29734f37bdcffd202eafcdd082f9d

                                                          SHA1

                                                          823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                          SHA256

                                                          87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                          SHA512

                                                          1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIA836.tmp-\AlphaControlAgentInstallation.dll
                                                          Filesize

                                                          25KB

                                                          MD5

                                                          aa1b9c5c685173fad2dabebeb3171f01

                                                          SHA1

                                                          ed756b1760e563ce888276ff248c734b7dd851fb

                                                          SHA256

                                                          e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                          SHA512

                                                          d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIA836.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                          Filesize

                                                          179KB

                                                          MD5

                                                          1a5caea6734fdd07caa514c3f3fb75da

                                                          SHA1

                                                          f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                          SHA256

                                                          cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                          SHA512

                                                          a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIAAC8.tmp-\CustomAction.config
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          bc17e956cde8dd5425f2b2a68ed919f8

                                                          SHA1

                                                          5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                          SHA256

                                                          e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                          SHA512

                                                          02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIAAC8.tmp-\Newtonsoft.Json.dll
                                                          Filesize

                                                          695KB

                                                          MD5

                                                          715a1fbee4665e99e859eda667fe8034

                                                          SHA1

                                                          e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                          SHA256

                                                          c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                          SHA512

                                                          bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIB2F8.tmp
                                                          Filesize

                                                          211KB

                                                          MD5

                                                          a3ae5d86ecf38db9427359ea37a5f646

                                                          SHA1

                                                          eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                          SHA256

                                                          c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                          SHA512

                                                          96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                          Download Submit

                                                        • C:\Windows\Installer\MSIC6D.tmp
                                                          Filesize

                                                          4.5MB

                                                          MD5

                                                          25a0aa722268b17888b4e159a9f82f18

                                                          SHA1

                                                          68ccb5adae9095056a9d5592f6a850f30715a86b

                                                          SHA256

                                                          72896d8abeeeb40360596927c0feade8f0bc28f9937d35f646b9ba2a47f1edca

                                                          SHA512

                                                          79a574f95dbb5ff11e35f2938fcd6a9e22a3f1a35d7e032aceb099dd69ad45dcdf006d92aeb7d1086e3d0615241f6669e510d5dee6f7d262e0e3d4179822365d

                                                          Download Submit

                                                        • C:\Windows\Installer\e57a7b9.msi
                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          b3d7566d73cdfc73d57d9318b24f578a

                                                          SHA1

                                                          f48955ca77e0753c806accb5a70f0540bbbddef3

                                                          SHA256

                                                          17a8deead8891bf0f89d9445088e3e85205d48c506d5067b3b3abcd31b746e91

                                                          SHA512

                                                          81cda0355af774f7a3c7d21303b2d2c06f0689a94f9a4d81ccbed98b486c630f7afcdde51668f71e5908696550d51a2ca6934eaaa08a1eae180d11a3ec469259

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{85ed1866-50c4-b742-a6aa-bb41caff48ba}\lci_iddcx.cat
                                                          Filesize

                                                          10KB

                                                          MD5

                                                          62458e58313475c9a3642a392363e359

                                                          SHA1

                                                          e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                          SHA256

                                                          85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                          SHA512

                                                          49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{85ed1866-50c4-b742-a6aa-bb41caff48ba}\lci_iddcx.inf
                                                          Filesize

                                                          4KB

                                                          MD5

                                                          1cec22ca85e1b5a8615774fca59a420b

                                                          SHA1

                                                          049a651751ef38321a1088af6a47c4380f9293fc

                                                          SHA256

                                                          60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                          SHA512

                                                          0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{85ed1866-50c4-b742-a6aa-bb41caff48ba}\x64\lci_iddcx.dll
                                                          Filesize

                                                          52KB

                                                          MD5

                                                          01e8bc64139d6b74467330b11331858d

                                                          SHA1

                                                          b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                          SHA256

                                                          148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                          SHA512

                                                          4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{8dd8da7d-bbe8-7e48-9bd5-192e20d41290}\lci_proxywddm.cat
                                                          Filesize

                                                          12KB

                                                          MD5

                                                          8e16d54f986dbe98812fd5ec04d434e8

                                                          SHA1

                                                          8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                          SHA256

                                                          7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                          SHA512

                                                          e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{8dd8da7d-bbe8-7e48-9bd5-192e20d41290}\lci_proxywddm.inf
                                                          Filesize

                                                          2KB

                                                          MD5

                                                          0315a579f5afe989154cb7c6a6376b05

                                                          SHA1

                                                          e352ff670358cf71e0194918dfe47981e9ccbb88

                                                          SHA256

                                                          d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                          SHA512

                                                          c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{8dd8da7d-bbe8-7e48-9bd5-192e20d41290}\x64\lci_proxyumd.dll
                                                          Filesize

                                                          179KB

                                                          MD5

                                                          4dc11547a5fc28ca8f6965fa21573481

                                                          SHA1

                                                          d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                          SHA256

                                                          e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                          SHA512

                                                          bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{8dd8da7d-bbe8-7e48-9bd5-192e20d41290}\x64\lci_proxyumd32.dll
                                                          Filesize

                                                          135KB

                                                          MD5

                                                          67ae7b2c36c9c70086b9d41b4515b0a8

                                                          SHA1

                                                          ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                          SHA256

                                                          79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                          SHA512

                                                          4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                          Download Submit

                                                        • C:\Windows\System32\DriverStore\Temp\{8dd8da7d-bbe8-7e48-9bd5-192e20d41290}\x64\lci_proxywddm.sys
                                                          Filesize

                                                          119KB

                                                          MD5

                                                          b9b0e9b4d93b18b99ece31a819d71d00

                                                          SHA1

                                                          2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                          SHA256

                                                          0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                          SHA512

                                                          465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                          Download Submit

                                                        • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-02-14-49.dat
                                                          Filesize

                                                          602B

                                                          MD5

                                                          64a73b81930dff77fa6a2174c5cca39f

                                                          SHA1

                                                          9cdd1a39d9683e52118983498eb684b28cc2527e

                                                          SHA256

                                                          04d5ed9ed421081ea932aa70ee5a49c8baf7ac93cd657ca61af05ec8dc3ac04f

                                                          SHA512

                                                          3df91914136d9f9ac329ec948aaa5c9512b4a78f8adc314667517311b5aa8d36c03339982219f13a32271724278dd2cc132145934cd1fdacfb69db46e090138f

                                                          Download Submit

                                                        • C:\Windows\Temp\InstallUtil.log
                                                          Filesize

                                                          4KB

                                                          MD5

                                                          434076512dbbf55110939c7ee762dc5c

                                                          SHA1

                                                          cfe684c8b2cf55eac40296d6d329107683f2b151

                                                          SHA256

                                                          fe5425d777c4a75fb497c332e7466e36fb0992ba51d027ef29aca368eabf97c3

                                                          SHA512

                                                          6343d4c4d13b56049dc0b0dd8c3a2588540ae32758d7349fb38fe87e01e13f588f109d0f8f355db9f320dc3c842353aabafcfc3e22a75eed7aad1077a0263aed

                                                          Download Submit

                                                        • C:\Windows\Temp\unpack.log
                                                          Filesize

                                                          4KB

                                                          MD5

                                                          45077ad41404ae95d9649aa5cb156831

                                                          SHA1

                                                          34488185bb042e265f8f148182a8c4a3319d5d91

                                                          SHA256

                                                          121414c44dc689de0729eba4695d0b9debd311c961136ebefb08bad20cb23ed9

                                                          SHA512

                                                          3d3eb5dbef3be39ddd3204b6e8dc28e4290cddad654c56b08d3683076e0e744dfdf8f2a1617a676fe1bbc0c4e28c87c85f88b31c30b895fdd7ba7287b59cf143

                                                          Download Submit

                                                        • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                          Filesize

                                                          2.7MB

                                                          MD5

                                                          df5eb1af99091a902effa52463eda084

                                                          SHA1

                                                          b04578b36490a4ec0092e9a44ae6b2679670450a

                                                          SHA256

                                                          83ef8e362af27279b63ef28379675a087984791e5eaf4a9272a5cb4e52dd059c

                                                          SHA512

                                                          663e11667ec5c6c7969ce61f90d869f3723cbd007236150478ef6dbd861ddc75cf5f96b0345319bd178cd87045daa39a0d6ca4af83cf8dcdb4ebe7462d3eeabd

                                                          Download Submit

                                                        • C:\Windows\Temp\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\ISRT.dll
                                                          Filesize

                                                          427KB

                                                          MD5

                                                          85315ad538fa5af8162f1cd2fce1c99d

                                                          SHA1

                                                          31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                          SHA256

                                                          70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                          SHA512

                                                          877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                          Download Submit

                                                        • C:\Windows\Temp\{320BCFD2-4167-425A-80CB-31EB9FD02ADC}\_isres_0x0409.dll
                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          befe2ef369d12f83c72c5f2f7069dd87

                                                          SHA1

                                                          b89c7f6da1241ed98015dc347e70322832bcbe50

                                                          SHA256

                                                          9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                          SHA512

                                                          760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                          Download Submit

                                                        • C:\Windows\Temp\{AB0D9404-981E-48A4-B0AA-620DF235068C}\IsConfig.ini
                                                          Filesize

                                                          571B

                                                          MD5

                                                          de10be3435fbcab7eeccaa67e2431619

                                                          SHA1

                                                          7afdb3c4c042692ea3f19f2d2275bada7cacfbfd

                                                          SHA256

                                                          d193eda99410268676293d315164ff29cd263ca0251a0238592a23a9d78476b0

                                                          SHA512

                                                          bda2f23885d4bb07c328622d7f637379f63f08b57eb54c4a665fb56d5f68e61d36ff4b4e3cc2b8b2b3d3c5f2e0d3dbb581770eec4fddf9a8c0f4b6555ad3c1af

                                                          Download Submit

                                                        • C:\Windows\Temp\{AB0D9404-981E-48A4-B0AA-620DF235068C}\String1033.txt
                                                          Filesize

                                                          182KB

                                                          MD5

                                                          1d4329601bef6492cd3227df5bcd5125

                                                          SHA1

                                                          d03a3c50ba7663b52c13b54b08b9284f40e4f848

                                                          SHA256

                                                          bd703470b2f35e3c4d917d3038bf806fcc7c155142d300806c95500274951efd

                                                          SHA512

                                                          b0cfc1aef000d428d1ff4f2df41539284a048571e26a2c1a217093e593e546f5af79bbc61be8458021a9829a7d79f68cb8728bf942475096b53c81a66094dd7b

                                                          Download Submit

                                                        • C:\Windows\Temp\{AB0D9404-981E-48A4-B0AA-620DF235068C}\_is24E.exe
                                                          Filesize

                                                          179KB

                                                          MD5

                                                          7a1c100df8065815dc34c05abc0c13de

                                                          SHA1

                                                          3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                          SHA256

                                                          e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                          SHA512

                                                          bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                          Download Submit

                                                        • C:\Windows\Temp\{AB0D9404-981E-48A4-B0AA-620DF235068C}\setup.inx
                                                          Filesize

                                                          345KB

                                                          MD5

                                                          0376dd5b7e37985ea50e693dc212094c

                                                          SHA1

                                                          02859394164c33924907b85ab0aaddc628c31bf1

                                                          SHA256

                                                          c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                          SHA512

                                                          69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                          Download Submit

                                                        • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                          Filesize

                                                          404B

                                                          MD5

                                                          47227fb0f2b16316b6c6910e075474ab

                                                          SHA1

                                                          e054c643bf18fc4a45eb5b72ec1f9b185ce316ef

                                                          SHA256

                                                          74aee475e8e7701689039423dc3251cb75d858c2a7e658bb9b2e546cafe7109a

                                                          SHA512

                                                          fc17643e3a4602f4470da7b8766985649d71a814c14a10573e326cd4dfeac000ab65f5f6e1667131161f8a4e084a305fa0f12d79e81a43decdb83e9ce6ef7af2

                                                          Download Submit

                                                        • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                          Filesize

                                                          412B

                                                          MD5

                                                          4a40049aefa373880133d32421bf50cb

                                                          SHA1

                                                          226a7637910d3d8b6b26f5abccfb0c08bcc6ca69

                                                          SHA256

                                                          c54f8f2c2cf5a083413cc0f0134afa4bdec0a2c3cc7cb1a603f2577cb459887d

                                                          SHA512

                                                          091b3035f082ca6a50d25dbecb85ce749a9546e769430f768e911eee2935d7f35f497d597465ce5229836b6afb4e3371057d90bc0d56e94a2d57517dace83da8

                                                          Download Submit

                                                        • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                          Filesize

                                                          24.1MB

                                                          MD5

                                                          9edcea7a46a1b65703b3242a2296fcc3

                                                          SHA1

                                                          4c431da2791afa833083d251e4e667e0ddc1f151

                                                          SHA256

                                                          91f64f20e5261215b14a77e78d08837f427cf2ff865285a6bdf2a18976f0e018

                                                          SHA512

                                                          bccd5df5279381d108d9f844d79a96700e02ac8c20040ee4ff09e2835d8c20aa69403dccc122ad1785ceffa93d8eb020306eb1a85f26ac4ff464e5d34924cbcc

                                                          Download Submit

                                                        • \??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{348cd1fb-0cd1-4858-8847-780c70ebd366}_OnDiskSnapshotProp
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          0587f3ab4e14ee5a20f819d1164add84

                                                          SHA1

                                                          bc2d0261eb6539ce6e97b9633ff354a447afae54

                                                          SHA256

                                                          281cfa5670eba7f8a7b472bca3d0baef558f912a03c83ea0fcb864483829b978

                                                          SHA512

                                                          d0221308174da965963e499ef54bbdaa43699ad30791ddf78954b1e3816a5dc04796e561ff55cb08c243db0f9864e1cd91e5d30b295445da9fc19cf96296ba9c

                                                          Download Submit

                                                        • memory/508-300-0x000001C8E6FB0000-0x000001C8E6FC6000-memory.dmp

                                                          Filesize

                                                          88KB

                                                          Download

                                                        • memory/508-301-0x000001C8E79A0000-0x000001C8E7A52000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/508-302-0x000001C8E7390000-0x000001C8E73AC000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/1224-1767-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/1224-1766-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/1224-1188-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/1224-1190-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/1224-1189-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/1224-1770-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/1428-496-0x0000023FE8930000-0x0000023FE8956000-memory.dmp

                                                          Filesize

                                                          152KB

                                                          Download

                                                        • memory/2112-1674-0x000001D2F7F00000-0x000001D2F7F26000-memory.dmp

                                                          Filesize

                                                          152KB

                                                          Download

                                                        • memory/2432-166-0x0000022ED9220000-0x0000022ED9232000-memory.dmp

                                                          Filesize

                                                          72KB

                                                          Download

                                                        • memory/2432-162-0x0000022EF32E0000-0x0000022EF3378000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/2432-167-0x0000022EDA9F0000-0x0000022EDAA2C000-memory.dmp

                                                          Filesize

                                                          240KB

                                                          Download

                                                        • memory/2432-150-0x0000022ED8C90000-0x0000022ED8CB8000-memory.dmp

                                                          Filesize

                                                          160KB

                                                          Download

                                                        • memory/2448-82-0x0000000004D20000-0x0000000005074000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                          Download

                                                        • memory/2448-81-0x0000000004B40000-0x0000000004B62000-memory.dmp

                                                          Filesize

                                                          136KB

                                                          Download

                                                        • memory/2448-78-0x0000000004C60000-0x0000000004D12000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/2504-112-0x0000000005020000-0x0000000005086000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/2612-1807-0x000001EA86BF0000-0x000001EA86C3A000-memory.dmp

                                                          Filesize

                                                          296KB

                                                          Download

                                                        • memory/2612-1806-0x000001EA86230000-0x000001EA86242000-memory.dmp

                                                          Filesize

                                                          72KB

                                                          Download

                                                        • memory/2612-1808-0x000001EA86BA0000-0x000001EA86BBC000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/3372-356-0x0000019E702E0000-0x0000019E70348000-memory.dmp

                                                          Filesize

                                                          416KB

                                                          Download

                                                        • memory/3372-355-0x0000019E6FA40000-0x0000019E6FA48000-memory.dmp

                                                          Filesize

                                                          32KB

                                                          Download

                                                        • memory/3372-350-0x0000019E6F5A0000-0x0000019E6F5AA000-memory.dmp

                                                          Filesize

                                                          40KB

                                                          Download

                                                        • memory/3372-359-0x0000019E70270000-0x0000019E70296000-memory.dmp

                                                          Filesize

                                                          152KB

                                                          Download

                                                        • memory/3372-358-0x0000019E71180000-0x0000019E711BA000-memory.dmp

                                                          Filesize

                                                          232KB

                                                          Download

                                                        • memory/3372-345-0x0000019E6F970000-0x0000019E6F9BA000-memory.dmp

                                                          Filesize

                                                          296KB

                                                          Download

                                                        • memory/3372-349-0x0000019E6F590000-0x0000019E6F598000-memory.dmp

                                                          Filesize

                                                          32KB

                                                          Download

                                                        • memory/3372-351-0x0000019E70350000-0x0000019E7042C000-memory.dmp

                                                          Filesize

                                                          880KB

                                                          Download

                                                        • memory/3372-352-0x0000019E70430000-0x0000019E704E2000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/3372-353-0x0000019E6F840000-0x0000019E6F848000-memory.dmp

                                                          Filesize

                                                          32KB

                                                          Download

                                                        • memory/3372-354-0x0000019E6FA30000-0x0000019E6FA38000-memory.dmp

                                                          Filesize

                                                          32KB

                                                          Download

                                                        • memory/3372-348-0x0000019E70120000-0x0000019E70168000-memory.dmp

                                                          Filesize

                                                          288KB

                                                          Download

                                                        • memory/3372-346-0x0000019E6F3D0000-0x0000019E6F3EC000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/3372-347-0x0000019E6F9C0000-0x0000019E6FA0C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                          Download

                                                        • memory/3372-357-0x0000019E702A0000-0x0000019E702CA000-memory.dmp

                                                          Filesize

                                                          168KB

                                                          Download

                                                        • memory/3372-344-0x0000019E6EEE0000-0x0000019E6EF44000-memory.dmp

                                                          Filesize

                                                          400KB

                                                          Download

                                                        • memory/3652-197-0x000001C4E0950000-0x000001C4E0A02000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/3652-203-0x000001C4E0890000-0x000001C4E08B2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                          Download

                                                        • memory/3652-243-0x000001C4E0E50000-0x000001C4E0E88000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/3768-1293-0x0000020FA0E80000-0x0000020FA0E9C000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/3768-1292-0x0000020FA0A80000-0x0000020FA0A92000-memory.dmp

                                                          Filesize

                                                          72KB

                                                          Download

                                                        • memory/3768-1294-0x0000020FB9C50000-0x0000020FB9D02000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/3768-1670-0x0000020FB9B90000-0x0000020FB9BE4000-memory.dmp

                                                          Filesize

                                                          336KB

                                                          Download

                                                        • memory/4068-1268-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4068-1269-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4068-1267-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4068-2464-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4068-2465-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4068-2463-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4068-1187-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4068-1186-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4068-1185-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4160-1173-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4160-1763-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4160-2180-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4160-1762-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4160-1254-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4160-1253-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4160-1250-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4160-2181-0x00000000731C0000-0x00000000732DC000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4160-1764-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4160-1172-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4160-1171-0x00000000732E0000-0x00000000733DD000-memory.dmp

                                                          Filesize

                                                          1012KB

                                                          Download

                                                        • memory/4160-2182-0x0000000072DF0000-0x00000000731B4000-memory.dmp

                                                          Filesize

                                                          3.8MB

                                                          Download

                                                        • memory/4172-44-0x0000000004F10000-0x0000000004F1C000-memory.dmp

                                                          Filesize

                                                          48KB

                                                          Download

                                                        • memory/4172-39-0x0000000004EE0000-0x0000000004F0E000-memory.dmp

                                                          Filesize

                                                          184KB

                                                          Download

                                                        • memory/4428-1118-0x0000000010000000-0x0000000010114000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4428-1046-0x0000000010000000-0x0000000010114000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4428-947-0x00000000033F0000-0x00000000035B7000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                          Download

                                                        • memory/4428-944-0x0000000010000000-0x0000000010114000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4428-526-0x00000000033B0000-0x0000000003577000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                          Download

                                                        • memory/4428-523-0x0000000010000000-0x0000000010114000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                          Download

                                                        • memory/4908-278-0x000001E5C7C80000-0x000001E5C7C9C000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/4908-277-0x000001E5E0960000-0x000001E5E0A10000-memory.dmp

                                                          Filesize

                                                          704KB

                                                          Download

                                                        • memory/4908-274-0x000001E5C77A0000-0x000001E5C77D0000-memory.dmp

                                                          Filesize

                                                          192KB

                                                          Download

                                                        • memory/5180-1804-0x0000020024080000-0x000002002409A000-memory.dmp

                                                          Filesize

                                                          104KB

                                                          Download

                                                        • memory/5180-1797-0x0000020023730000-0x000002002373A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                          Download

                                                        • memory/5420-1795-0x000002C323B80000-0x000002C323C32000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/5420-1790-0x000002C30AA20000-0x000002C30AA2C000-memory.dmp

                                                          Filesize

                                                          48KB

                                                          Download

                                                        • memory/5420-1791-0x000002C30B3A0000-0x000002C30B3B8000-memory.dmp

                                                          Filesize

                                                          96KB

                                                          Download

                                                        • memory/5620-1799-0x000001F373EF0000-0x000001F373F00000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/5620-1798-0x000001F373B40000-0x000001F373B50000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/5620-1800-0x000001F374690000-0x000001F374742000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/5620-1801-0x000001F374000000-0x000001F374020000-memory.dmp

                                                          Filesize

                                                          128KB

                                                          Download

                                                        • memory/5660-1805-0x00000195BC450000-0x00000195BC498000-memory.dmp

                                                          Filesize

                                                          288KB

                                                          Download

                                                        • memory/5660-1573-0x00000195A3300000-0x00000195A333A000-memory.dmp

                                                          Filesize

                                                          232KB

                                                          Download

                                                        • memory/5660-1789-0x00000195BC4A0000-0x00000195BC552000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/5660-1792-0x00000195BC3E0000-0x00000195BC3FC000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/5744-1802-0x000001FD655C0000-0x000001FD655CC000-memory.dmp

                                                          Filesize

                                                          48KB

                                                          Download

                                                        • memory/5752-1612-0x000001B0DBF80000-0x000001B0DBFE6000-memory.dmp

                                                          Filesize

                                                          408KB

                                                          Download

                                                        • memory/5752-1568-0x000001B0C2310000-0x000001B0C2320000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/5752-1649-0x000001B0C2BA0000-0x000001B0C2BB4000-memory.dmp

                                                          Filesize

                                                          80KB

                                                          Download

                                                        • memory/5752-1595-0x000001B0DB440000-0x000001B0DB4F2000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/5752-1590-0x000001B0C2B50000-0x000001B0C2B70000-memory.dmp

                                                          Filesize

                                                          128KB

                                                          Download

                                                        • memory/5880-1673-0x0000026C846D0000-0x0000026C846DA000-memory.dmp

                                                          Filesize

                                                          40KB

                                                          Download

                                                        • memory/5880-1594-0x0000026C842C0000-0x0000026C842F4000-memory.dmp

                                                          Filesize

                                                          208KB

                                                          Download

                                                        • memory/5880-1672-0x0000026C84B70000-0x0000026C84B88000-memory.dmp

                                                          Filesize

                                                          96KB

                                                          Download

                                                        • memory/5880-1712-0x0000026C9D410000-0x0000026C9D45A000-memory.dmp

                                                          Filesize

                                                          296KB

                                                          Download

                                                        • memory/5880-1663-0x0000026C84B50000-0x0000026C84B6C000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/5880-1611-0x0000026C9D3C0000-0x0000026C9D40A000-memory.dmp

                                                          Filesize

                                                          296KB

                                                          Download

                                                        • memory/5900-1596-0x0000018FDFCE0000-0x0000018FDFCFC000-memory.dmp

                                                          Filesize

                                                          112KB

                                                          Download

                                                        • memory/5900-1671-0x0000018FF87E0000-0x0000018FF88BC000-memory.dmp

                                                          Filesize

                                                          880KB

                                                          Download

                                                        • memory/5900-1732-0x0000018FF88C0000-0x0000018FF8972000-memory.dmp

                                                          Filesize

                                                          712KB

                                                          Download

                                                        • memory/5900-1592-0x0000018FDF4A0000-0x0000018FDF4B0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/5900-1593-0x0000018FDFD60000-0x0000018FDFDAA000-memory.dmp

                                                          Filesize

                                                          296KB

                                                          Download

                                                        • memory/5900-1803-0x0000018FDFD30000-0x0000018FDFD38000-memory.dmp

                                                          Filesize

                                                          32KB

                                                          Download