Overview

overview

10

Static

static

1

f065892060...72.msi

windows7-x64

10

f065892060...72.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 12:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72.msi

  • Size

    2.6MB

  • MD5

    055047fe65e1d28dd3bb2e53a9bbcf31

  • SHA1

    126af029786aae23fb19e4ab3b71d50a04880393

  • SHA256

    f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72

  • SHA512

    94da78ac9c85e16e628872ba1d318db1733bb917711836df73b30b5d9825d6f04db5418c094220a20886ecd892e5721238ab47e1ca7b7674c163fa35a91c0ddf

  • SSDEEP

    49152:sBRNlatz55q6jzoz//stPEqQpTIQW8MQ6M97ouRUbFFOV47S9gonUI:MRNlap55qAczWgW9MxcFFOV42+

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Blocklisted process makes network request 5 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 12 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1636
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4364
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 255AAD0E4CFD73B2DB7D00628B9BF6D8
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI1325.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653343 2 AlphaControlAgentInstallationDialog!AlphaControlAgentInstallationDialog.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1516
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="4" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId=""
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1076
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F7578A6F89F32861DDFBDB0AADA9FC04 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{780B913C-02B2-4331-B0B4-9238CCE39CF9}
          3⤵
          • Executes dropped EXE
          PID:5176
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5793354C-EAF4-4A93-A09C-6A1DF9FC2F2E}
          3⤵
          • Executes dropped EXE
          PID:5224
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5CBC7C1A-F805-4F4B-AE18-83D82B317A60}
          3⤵
          • Executes dropped EXE
          PID:5256
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2BA7BB16-7117-4449-BDD7-61647048286D}
          3⤵
          • Executes dropped EXE
          PID:5288
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{79851274-6B2E-4727-AFC0-7D7188DB25CF}
          3⤵
          • Executes dropped EXE
          PID:5328
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A73BA58B-AD43-4144-8ACD-FE953B178D7D}
          3⤵
          • Executes dropped EXE
          PID:5416
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2F9D98B-1492-4765-B67B-9E075AA00D4B}
          3⤵
          • Executes dropped EXE
          PID:5448
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1C4C3258-380D-4F61-8CC5-0351AB7E2268}
          3⤵
          • Executes dropped EXE
          PID:5492
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9DE27299-8869-44A8-B1AF-86D6693CE487}
          3⤵
          • Executes dropped EXE
          PID:5528
        • C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe
          C:\Windows\TEMP\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_is5F61.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61848100-146B-403E-A069-A7D32C18D0E7}
          3⤵
          • Executes dropped EXE
          PID:5560
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5604
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5656
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5688
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5740
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5768
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5820
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5852
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5904
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5936
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5988
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:6020
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6064
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:6092
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6136
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3320
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2232
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1772
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5188
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5248
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            4⤵
              PID:5224
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill.exe /F /IM SRVirtualDisplay.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:5300
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9EC222DE-898F-477B-A6A0-B1BDDC2C654B}
            3⤵
            • Executes dropped EXE
            PID:5464
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46246606-EF32-45D8-89D6-447E46D272A8}
            3⤵
            • Executes dropped EXE
            PID:5200
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{507E001F-CCB4-4A35-B7AD-ADEBA3E387A0}
            3⤵
            • Executes dropped EXE
            PID:2976
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{238DDF01-9DA8-49BC-86E1-7D68ADD87451}
            3⤵
            • Executes dropped EXE
            PID:4720
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA5047D0-3887-4F86-ADD5-65EA54FFE1F7}
            3⤵
            • Executes dropped EXE
            PID:1376
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4A1007B6-427D-4F7D-980A-CA7F4F141405}
            3⤵
            • Executes dropped EXE
            PID:5528
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91BB9DFE-038F-4ABB-87C1-970C68849937}
            3⤵
            • Executes dropped EXE
            PID:5560
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1BFEDC48-4643-4559-A0A9-BE653EE07B30}
            3⤵
            • Executes dropped EXE
            PID:5668
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4BDEFA85-D6A6-4FDE-807F-623108219526}
            3⤵
            • Executes dropped EXE
            PID:5636
          • C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
            C:\Windows\TEMP\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FFBCCE10-DF8A-496A-A99E-FB7E238A3594}
            3⤵
            • Executes dropped EXE
            PID:5756
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8E30BE4-30A0-4FB7-B2CF-5927827469FA}
            3⤵
            • Executes dropped EXE
            PID:6072
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9BA5E38A-2F83-4E8D-A49D-9A3D99312E45}
            3⤵
            • Executes dropped EXE
            PID:6028
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B08E72C1-5D14-4188-8B8F-4EA6B1E1115A}
            3⤵
            • Executes dropped EXE
            PID:6136
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F45A9061-2ADF-44DD-B926-10D437B656DC}
            3⤵
            • Executes dropped EXE
            PID:3840
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB800FC3-2098-4BCE-ABF8-5C4174B47628}
            3⤵
            • Executes dropped EXE
            PID:2232
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC105185-4EE6-459B-BB03-DA8793C5DC93}
            3⤵
            • Executes dropped EXE
            PID:5212
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BEC7C3BC-22AF-4701-B003-3BAE0861A3DB}
            3⤵
            • Executes dropped EXE
            PID:5276
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0D85235D-6DB1-4509-979E-7BC78AE51294}
            3⤵
            • Executes dropped EXE
            PID:5300
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0238C6E-8945-43E3-A242-FE38FEFBD486}
            3⤵
            • Executes dropped EXE
            PID:5224
          • C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe
            C:\Windows\TEMP\{E2C80CA5-D085-4067-9B93-11549C6E1525}\_is8867.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8477E5AB-3F37-45A6-A761-B304DC22B5BB}
            3⤵
            • Executes dropped EXE
            PID:5424
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5480
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4128
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:5620
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:5668
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                4⤵
                  PID:5976
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1920
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AD5EE09C-F611-4A34-A791-2F96D70D6874}
                3⤵
                • Executes dropped EXE
                PID:4112
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35F933B5-214F-47F8-BCE0-C66DA8895B28}
                3⤵
                • Executes dropped EXE
                PID:5964
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5CF7CF2-3F9E-4BF8-9674-826F45B381B6}
                3⤵
                • Executes dropped EXE
                PID:6084
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A556A169-AEE0-4E27-8350-62C02ECBD49B}
                3⤵
                • Executes dropped EXE
                PID:6056
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{444CDFFD-252A-421B-83EF-B1EEF5E7E730}
                3⤵
                • Executes dropped EXE
                PID:6028
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{840867C8-4B92-4B76-A699-6C2BB2103059}
                3⤵
                • Executes dropped EXE
                PID:5140
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8FAC427B-1A6F-435C-BBA6-73D5F12D4358}
                3⤵
                • Executes dropped EXE
                PID:5184
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AFEFA06D-FCAE-47CC-BE87-58F285F6E51F}
                3⤵
                • Executes dropped EXE
                PID:6016
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{233BA58F-329E-4B20-B08A-B8A30BE87074}
                3⤵
                • Executes dropped EXE
                PID:2784
              • C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe
                C:\Windows\TEMP\{A0991835-4AF3-4837-B163-94A230A034B9}\_is9F0E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8DEC5C36-B227-4FD5-A4F6-7A5B8785D356}
                3⤵
                • Executes dropped EXE
                PID:5256
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:5104
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4756C6C-86E7-488E-B0C7-5FF6D28C2D4D}
                3⤵
                • Executes dropped EXE
                PID:5364
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7F56C9E4-4AFE-40A7-896A-010A1391918B}
                3⤵
                • Executes dropped EXE
                PID:5484
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{99ABC0A6-C6BB-44BE-B5F5-9A2DCE446F07}
                3⤵
                • Executes dropped EXE
                PID:4580
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00CEE12F-BD5A-41BE-B42B-163091157377}
                3⤵
                • Executes dropped EXE
                PID:2976
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9BDD322-284B-4576-B5C4-B8F4EBA97BB3}
                3⤵
                • Executes dropped EXE
                PID:1516
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A36C411-3846-49EC-9FF8-EBFE9621C7F2}
                3⤵
                • Executes dropped EXE
                PID:5544
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0376D02A-B8C2-4FF2-BBEB-F4D531C79B86}
                3⤵
                • Executes dropped EXE
                PID:5596
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D63905AB-EB93-44B6-9324-AF1F76FE62BA}
                3⤵
                • Executes dropped EXE
                PID:5612
              • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3BD54284-0B9F-496B-B4FA-ED2C903FB58C}
                3⤵
                  PID:2684
                • C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe
                  C:\Windows\TEMP\{3FF5E0A2-3495-48AA-B5E5-27339966B86E}\_isA410.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E4650DAE-CA04-4417-91B5-C7F8E35807D4}
                  3⤵
                    PID:5704
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5784
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 7F9B6216702C89913521466E236CD053 E Global\MSI0000
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5780
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSID077.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240701796 439 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                    3⤵
                    • Drops file in Windows directory
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:5644
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSID26C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702046 443 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:4236
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSID607.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702984 448 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                    3⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5776
                  • C:\Windows\syswow64\NET.exe
                    "NET" STOP AteraAgent
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5188
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2580
                  • C:\Windows\syswow64\TaskKill.exe
                    "TaskKill.exe" /f /im AteraAgent.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    PID:5728
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Windows\Installer\MSI462.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714828 476 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                    3⤵
                    • Blocklisted process makes network request
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2684
                • C:\Windows\system32\NET.exe
                  NET STOP AteraAgent
                  2⤵
                    PID:5072
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 STOP AteraAgent
                      3⤵
                        PID:216
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im AteraAgent.exe
                      2⤵
                      • Kills process with taskkill
                      PID:5672
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                      2⤵
                      • Drops file in System32 directory
                      PID:5052
                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                      "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="6dd3fa4d-1bad-489d-a490-fedabe15ec0e"
                      2⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:4420
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1796
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                    1⤵
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4868
                    • C:\Windows\System32\sc.exe
                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                      2⤵
                      • Launches sc.exe
                      PID:1508
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "7fbe50a7-192c-47fe-9804-68c9b3393926" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification"
                      2⤵
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      PID:2676
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "dd4c055c-5c35-4aeb-8f00-7f97f144a32d" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification"
                      2⤵
                      • Executes dropped EXE
                      PID:4488
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "e0c86c9d-f467-455b-ac67-8cbea9cf9f13" agent-api.atera.com/Production 443 or8ixLi90Mf "identified"
                      2⤵
                      • Executes dropped EXE
                      PID:3332
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "b9238f76-f001-4920-8940-d46a8ee894fe" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui"
                      2⤵
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Suspicious use of WriteProcessMemory
                      PID:5004
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3288
                        • C:\Windows\system32\cscript.exe
                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                          4⤵
                          • Modifies data under HKEY_USERS
                          • Modifies system certificate store
                          PID:2412
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "954fe380-fe94-4405-b710-41cc7f1f4f0d" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0="
                      2⤵
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:940
                      • C:\Windows\TEMP\SplashtopStreamer.exe
                        "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2396
                        • C:\Windows\Temp\unpack\PreVerCheck.exe
                          "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1392
                          • C:\Windows\SysWOW64\msiexec.exe
                            msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:3604
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "3cbb20f3-fbef-4bc2-bc13-e191793e6fdd" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile"
                      2⤵
                      • Drops file in System32 directory
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5028
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                    1⤵
                    • Drops file in Program Files directory
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of WriteProcessMemory
                    PID:228
                    • C:\Windows\System32\sc.exe
                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                      2⤵
                      • Launches sc.exe
                      PID:3840
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "9e182a13-064e-4d6f-97ba-b81759e6b6ee" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo"
                      2⤵
                      • Drops file in Program Files directory
                      PID:5488
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        3⤵
                          PID:3016
                          • C:\Windows\system32\cscript.exe
                            cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            4⤵
                            • Modifies data under HKEY_USERS
                            PID:5080
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "882f5855-715e-461b-ab98-912f08eb2b37" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates"
                        2⤵
                          PID:5760
                          • C:\Windows\SYSTEM32\msiexec.exe
                            "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                            3⤵
                              PID:876
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "a5eadcc6-3b9d-4923-ba90-ff493bdfe528" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded"
                            2⤵
                              PID:5848
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=d53a732f7e632d7b39f50f90927dc8e1&rmm_session_pwd_ttl=86400"
                                3⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:2556
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "9dd812db-c06c-48bf-9f4e-1b3c330edd45" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain"
                              2⤵
                              • Drops file in System32 directory
                              • Modifies registry class
                              PID:1620
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "6e3eac87-9857-42ab-95d6-76c67fbcc567" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat"
                              2⤵
                              • Drops file in System32 directory
                              PID:5892
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "92b052ed-702d-487a-b212-5c9215562a0a" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision"
                              2⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:5516
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "411e38b5-8f56-448f-a3d0-e8e76f7a5e51" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ=="
                              2⤵
                              • Drops file in System32 directory
                              PID:4572
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "8d4d3e26-5058-42fc-8cf7-55e1badd9c2f" agent-api.atera.com/Production 443 or8ixLi90Mf "probe"
                              2⤵
                                PID:5544
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "17110bc5-688e-49d7-9d4f-e69d2b50153e" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll"
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                PID:3528
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "a43f5ccc-07c3-433a-9ef7-8df42b5e9809" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps"
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                PID:2680
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  3⤵
                                    PID:4360
                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "ef8accdb-d5a3-4f60-9a28-dfbbb85e7d2d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9"
                                  2⤵
                                  • Drops file in System32 directory
                                  PID:4108
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                    3⤵
                                    • System Time Discovery
                                    PID:1920
                                    • C:\Program Files\dotnet\dotnet.exe
                                      dotnet --list-runtimes
                                      4⤵
                                      • System Time Discovery
                                      PID:3600
                                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "73518d6a-8a08-492d-9e2e-4a0d43e734b9" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates"
                                  2⤵
                                    PID:5280
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "c6bd9641-aad2-4d27-8bda-91e1c17d3ca1" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ=="
                                    2⤵
                                      PID:2288
                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "6a691292-a69a-4201-af97-e475793ddee7" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor"
                                      2⤵
                                      • Writes to the Master Boot Record (MBR)
                                      • Loads dropped DLL
                                      • Modifies data under HKEY_USERS
                                      PID:5004
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                    1⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5812
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                      2⤵
                                      • Drops file in System32 directory
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4508
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                        -h -t
                                        3⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:6088
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                        3⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5964
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                          4⤵
                                            PID:3144
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:6052
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                          3⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:3644
                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                            SRUtility.exe -r
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:4360
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies data under HKEY_USERS
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5468
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                            4⤵
                                              PID:3984
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ver
                                                5⤵
                                                  PID:5384
                                                • C:\Windows\system32\sc.exe
                                                  sc query ddmgr
                                                  5⤵
                                                  • Launches sc.exe
                                                  PID:5992
                                                • C:\Windows\system32\sc.exe
                                                  sc query lci_proxykmd
                                                  5⤵
                                                  • Launches sc.exe
                                                  PID:5192
                                                • C:\Windows\system32\rundll32.exe
                                                  rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                                  5⤵
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • Checks SCSI registry key(s)
                                                  • Modifies data under HKEY_USERS
                                                  PID:4060
                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                          C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                                          1⤵
                                            PID:1516
                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                            1⤵
                                            • Drops file in Program Files directory
                                            • Modifies data under HKEY_USERS
                                            PID:2784
                                            • C:\Windows\System32\sc.exe
                                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                              2⤵
                                              • Launches sc.exe
                                              PID:5096
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "48d9f57a-d360-46e9-b86d-f436144d3512" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002pMd9hAAC
                                              2⤵
                                                PID:3840
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                  3⤵
                                                    PID:3604
                                                    • C:\Windows\system32\cscript.exe
                                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                      4⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:5804
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "7d99e435-2766-4705-b679-10897e9b5dcd" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002pMd9hAAC
                                                  2⤵
                                                    PID:5832
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "21ffed2e-54b4-4fe1-ac15-206c84d2b000" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002pMd9hAAC
                                                    2⤵
                                                      PID:5828
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "54d0960f-cf8b-46de-9c4f-fb587262ff85" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002pMd9hAAC
                                                      2⤵
                                                      • Drops file in Program Files directory
                                                      PID:1592
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "79cc8d03-4464-41e5-9d6b-cd6ed5e98893" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002pMd9hAAC
                                                      2⤵
                                                        PID:372
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "429082b1-b3ad-416c-bdab-97eec81944b7" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002pMd9hAAC
                                                        2⤵
                                                          PID:5340
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "1cbd0fd7-74f0-484b-9a98-22872adbf90f" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002pMd9hAAC
                                                          2⤵
                                                            PID:1812
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "02404627-6107-4d97-9d57-36f3e68562ff" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002pMd9hAAC
                                                            2⤵
                                                              PID:4232
                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=d53a732f7e632d7b39f50f90927dc8e1&rmm_session_pwd_ttl=86400"
                                                                3⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5552
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "51cd98b0-fd34-4eed-baa9-822f7a4087e9" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002pMd9hAAC
                                                              2⤵
                                                                PID:4664
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "bb02492f-a1e1-453f-a161-ea1e9bf4f3ec" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002pMd9hAAC
                                                                2⤵
                                                                  PID:5924
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                                    3⤵
                                                                    • System Time Discovery
                                                                    PID:2916
                                                                    • C:\Program Files\dotnet\dotnet.exe
                                                                      dotnet --list-runtimes
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:1776
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "14ae9b4e-e8b7-45ae-add2-6efb94631378" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002pMd9hAAC
                                                                  2⤵
                                                                  • Writes to the Master Boot Record (MBR)
                                                                  PID:5384
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "3ba3263e-1f76-429b-9ba6-1720257ed7b3" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002pMd9hAAC
                                                                  2⤵
                                                                    PID:3388
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "0c724d85-4fdb-41ee-b78d-6e0ac6db4965" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002pMd9hAAC
                                                                    2⤵
                                                                    • Modifies registry class
                                                                    PID:1812
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 0b1e6948-366c-4ca8-9346-3deb276ac81b "e89735b1-d9fa-4319-829e-8686040cc3a3" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002pMd9hAAC
                                                                    2⤵
                                                                      PID:5280
                                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "0b1e6948-366c-4ca8-9346-3deb276ac81b" "e89735b1-d9fa-4319-829e-8686040cc3a3" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "0013z00002pMd9hAAC"
                                                                        3⤵
                                                                          PID:5528
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      • Checks SCSI registry key(s)
                                                                      PID:5752
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:3840
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "000000000000016C" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                        2⤵
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:5276
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "000000000000016C"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Checks SCSI registry key(s)
                                                                        PID:2856
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Checks SCSI registry key(s)
                                                                        PID:5544

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Persistence

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Privilege Escalation

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Installer Packages

                                                                    1
                                                                    T1546.016

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    1
                                                                    T1112

                                                                    Pre-OS Boot

                                                                    1
                                                                    T1542

                                                                    Bootkit

                                                                    1
                                                                    T1542.003

                                                                    Subvert Trust Controls

                                                                    1
                                                                    T1553

                                                                    Install Root Certificate

                                                                    1
                                                                    T1553.004

                                                                    System Binary Proxy Execution

                                                                    1
                                                                    T1218

                                                                    Msiexec

                                                                    1
                                                                    T1218.007

                                                                    Credential Access

                                                                    Discovery

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    4
                                                                    T1012

                                                                    System Information Discovery

                                                                    3
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Config.Msi\e58128a.rbs
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      1de0641c549ab9996f4e365fa6ddc1bd

                                                                      SHA1

                                                                      3bd7618c9bf5c016d66e9d809391dfb47262303f

                                                                      SHA256

                                                                      ac5ab2a481eed560c5d7ebb4d04f78a3b1549bc814eb918fcbdd5d601111a0d9

                                                                      SHA512

                                                                      48a52fa9d0fdc3bde05df0d925376af8e54743d450724eb0daf7d828bc8c1a5e155a8559b21526c2a5132419979b690915ebe9a869147bd8604f612906825a34

                                                                      Download Submit

                                                                    • C:\Config.Msi\e58128f.rbs
                                                                      Filesize

                                                                      74KB

                                                                      MD5

                                                                      fe2b0cf5853269b3680ff458af277bb4

                                                                      SHA1

                                                                      8afe653cc0940763927fca8874b7ff69d3fea570

                                                                      SHA256

                                                                      5cee505b3a365016cb3b6f3fb3cb15b9961491fc34bd531ed210b8746f024a47

                                                                      SHA512

                                                                      b741ea9d852cadac5dfd73cfadcdb95aff8f601e957c7f8fa9998913e5a0d27f11c61a4c71ad6ea496d724ee2327cb6c3b909284ba746e977cf59619a0ca2add

                                                                      Download Submit

                                                                    • C:\Config.Msi\e581291.rbs
                                                                      Filesize

                                                                      464B

                                                                      MD5

                                                                      cb827bd023acf6d6938d2cbe229f9a8a

                                                                      SHA1

                                                                      1dd4ac65726b82fa2c4117977a8c6a42e4b9ccab

                                                                      SHA256

                                                                      f19d56c6c96097b3d1b37a970b5e96b80a7f4bb0d41b80dbe4b4e7031637f3cc

                                                                      SHA512

                                                                      bf36b0f969e34cc8de468ea3501764076e6f8eb46e7a462395b9c0b41d9302e05ed09d99966b92c0450fa7bf2ede72ddda857be7e3b5bf54021810dccf9cd6ae

                                                                      Download Submit

                                                                    • C:\Config.Msi\e581297.rbs
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      6e59d3bd2610624bb16cab71ad0982d8

                                                                      SHA1

                                                                      108f4e9ffc317024a9f0b05a9dc8e59ec274efc2

                                                                      SHA256

                                                                      08bbb1198ed6fdd1935f3c7c300af2d0fda644f2422b5cce677b0b7c0e5b990f

                                                                      SHA512

                                                                      acb72856e3eabe3bfb46c7f3b86857fa6b10802de6e08ca3aee15c73b6161ae8dc4155a47ee9523874787f9a1a3c2a63564cf985888f339954e954e8c51663a6

                                                                      Download Submit

                                                                    • C:\Config.Msi\e58129f.rbs
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      58fa32f11dc8d01b0983a8eaea4f8107

                                                                      SHA1

                                                                      ef0e02a13bafa21bf4acb1366bd595452a3c4b76

                                                                      SHA256

                                                                      fe19caaf4baf096f56e83d2af9b1aea1bae8c628c234c075c7161fd49dc18868

                                                                      SHA512

                                                                      c44efc6f629b810017df752c49663a0acc08e38a6560b169ef2f7239d7cb9899f669889240aa43b8304895feb3623b61e61a12b0a7abab3f6258afd1b666e6eb

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      3840b31c383fdf49bfd6740d945c9032

                                                                      SHA1

                                                                      a6f50164a69718bcef4664d7c47534f0d721866a

                                                                      SHA256

                                                                      1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                                      SHA512

                                                                      f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                      Filesize

                                                                      138KB

                                                                      MD5

                                                                      8dd350bb44e45c0b89d0c2cea8e1fd9f

                                                                      SHA1

                                                                      298ccacd3f218f8d98709a43df09acc82178cbf2

                                                                      SHA256

                                                                      127fde9b3c238f66232d0f0db1d3ff62d2c46d16f50aa92073d26977f36f463a

                                                                      SHA512

                                                                      ec8c638a8c616c7fa7989585cd5c577c3bff88801789c5b975e016ec888c0d2a1d3f492d12bbb3618ee93c79c80dc1f666ed9e21ffe595dd7b2f3c9f601e03c0

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                                      SHA1

                                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                      SHA256

                                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                      SHA512

                                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                      Filesize

                                                                      209KB

                                                                      MD5

                                                                      b322ca965d1571b468b8c49d387d7f84

                                                                      SHA1

                                                                      cc1c2fd52c081e36c2b01f05fb2995d0807fcb19

                                                                      SHA256

                                                                      e45af7598efae14255851cf7d23c669af1a0e89fffa64e4e12c59960542ad0da

                                                                      SHA512

                                                                      50cfb1240491efe00760c37150f2f8a7dc6769f58fbeccc811eea9574917f383c510af3bce181efe7515e417fc211314aad48326a296f6c1093ca23ff76c9318

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      693KB

                                                                      MD5

                                                                      fdde119bd5c37341879e1bd1bfce033a

                                                                      SHA1

                                                                      e7228d4dd8a2a0fa7d60f50f68e32560932c3a6a

                                                                      SHA256

                                                                      9a7f775a3d2569ee6a830a7814f1b6068613153b14bc5515ea7644dd51e5972e

                                                                      SHA512

                                                                      8f91ae407ae1998d86e2edadf9b871e31f8b46b24f7285d17e6f221c33ed19623cbb16f4b73f94dde860dd47ad122f38cba7f5810350b049f79d89c417f53ab8

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                      Filesize

                                                                      157KB

                                                                      MD5

                                                                      242d415e238789fbc57c5ac7e8ca5d02

                                                                      SHA1

                                                                      09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                                      SHA256

                                                                      7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                                      SHA512

                                                                      ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                      Filesize

                                                                      51KB

                                                                      MD5

                                                                      3180c705182447f4bcc7ce8e2820b25d

                                                                      SHA1

                                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                      SHA256

                                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                      SHA512

                                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                      Filesize

                                                                      12B

                                                                      MD5

                                                                      dc63026e80d2bb04f71e41916f807e33

                                                                      SHA1

                                                                      6cda386d2c365f94ea3de41e2390fd916622eb51

                                                                      SHA256

                                                                      3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                                      SHA512

                                                                      61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                      Filesize

                                                                      173KB

                                                                      MD5

                                                                      31def444e6135301ea3c38a985341837

                                                                      SHA1

                                                                      f135be75c721af2d5291cb463cbc22a32467084a

                                                                      SHA256

                                                                      36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                                      SHA512

                                                                      bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                      Filesize

                                                                      546B

                                                                      MD5

                                                                      158fb7d9323c6ce69d4fce11486a40a1

                                                                      SHA1

                                                                      29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                      SHA256

                                                                      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                      SHA512

                                                                      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                                      Filesize

                                                                      94KB

                                                                      MD5

                                                                      9d8b5941ea5b905e8197a175ef2b15a9

                                                                      SHA1

                                                                      86a078e94b5578ec4125f50f78c8518a8ce1d086

                                                                      SHA256

                                                                      c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d

                                                                      SHA512

                                                                      fab5fe82873862ce8ed1a427482093cca307f6663e9f6497fdc244ce461312872d419ff274cdca0c496414c28681901f335c9911b95d2a7c112d30e32d74e498

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      688KB

                                                                      MD5

                                                                      ba66874c510645c1fb5fe74f85b32e98

                                                                      SHA1

                                                                      e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                                      SHA256

                                                                      12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                                      SHA512

                                                                      44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                      Filesize

                                                                      27KB

                                                                      MD5

                                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                                      SHA1

                                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                      SHA256

                                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                      SHA512

                                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                      Filesize

                                                                      214KB

                                                                      MD5

                                                                      01807774f043028ec29982a62fa75941

                                                                      SHA1

                                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                      SHA256

                                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                      SHA512

                                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                      Filesize

                                                                      37KB

                                                                      MD5

                                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                                      SHA1

                                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                                      SHA256

                                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                      SHA512

                                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                      Filesize

                                                                      3.4MB

                                                                      MD5

                                                                      e010d1f614b1a830482d3df4ba056f24

                                                                      SHA1

                                                                      5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                      SHA256

                                                                      98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                      SHA512

                                                                      727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.INI
                                                                      Filesize

                                                                      12B

                                                                      MD5

                                                                      5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                                      SHA1

                                                                      93012724e6cc0a298838aede678806e6c0c6517d

                                                                      SHA256

                                                                      a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                                      SHA512

                                                                      890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                      Filesize

                                                                      389KB

                                                                      MD5

                                                                      5e3252e0248b484e76fcdbf8b42a645d

                                                                      SHA1

                                                                      11ae92fd16ac87f6ab755911e85e263253c16516

                                                                      SHA256

                                                                      01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                      SHA512

                                                                      540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      c6ecf24757926eba64e674bff8b747d1

                                                                      SHA1

                                                                      3a46083826c20e8e085c42bbfdfeef4f9e2b90d9

                                                                      SHA256

                                                                      c3ec04142c15b0a237e72ce1c3c85d19cd1231b9824f7a9854e7909a74b7becc

                                                                      SHA512

                                                                      efabb9883adb098a90115e8938c92b76bbb8d2eb5de170ecfa205ee949a2d722e0f97f6e01f9a71ac8b5fa2108b9ff82fa0171759d50e30d0ab5fc1948bdce15

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Atera.AgentPackages.CommonLib.dll
                                                                      Filesize

                                                                      93KB

                                                                      MD5

                                                                      0e5155ecbe5a1797644f1610daa15583

                                                                      SHA1

                                                                      89677e0f9443d52c73d4e0b91c5aee5215ec4e88

                                                                      SHA256

                                                                      9baf23c814dd100b2ac9511c9a2e5302dee1ffb1807dea021e1d317ba36901ca

                                                                      SHA512

                                                                      3f80a871547bdf47f0a5b58f54b9597d0894580fcee8f53dd08c8a80658697fa9c9426ab8d47a40b0cdcf53d11769c654d26a3b530ad39a3a6e37d468ca309d3

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Dapper.dll
                                                                      Filesize

                                                                      151KB

                                                                      MD5

                                                                      12572f87ccf0e40406b3554a1a6d3905

                                                                      SHA1

                                                                      c9e238ef065d38400d084265ee056b2abb694224

                                                                      SHA256

                                                                      6fdb589ebadf91a869eaa3a850b0fb17a8ab96bed78422e28f7efaf63bc040f9

                                                                      SHA512

                                                                      d397888aacb1b787662b1678a24e24ddfa7a42c5363ac673706934a1a42e13f5ed55956d478faf0998c77891a64f5f26e85dcfa7ffc0a6ae87df26b3c24c4314

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\NLog.dll
                                                                      Filesize

                                                                      863KB

                                                                      MD5

                                                                      286642cd396c5b6cadc906b112b493ee

                                                                      SHA1

                                                                      cb625fdbd26798b3042bc5cffd010f4e73cdaf1b

                                                                      SHA256

                                                                      004bf709595e808ae59558ae7510a40277b7e31d99a5580b0e07f136eae09130

                                                                      SHA512

                                                                      49773e5ad432f893c559308da144596ce1dfb967db5fcfb1805528cc7535e70a181ed8801cae43a47b58656c9925a236b06a4f2c67802a1a875a3dce3c9002dd

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      693KB

                                                                      MD5

                                                                      b61a163ec8f1e6a3a3572a90ba23f7cb

                                                                      SHA1

                                                                      467fba9f1c171b58b76f4e9e24aba1ce5c91d02f

                                                                      SHA256

                                                                      87da900259bea3bb65d984fb6fcd3134661e3eb0883ebf24981d50ca5d36f51a

                                                                      SHA512

                                                                      87eadb61d95ef67cea0ec8cf15c2e285aff8c92941adb47dbce6886796de45b4940efa803d2a9333fadd09473e1b1a34660042d12562fb07eaf4a59c401244ca

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\OpenHardwareMonitorLib.dll
                                                                      Filesize

                                                                      286KB

                                                                      MD5

                                                                      3362fdb62a7980ca70c44b4dbda5be9b

                                                                      SHA1

                                                                      77b328fd868e9be19165c39b541e815bad1fe13f

                                                                      SHA256

                                                                      a6b74a797384f89b692f2e1027a3f73b4fad2a97914208158869a33068132a1c

                                                                      SHA512

                                                                      d0441e5c747707434c02a64e8ff3a49edf33cff2c9d22f2c22e8bdfebc30a3cdf79b2ed96b8abd819ecd042876baa77c32e119ebb05ba0ecac73dfe2bf971e86

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\Polly.dll
                                                                      Filesize

                                                                      270KB

                                                                      MD5

                                                                      66c97a4217593113658977f5aefc18d8

                                                                      SHA1

                                                                      a7e4ff9bdb3800c1e93a0d521b53e344a10699ff

                                                                      SHA256

                                                                      9ad65cc593bfc60815124c6377a8f3ea4f031bca01c688fb543b50a2b6418764

                                                                      SHA512

                                                                      d2a474718a38aa0ea738200d7584a5c21552dc76428176026c5509ae606fea534f4aeabedf93d5bae5735754d82b2d93e4cfb67bcfea9a435147d7bb4b1f0722

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\StructureMap.dll
                                                                      Filesize

                                                                      277KB

                                                                      MD5

                                                                      a6d30251ed124d7656f523a7df177d09

                                                                      SHA1

                                                                      48092d267e067c1967b5acf1aebd9a18f0b91515

                                                                      SHA256

                                                                      ec81827b885c0b109aaa3882469bb41d26871274b2e39d3b227fbd18858bf6a3

                                                                      SHA512

                                                                      466809068b5813ac5531d9e5c76ba080a3a15b0d1aff2a7187149cd5366d990dfd07df1d51eeb8fcc656ed5c2d1c099ac32e0416f219fc38b64bd1a2351ee502

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\System.Data.SQLite.dll
                                                                      Filesize

                                                                      399KB

                                                                      MD5

                                                                      5b3639406abb5ad7f16a90124b708862

                                                                      SHA1

                                                                      466db9d6bc5f2a8eb205e5f3a7f2ec8c52809597

                                                                      SHA256

                                                                      83717328623f05f5987dc258332bca21c1f2858b7ce6b834af5da687b0948847

                                                                      SHA512

                                                                      f10717408e0140c8dbefcce9501cf03b86cecd32f2b55770879c28e21d793e45bd8b7eeed52e56e3386000a7beef7f0bdd05ebeff99a44d1056512f48063f71c

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      cd6af04995c443aeb37523e6c826dd4b

                                                                      SHA1

                                                                      1df2cf7e4d5c58f273cd360f9bf1cfa49929ba18

                                                                      SHA256

                                                                      978e96534f36dc2ded9255abe9198cd4aa2f390dbf600f91fb8cf744a483a46c

                                                                      SHA512

                                                                      6f87259e395b352fc92d8fe58b4b1183f3c5618a5204836e3c09aca5fced0313285abc68120d616faaa161ada1ab4bd30bb510ad5d3218ad3b338e4fe0b5a369

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\x64\SQLite.Interop.dll
                                                                      Filesize

                                                                      1.7MB

                                                                      MD5

                                                                      cba9d50085ee939b987cf758c727dd62

                                                                      SHA1

                                                                      ddc0faf68995883ac754662c59c4295bb0a64e3b

                                                                      SHA256

                                                                      75e47a697a46e31811fab8c5d9fe1aba6ba095b6d13dc79a8c848be308917c37

                                                                      SHA512

                                                                      a5f3d1b96535e0b523ecd71dc36fd3af157c630874ff11da29066c545114d256b14a5ee2ba725679c4192182d37df6900aa69ece228bafce909a482dff43a1e0

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                      Filesize

                                                                      196KB

                                                                      MD5

                                                                      5f782d0cb0f717ae9dfd1b4da1295f15

                                                                      SHA1

                                                                      b33575e428e19940f0585c747e054ca70a12d454

                                                                      SHA256

                                                                      0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                                      SHA512

                                                                      e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                      Filesize

                                                                      55KB

                                                                      MD5

                                                                      a739b889642ca9ce4ad3a37a3c521604

                                                                      SHA1

                                                                      18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                                      SHA256

                                                                      44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                                      SHA512

                                                                      92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      9d1528a2ce17522f6de064ae2c2b608e

                                                                      SHA1

                                                                      2f1ce8b589e57ab300bb93dde176689689f75114

                                                                      SHA256

                                                                      11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                      SHA512

                                                                      a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.2680.update
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      14ffcf07375b3952bd3f2fe52bb63c14

                                                                      SHA1

                                                                      ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                      SHA256

                                                                      6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                      SHA512

                                                                      14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                      Filesize

                                                                      8KB

                                                                      MD5

                                                                      c64defc8b048da7f4d94e84fd2185933

                                                                      SHA1

                                                                      1f83e0fdf4b9908021beb7b604ab8777241760a8

                                                                      SHA256

                                                                      6af0c39e95c072b87de42f3007ad0ce1a7721287f1436cd7e83e0c904c02e901

                                                                      SHA512

                                                                      76188098628f99ec5aecc46ec441ed94583128a75fd2703b2785e446ebaa236d76769bda58815638a10843c92b52895f9a8438eddf5b233bd4d4b3478001bd64

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                      Filesize

                                                                      2B

                                                                      MD5

                                                                      81051bcc2cf1bedf378224b0a93e2877

                                                                      SHA1

                                                                      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                      SHA256

                                                                      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                      SHA512

                                                                      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                      Filesize

                                                                      54KB

                                                                      MD5

                                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                                      SHA1

                                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                      SHA256

                                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                      SHA512

                                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                      Filesize

                                                                      334KB

                                                                      MD5

                                                                      b3e14504a48bed32c53ec7aab2cb2c8f

                                                                      SHA1

                                                                      0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                                      SHA256

                                                                      adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                                      SHA512

                                                                      e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.INI
                                                                      Filesize

                                                                      12B

                                                                      MD5

                                                                      3d66ae5ed06891e8ce75a39a24070844

                                                                      SHA1

                                                                      368064119835d4376727a14706c41384446183e8

                                                                      SHA256

                                                                      73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                                      SHA512

                                                                      c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                      Filesize

                                                                      72KB

                                                                      MD5

                                                                      749c51599fbf82422791e0df1c1e841c

                                                                      SHA1

                                                                      bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                                      SHA256

                                                                      c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                                      SHA512

                                                                      f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                                      Filesize

                                                                      541B

                                                                      MD5

                                                                      d0efb0a6d260dbe5d8c91d94b77d7acd

                                                                      SHA1

                                                                      e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                                      SHA256

                                                                      7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                                      SHA512

                                                                      a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Atera.AgentPackage.Common.dll
                                                                      Filesize

                                                                      94KB

                                                                      MD5

                                                                      ebbe06f612e1c8b87e3d4aaca15a29b5

                                                                      SHA1

                                                                      d2b1317ed96ec0c92ccaf7e85f68ee24f289413f

                                                                      SHA256

                                                                      6cd16dce27e724c2daa098f131343ffdbbed0da5b7ef62542b421a0817de3a3e

                                                                      SHA512

                                                                      eb079eb409925516118db4980be734a645b7444bc51862ce7c95d52e0697b7b937bbacaf421fc5af1a01d3262c1b19a3cf9376adb0a5537de0973e0b7dde63df

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      693KB

                                                                      MD5

                                                                      3b395830460c2f72bc6cd12dd096db0c

                                                                      SHA1

                                                                      73063c63d2b562310af76abef2a8b7e697389c94

                                                                      SHA256

                                                                      f7bb07b7c1718dbbcb692aa4296ebefd7ccd1e55f27be00703a3ce623ad38d5b

                                                                      SHA512

                                                                      dbcaedddc4d99586f1e04fda97e1c706fbc6be7bb766e0fe73addad3116517010a3c1c92d7f54d71533b4c4459631966d8d0cf370ecf1f789f7d25fcb2f5a64e

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                      Filesize

                                                                      50KB

                                                                      MD5

                                                                      c0f02eaa3eb28659d8f1bcba8de48479

                                                                      SHA1

                                                                      5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                                      SHA256

                                                                      6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                                      SHA512

                                                                      47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                      Filesize

                                                                      32KB

                                                                      MD5

                                                                      f531d3157e9ff57eea92db36c40e283e

                                                                      SHA1

                                                                      d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                                      SHA256

                                                                      30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                                      SHA512

                                                                      27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                      Filesize

                                                                      54KB

                                                                      MD5

                                                                      d11b2139d29e79d795054c3866898b7f

                                                                      SHA1

                                                                      020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                                      SHA256

                                                                      11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                                      SHA512

                                                                      de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                      Filesize

                                                                      588KB

                                                                      MD5

                                                                      d39533ae3451324100a8be62845799e6

                                                                      SHA1

                                                                      31af6d7acac3ff2b67a3b6d5dca6ba22809988d3

                                                                      SHA256

                                                                      fa52b413bec029179f4dc476b9198f53d9034b0de59ae2439a8882403b61d07e

                                                                      SHA512

                                                                      ce69bde9859ba32aa24b09538e5ccefa8766f2f264bf637fae2d0ec1419e306f767e3343793448d960880c82d328fa6e7b75e14cbc2de3403fb21c80f03318bd

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                      Filesize

                                                                      167B

                                                                      MD5

                                                                      6531153d66e55b212320321dc39dd9b9

                                                                      SHA1

                                                                      69d7d7cb9ff0c036c9be3131fd494867f9f6ad7d

                                                                      SHA256

                                                                      afe26d2003c54167d43c173fa67d904bc90db50629cceb4a61c45da528f8c203

                                                                      SHA512

                                                                      2330382123f0b1bcfc4152cb6c6b6a5ea88c56b51388fa9dd8c49093d4f567781594aa557eb658e1023b734690fc50724719ed9d28abd0d5b4dd4f31d6b875ab

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                      Filesize

                                                                      205B

                                                                      MD5

                                                                      5bee251dd33f487a36635534c9c7f81a

                                                                      SHA1

                                                                      958f1d162957af39446951b4260790ccbb8977be

                                                                      SHA256

                                                                      cb98d6262ec039179bad185a1ca1f039344e308ffa0512e2edc1f1c27653a4ca

                                                                      SHA512

                                                                      e7df95ebd535c94e3cc5646fb7063758fd693dd523fd396a65f5c8db61f2162614f46f85ac1e77d798f63865b2be4b8096925e093cb4049e7d1441f7686f2d02

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                                      SHA1

                                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                                      SHA256

                                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                      SHA512

                                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      f512536173e386121b3ebd22aac41a4e

                                                                      SHA1

                                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                                      SHA256

                                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                      SHA512

                                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                      Filesize

                                                                      76KB

                                                                      MD5

                                                                      b40fe65431b18a52e6452279b88954af

                                                                      SHA1

                                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                      SHA256

                                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                      SHA512

                                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                      Download Submit

                                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                      Filesize

                                                                      80KB

                                                                      MD5

                                                                      3904d0698962e09da946046020cbcb17

                                                                      SHA1

                                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                      SHA256

                                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                      SHA512

                                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                      Filesize

                                                                      287B

                                                                      MD5

                                                                      fcad4da5d24f95ebf38031673ddbcdb8

                                                                      SHA1

                                                                      3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                                      SHA256

                                                                      7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                                      SHA512

                                                                      1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      362ce475f5d1e84641bad999c16727a0

                                                                      SHA1

                                                                      6b613c73acb58d259c6379bd820cca6f785cc812

                                                                      SHA256

                                                                      1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                      SHA512

                                                                      7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                      Filesize

                                                                      1.9MB

                                                                      MD5

                                                                      8de5a7a19d882820893d8b911c1710fb

                                                                      SHA1

                                                                      95cdf5855bc5e454c8944952697ab142f77124f7

                                                                      SHA256

                                                                      2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                                      SHA512

                                                                      3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                                      SHA1

                                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                      SHA256

                                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                      SHA512

                                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                      Filesize

                                                                      375KB

                                                                      MD5

                                                                      3c93b399b417b0d6a232d386e65a8b46

                                                                      SHA1

                                                                      bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                                      SHA256

                                                                      29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                                      SHA512

                                                                      a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                      Filesize

                                                                      321KB

                                                                      MD5

                                                                      d3901e62166e9c42864fe3062cb4d8d5

                                                                      SHA1

                                                                      c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                      SHA256

                                                                      dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                      SHA512

                                                                      ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                      Filesize

                                                                      814KB

                                                                      MD5

                                                                      9b1f97a41bfb95f148868b49460d9d04

                                                                      SHA1

                                                                      768031d5e877e347a249dfdeab7c725df941324b

                                                                      SHA256

                                                                      09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                      SHA512

                                                                      9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                      Filesize

                                                                      1.2MB

                                                                      MD5

                                                                      e74d2a16da1ddb7f9c54f72b8a25897c

                                                                      SHA1

                                                                      32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                      SHA256

                                                                      a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                      SHA512

                                                                      52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                      Filesize

                                                                      11B

                                                                      MD5

                                                                      5eda46a55c61b07029e7202f8cf1781c

                                                                      SHA1

                                                                      862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                      SHA256

                                                                      12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                      SHA512

                                                                      4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      8c3998a3c2ba9500d4d939765dbd460c

                                                                      SHA1

                                                                      a882b78b5f0e182898f1da624957c8dacf331acc

                                                                      SHA256

                                                                      9dde140fb482b58a0c58c1ce36a6235e0b55f0190b9b798e94569cbda9285b03

                                                                      SHA512

                                                                      84f80872e6e39b6b71adcc78fab7061bfce468491e8b141374cd4d9c92ddf51ae4948373e1bc665a9f7b5e08b0a698beae804318a04b3a3e968c0356c57f5174

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                      Filesize

                                                                      48KB

                                                                      MD5

                                                                      dd6b5a7d60ca666b460c912d07e58c5d

                                                                      SHA1

                                                                      901e722e1692296e5b0a601bd40423cea36d13d9

                                                                      SHA256

                                                                      a9388e7fc7d66e5b3ea96b3e8923db205276904d1b6588bada56616e04c26e09

                                                                      SHA512

                                                                      6a1617c82dcb4f44ca357b81fa9ed4b7e99ff9e99ce52f0ee4d02124d3f0dca3d085e6f8b62d23f73b61be72fa2eb6c8299367c1ce99e73b122580004ee9f538

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                      Filesize

                                                                      2.8MB

                                                                      MD5

                                                                      91453d3e1e2bc9586cf5495073fb3cf7

                                                                      SHA1

                                                                      09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                                      SHA256

                                                                      5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                                      SHA512

                                                                      462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                      Filesize

                                                                      2.9MB

                                                                      MD5

                                                                      384d6da5c34ff401b18f0af41e3a2643

                                                                      SHA1

                                                                      3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                                      SHA256

                                                                      0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                                      SHA512

                                                                      5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      6c6f85e896655a6eb726482f04c49086

                                                                      SHA1

                                                                      2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                      SHA256

                                                                      e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                      SHA512

                                                                      b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                      Filesize

                                                                      646KB

                                                                      MD5

                                                                      7895698867d1ad33934a8553b4806dc5

                                                                      SHA1

                                                                      32704df55deaff9bf0b4ee0b887541856578938b

                                                                      SHA256

                                                                      ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                                      SHA512

                                                                      20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                      Filesize

                                                                      3.1MB

                                                                      MD5

                                                                      85e1898362165fc1315d18abb73c1b37

                                                                      SHA1

                                                                      289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                                      SHA256

                                                                      d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                                      SHA512

                                                                      49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                                      Download Submit

                                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                      Filesize

                                                                      569KB

                                                                      MD5

                                                                      9614d1da18956de06747c03068208d66

                                                                      SHA1

                                                                      fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                                      SHA256

                                                                      dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                                      SHA512

                                                                      d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                                      Download Submit

                                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\bebb36d3f9dded10d7d76a293ca7110b
                                                                      Filesize

                                                                      16KB

                                                                      MD5

                                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                                      SHA1

                                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                      SHA256

                                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                      SHA512

                                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                      Download Submit

                                                                    • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                      Filesize

                                                                      809B

                                                                      MD5

                                                                      8b6737800745d3b99886d013b3392ac3

                                                                      SHA1

                                                                      bb94da3f294922d9e8d31879f2d145586a182e19

                                                                      SHA256

                                                                      86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                      SHA512

                                                                      654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                      Download Submit

                                                                    • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                      Filesize

                                                                      625B

                                                                      MD5

                                                                      9a92c42bfc511f3972d0632602695d70

                                                                      SHA1

                                                                      61737317ad4173a630771eaaff501ac80141ae85

                                                                      SHA256

                                                                      64d6bfafe3820c60bc477bfe32d8d453516fa9b5be6a7b470fe23cb1fadef50c

                                                                      SHA512

                                                                      28e6c71262477b2112d44229c58d4b98e65654ce4a1d4d8d64bed3b23ea849397b4694e9bee3496f079624ddba6ca3e45db9717d4575a5408d1c060e2e46c36f

                                                                      Download Submit

                                                                    • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      50e408551916ecfffb8f361c6edf20b6

                                                                      SHA1

                                                                      a78ba3ebbd7338e086f74cef158490768aaa3438

                                                                      SHA256

                                                                      60a940f016ac2fb4e1c859bbdefe7812a6b146cf2108678f0dbbb9c640501903

                                                                      SHA512

                                                                      4a418a05e8faef55bd1d1de61b907c610ca692f7b2f5c2021cb6b04d6d0d524eaa1b481c24d55964b6f02adf7d742a379b673288e6baa61326426bab19c19539

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                      Filesize

                                                                      471B

                                                                      MD5

                                                                      7795df33fc7dd3aa62e0bc052f9dfbad

                                                                      SHA1

                                                                      ea227ec994561b5bce01c5228f9c337286fbec9c

                                                                      SHA256

                                                                      6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736

                                                                      SHA512

                                                                      de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9
                                                                      Filesize

                                                                      727B

                                                                      MD5

                                                                      043fc0ff529996b681d9677246420c3b

                                                                      SHA1

                                                                      4e5fe5b8407e1fc953ca459d1f25e271e7b8f819

                                                                      SHA256

                                                                      ca1b6b17d41eebcd503c186a777404136480328bb3fd4783b4e5bda7f9557c88

                                                                      SHA512

                                                                      22a04c039c37cde623b03954acdc5587cabe99991809370aee60a87ceae428cd553b8dc71dde08d8e1b61938676a178171462ea8a084738f6392bb26d8028edd

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      727B

                                                                      MD5

                                                                      eb9a1d98cc4b6ac3d674a6621df5a758

                                                                      SHA1

                                                                      5e9bc182d48b8e86a61d8a3f4b5add9c88da6800

                                                                      SHA256

                                                                      20d856d68dba3e2246ebb62a5eaedcefda221accfa1b9362b33afad33b6e48c7

                                                                      SHA512

                                                                      1054d82e5e1b2f2c1416d31f01ff2c172aca8dcc31a622cdd959f918b78a474bd9b40a9b7316122a8262fac24d6236860e2eadd665030a61d56c5c0a153f81c7

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                      Filesize

                                                                      400B

                                                                      MD5

                                                                      e3d5f306b19532c687f806fbf2cf0455

                                                                      SHA1

                                                                      ab6c1d87015d6d3286fdfb3dd4b94d1f5fe36464

                                                                      SHA256

                                                                      196abca8ed670e21d299cd14d4b7cfda9c2a9961caba651bf25205a0ef7e39ff

                                                                      SHA512

                                                                      befc7b49187fe576cacd456db2cfbcee65fd5f137566f0cca247dd301d38421450f34ac453028fc3153bc51ea316251c1da803447a5dc06617a7df321a933c19

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D6781754937F132531C364D68914BDA9
                                                                      Filesize

                                                                      408B

                                                                      MD5

                                                                      85e7a0af95c63ff4be2e4d5e54089a65

                                                                      SHA1

                                                                      d13a95db0d32fab41398fc56d793e6fc61bac7f2

                                                                      SHA256

                                                                      5d26bf7b90be58b64ac3047e10010c9c2791f7f7e3f6c2857f6134c2d8c1d719

                                                                      SHA512

                                                                      3baf6a9e7b23537c657eb4d9dcc0e6243b7e8fc2173dd664c0ce3d4603bb3a49124addc7c601abe15ee1e46f9ec994be6f9afcf83c3e9ecacdc8eee805f3a893

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      09c3981e7244f69d1ad813c7a39c2ae8

                                                                      SHA1

                                                                      855d27fa210d36e21b82da26810012e924623097

                                                                      SHA256

                                                                      f4c23d3cc4041f03a93cc253b0e97b77e1c1bb55909eab0bca2ec3dc28ec1d51

                                                                      SHA512

                                                                      d03f2a6f13b6480267d4efc530a618b62782957d5990a82cc90f3c76b68690bb6321642e56b1100c394708f67673dc5ce55a0048a7bde6051144b958202b8429

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI1325.tmp
                                                                      Filesize

                                                                      245KB

                                                                      MD5

                                                                      acf29f18088d57d255b2b5c859e6d844

                                                                      SHA1

                                                                      cb0260ff6e7dd2189677d1c2afc9d25cd0c6f208

                                                                      SHA256

                                                                      767b905a0af875fde991601e1ea86ce40af300e6054ea719cad02fe72df28fd8

                                                                      SHA512

                                                                      29fe0a4159a7aabb7886475824c5b23310863304a315cf59b5d6bf44c0dc2c4df36521c38ff97e5336a8c7dda63a3f1b0405b493985c3ee4f308693bed9f638b

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI1325.tmp-\AlphaControlAgentInstallationDialog.dll
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      23b4b8d7a19b6de1bf97308c084a31c6

                                                                      SHA1

                                                                      cf8ac83896cfc180fe2f1c3d5db67adb25860038

                                                                      SHA256

                                                                      5b47208bdd53b9d55efbb807063a783a992fb4aca3b7da15ac64f30930a4cbc0

                                                                      SHA512

                                                                      b1ca3006d9aa1c25efbd84eb67d18dd0b88fd23190e296d0b005364223ef057c18d0ae6253d987fbca3e675646654557e897c9a9e5b354fb5b76d42775480830

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI1325.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                                      SHA1

                                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                      SHA256

                                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                      SHA512

                                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI1C01.tmp
                                                                      Filesize

                                                                      211KB

                                                                      MD5

                                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                                      SHA1

                                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                      SHA256

                                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                      SHA512

                                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSI8774.tmp
                                                                      Filesize

                                                                      4.5MB

                                                                      MD5

                                                                      2207f96731ce2f9d9327c0baaf4959ef

                                                                      SHA1

                                                                      f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                                      SHA256

                                                                      e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                                      SHA512

                                                                      7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSID26C.tmp-\AlphaControlAgentInstallation.dll
                                                                      Filesize

                                                                      25KB

                                                                      MD5

                                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                                      SHA1

                                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                                      SHA256

                                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                      SHA512

                                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSID26C.tmp-\CustomAction.config
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                                      SHA1

                                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                      SHA256

                                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                      SHA512

                                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSID26C.tmp-\Newtonsoft.Json.dll
                                                                      Filesize

                                                                      695KB

                                                                      MD5

                                                                      715a1fbee4665e99e859eda667fe8034

                                                                      SHA1

                                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                      SHA256

                                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                      SHA512

                                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                      Download Submit

                                                                    • C:\Windows\Installer\MSID607.tmp
                                                                      Filesize

                                                                      509KB

                                                                      MD5

                                                                      88d29734f37bdcffd202eafcdd082f9d

                                                                      SHA1

                                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                      SHA256

                                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                      SHA512

                                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                      Download Submit

                                                                    • C:\Windows\Installer\e581289.msi
                                                                      Filesize

                                                                      2.6MB

                                                                      MD5

                                                                      055047fe65e1d28dd3bb2e53a9bbcf31

                                                                      SHA1

                                                                      126af029786aae23fb19e4ab3b71d50a04880393

                                                                      SHA256

                                                                      f065892060e9e58460c920516e4c7257c265bf8b532e9782d5d73146ee936c72

                                                                      SHA512

                                                                      94da78ac9c85e16e628872ba1d318db1733bb917711836df73b30b5d9825d6f04db5418c094220a20886ecd892e5721238ab47e1ca7b7674c163fa35a91c0ddf

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{61f8c23a-12f9-f84e-bfea-394ea3024d64}\lci_iddcx.cat
                                                                      Filesize

                                                                      10KB

                                                                      MD5

                                                                      62458e58313475c9a3642a392363e359

                                                                      SHA1

                                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                      SHA256

                                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                      SHA512

                                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{61f8c23a-12f9-f84e-bfea-394ea3024d64}\lci_iddcx.inf
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      1cec22ca85e1b5a8615774fca59a420b

                                                                      SHA1

                                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                                      SHA256

                                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                      SHA512

                                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{61f8c23a-12f9-f84e-bfea-394ea3024d64}\x64\lci_iddcx.dll
                                                                      Filesize

                                                                      52KB

                                                                      MD5

                                                                      01e8bc64139d6b74467330b11331858d

                                                                      SHA1

                                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                      SHA256

                                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                      SHA512

                                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{d62b0373-bda9-354b-be7d-4ab1241bcbbc}\lci_proxywddm.cat
                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                                      SHA1

                                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                      SHA256

                                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                      SHA512

                                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{d62b0373-bda9-354b-be7d-4ab1241bcbbc}\lci_proxywddm.inf
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      0315a579f5afe989154cb7c6a6376b05

                                                                      SHA1

                                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                      SHA256

                                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                      SHA512

                                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{d62b0373-bda9-354b-be7d-4ab1241bcbbc}\x64\lci_proxyumd.dll
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      4dc11547a5fc28ca8f6965fa21573481

                                                                      SHA1

                                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                      SHA256

                                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                      SHA512

                                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{d62b0373-bda9-354b-be7d-4ab1241bcbbc}\x64\lci_proxyumd32.dll
                                                                      Filesize

                                                                      135KB

                                                                      MD5

                                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                                      SHA1

                                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                      SHA256

                                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                      SHA512

                                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                      Download Submit

                                                                    • C:\Windows\System32\DriverStore\Temp\{d62b0373-bda9-354b-be7d-4ab1241bcbbc}\x64\lci_proxywddm.sys
                                                                      Filesize

                                                                      119KB

                                                                      MD5

                                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                                      SHA1

                                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                      SHA256

                                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                      SHA512

                                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                      Download Submit

                                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-12-27-45.dat
                                                                      Filesize

                                                                      602B

                                                                      MD5

                                                                      6f7b2f8f78d13d0e90dd5710d976e056

                                                                      SHA1

                                                                      c41a5538ed5073ee5c8b0ac7e887f24cef1eaff1

                                                                      SHA256

                                                                      ff5258af181deea286ce1165b43ae32f8c639e2cff4acfb9cbdcd62e01b1d229

                                                                      SHA512

                                                                      599badef73cb4d58bb79f6acf58c2e66061962a1719b07f0cab3b4d65344768c3e01d319b40a089e832c9b9235f04990c9ffe4d27fc85cf36d30fa832fa37287

                                                                      Download Submit

                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                      Filesize

                                                                      976B

                                                                      MD5

                                                                      45dc81b086c7f784398c77552a68cbd6

                                                                      SHA1

                                                                      fd2d88a39e49339812058d41ad321551c15e6a07

                                                                      SHA256

                                                                      9b66fc464a63af6a888a1d2cf648493ccd9f23b810f141fe68f6816f71f4ea07

                                                                      SHA512

                                                                      cdab4a09e00f4dbbd2d94357be0c6f053d8086bb0ce3d811b9334a2a308f81afe2b792d1a553f0df595b5093e5f9e34d0584eb678349b4da6f0a29c915a873ab

                                                                      Download Submit

                                                                    • C:\Windows\Temp\InstallUtil.log
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      0cf8f4f78b9049eb3d3b7f0f9c133787

                                                                      SHA1

                                                                      e45174f634eb620ba5362cc85aaecc06e5dca568

                                                                      SHA256

                                                                      fa1bab870035ad5528c15b11f9f62a317f4abb170be99c3b5aa55f77a3672e46

                                                                      SHA512

                                                                      3c7b579815d202b9703a246400d2fe152703d917092f87bfe4f559c4ec2d2911620426e574fc76cd1fb3c5be285dc394e5cd78fb1b7482688b52e6ee607a853f

                                                                      Download Submit

                                                                    • C:\Windows\Temp\PreVer.log
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      0cf97de414ace5f5811b6bd1c6b09435

                                                                      SHA1

                                                                      13671c8569b5b1337da6103f44938e39b25f086b

                                                                      SHA256

                                                                      efe37d262947e1cf3558cef7054be27f97949eaf8ce2ddce2a2754dcc4dc4fb8

                                                                      SHA512

                                                                      6fabfa1061bede0cfa24d67ba8d5ed829d658e513af2f7eb94d6ec138ee629b4e8413910a155454ce0e9cdd1ef4d90fa49d4cc2575a79954ab986859107509b7

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack.log
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      6e0032fb708fa014f0e10838420d2d5c

                                                                      SHA1

                                                                      b41c497bb2dd4270c53dc71947d89a4904309f49

                                                                      SHA256

                                                                      8e27779912d0a9c873b753316c20f7085ebe8f34de69cd746f4fc31736bdf580

                                                                      SHA512

                                                                      e17598d270befd56534fba6cd17d1ad1407be095db22d36f8ba304962d77aee52f62418a45cb3d4bf690fc56f645cac8138accdb63dfdc4fdd08abacfcaaebee

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack.log
                                                                      Filesize

                                                                      4KB

                                                                      MD5

                                                                      4de819ffba1770b8edb5023d350ede54

                                                                      SHA1

                                                                      d29352aec2f912ad28bee6072ea69a45d3a228fb

                                                                      SHA256

                                                                      2263807f504a92002a636d8008cd901df14a78e1179d858c83732ab63897bae5

                                                                      SHA512

                                                                      512dd224041c129834241b443d1cfb4aba3888e16fd4cd448da95c620d6e87545514453b1be38388817da54da265384bfe0c5ff3d29af0d8dc60a059c862bdb6

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                      Filesize

                                                                      3.2MB

                                                                      MD5

                                                                      a7ce785b6cd1c9657040ca9b6cbeed10

                                                                      SHA1

                                                                      4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                                      SHA256

                                                                      7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                                      SHA512

                                                                      39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                                      Download Submit

                                                                    • C:\Windows\Temp\unpack\setup.ini
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      fc5de1fea9170b61439922a367a12478

                                                                      SHA1

                                                                      96941d31908b0cb49adeabbdfcc43508f2b99b36

                                                                      SHA256

                                                                      087ba98d89b1e1366d04a909ac09d109bb80a872b6d5c38e29568dbee5b116f1

                                                                      SHA512

                                                                      6423294e13ea896ce12e8369101cdeaf6eb467cc60a2852e5145be12cd8ee1189a8508a59faf504bb4bc90593f451ec09291662e6bd43438bbcac57f2b69613b

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\IsConfig.ini
                                                                      Filesize

                                                                      571B

                                                                      MD5

                                                                      38370175ce7d8dd5c3581030a9104259

                                                                      SHA1

                                                                      bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                                      SHA256

                                                                      ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                                      SHA512

                                                                      e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\String1033.txt
                                                                      Filesize

                                                                      182KB

                                                                      MD5

                                                                      37a2c4ef0ff41955f1cb884b7790699f

                                                                      SHA1

                                                                      8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                                      SHA256

                                                                      6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                                      SHA512

                                                                      fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\_is7183.exe
                                                                      Filesize

                                                                      179KB

                                                                      MD5

                                                                      7a1c100df8065815dc34c05abc0c13de

                                                                      SHA1

                                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                      SHA256

                                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                      SHA512

                                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{4F0C614E-0341-49FE-82C9-68BE41014E7B}\setup.inx
                                                                      Filesize

                                                                      345KB

                                                                      MD5

                                                                      0376dd5b7e37985ea50e693dc212094c

                                                                      SHA1

                                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                                      SHA256

                                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                      SHA512

                                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{EE690F3D-977C-4A2A-9959-9A114E493A90}\ISRT.dll
                                                                      Filesize

                                                                      427KB

                                                                      MD5

                                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                                      SHA1

                                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                      SHA256

                                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                      SHA512

                                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                      Download Submit

                                                                    • C:\Windows\Temp\{EE690F3D-977C-4A2A-9959-9A114E493A90}\_isres_0x0409.dll
                                                                      Filesize

                                                                      1.8MB

                                                                      MD5

                                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                                      SHA1

                                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                      SHA256

                                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                      SHA512

                                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                      Download Submit

                                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                      Filesize

                                                                      412B

                                                                      MD5

                                                                      03009580320d047de9e98ae6125af1c4

                                                                      SHA1

                                                                      b4be8a4b2ad6283b1b5c15b5291a59b99594968a

                                                                      SHA256

                                                                      4cad4c812a4630b0f5f5bfe890f618378c44aa813eafdd8e308f08ceae458b06

                                                                      SHA512

                                                                      846341e8798edd268387bc5e4ed923055e5ea74e2c733fc8e4818c0dc12b7e6d92da6bf0f715253dfbfc05dd44bc5bc8af305f10dbd7f6964d1fe810c0a0e8be

                                                                      Download Submit

                                                                    • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentPackageAgentInformation.exe.log
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      9cad061ddf5ad182cfe7879190aeed71

                                                                      SHA1

                                                                      cfd292d16d937f95b642527464403b7e5ef6af96

                                                                      SHA256

                                                                      b2d273fa926ebf6946e69e8808ad332db42bc65f449748082e088aa732e408ca

                                                                      SHA512

                                                                      df517d66358f441a7c4c690cd90e214f18d490e3de767dd76164effaa179b1dd865a0056d68ce3ab6aee55917465c7f39146e7694b1ac475fcc95c280fb29e92

                                                                      Download Submit

                                                                    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                      Filesize

                                                                      24.1MB

                                                                      MD5

                                                                      0e213960b90c1ff27f0213bc0d37ebf4

                                                                      SHA1

                                                                      b52ba1c4020f8205004ab06fd09c30bd6088f094

                                                                      SHA256

                                                                      ed8bc0d8725e01911abf7ec519a46911beb61cbb73fa8f78eeb1eec1d8bacda2

                                                                      SHA512

                                                                      a13a2409a18d3cd8109b3074fae97ecd008873b7d576d6ffbca98913f619fd3c606145be36718e9b39b52933d166000889a3a2dc8e5e609e3ad574631c3a518c

                                                                      Download Submit

                                                                    • \??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6a3628bb-e403-4b84-9f60-faffe953e504}_OnDiskSnapshotProp
                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      2c13e525927b904010cd4727ca0944ba

                                                                      SHA1

                                                                      a2cf4d6df6681aecaa409517f46f6800d181c370

                                                                      SHA256

                                                                      5ee9f4dfb172a38d9135fac02ca8bd4cc6d86f89d198fed05c545a427c88a4f9

                                                                      SHA512

                                                                      ccba2fcd3a029cf91b6c0106ed63e4aef609d498e8a8761b522dd6bd46d05b00f183e17871509889ff54bd844629029975fc5469b17fc25cbd207289b8ad1bee

                                                                      Download Submit

                                                                    • memory/940-203-0x000002454FDB0000-0x000002454FDCC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/940-201-0x0000024568B90000-0x0000024568C42000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/940-198-0x000002454F9C0000-0x000002454F9D6000-memory.dmp

                                                                      Filesize

                                                                      88KB

                                                                      Download

                                                                    • memory/1076-71-0x0000021E2AF50000-0x0000021E2AF76000-memory.dmp

                                                                      Filesize

                                                                      152KB

                                                                      Download

                                                                    • memory/1076-83-0x0000021E45560000-0x0000021E455F8000-memory.dmp

                                                                      Filesize

                                                                      608KB

                                                                      Download

                                                                    • memory/1076-88-0x0000021E2CC90000-0x0000021E2CCCC000-memory.dmp

                                                                      Filesize

                                                                      240KB

                                                                      Download

                                                                    • memory/1076-87-0x0000021E2CC20000-0x0000021E2CC32000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/1516-37-0x0000000004A10000-0x0000000004A3E000-memory.dmp

                                                                      Filesize

                                                                      184KB

                                                                      Download

                                                                    • memory/1516-42-0x0000000005010000-0x00000000055B4000-memory.dmp

                                                                      Filesize

                                                                      5.6MB

                                                                      Download

                                                                    • memory/1516-43-0x0000000004B50000-0x0000000004BE2000-memory.dmp

                                                                      Filesize

                                                                      584KB

                                                                      Download

                                                                    • memory/1516-41-0x0000000004A50000-0x0000000004A58000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/1620-1458-0x00000223A6B10000-0x00000223A6B28000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                      Download

                                                                    • memory/1620-1629-0x00000223A6D50000-0x00000223A6D70000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1620-1368-0x00000223A64D0000-0x00000223A64DC000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/1620-1459-0x00000223BF6E0000-0x00000223BF792000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/2676-167-0x0000021EE01D0000-0x0000021EE01EC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/2676-165-0x0000021EF8AD0000-0x0000021EF8B80000-memory.dmp

                                                                      Filesize

                                                                      704KB

                                                                      Download

                                                                    • memory/2676-162-0x0000021EDF950000-0x0000021EDF980000-memory.dmp

                                                                      Filesize

                                                                      192KB

                                                                      Download

                                                                    • memory/2680-1687-0x000002187CA20000-0x000002187CA40000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2680-1671-0x000002187C0A0000-0x000002187C0B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/2680-1675-0x000002187C8D0000-0x000002187C8E0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/2680-1714-0x000002187E4D0000-0x000002187EB2C000-memory.dmp

                                                                      Filesize

                                                                      6.4MB

                                                                      Download

                                                                    • memory/2680-1680-0x000002187D220000-0x000002187D2D2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/3528-1668-0x00000234A4B40000-0x00000234A4B7A000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                      Download

                                                                    • memory/3528-1703-0x00000234BDE10000-0x00000234BDEC2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/3528-1710-0x00000234A54E0000-0x00000234A5528000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                      Download

                                                                    • memory/3528-1705-0x00000234A5450000-0x00000234A546C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/4108-1711-0x000002A66F340000-0x000002A66F3F2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/4108-1694-0x000002A656880000-0x000002A65689C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/4108-1719-0x000002A66F2A0000-0x000002A66F2BA000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                      Download

                                                                    • memory/4108-1685-0x000002A656030000-0x000002A656042000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/4108-1712-0x000002A66F4E0000-0x000002A66F5BC000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/4108-1686-0x000002A6568B0000-0x000002A6568FA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/4508-1054-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/4508-2109-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/4508-1903-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4508-2108-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4508-1696-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/4508-1904-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/4508-1695-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4508-1053-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4572-1677-0x000001A5F7100000-0x000001A5F714A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/4572-1693-0x000001A5F7BF0000-0x000001A5F7CCC000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/4572-1678-0x000001A5F70D0000-0x000001A5F70EC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/4572-1702-0x000001A5F7930000-0x000001A5F7938000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/4572-1676-0x000001A5F6870000-0x000001A5F6880000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/4572-1700-0x000001A5F7B10000-0x000001A5F7BC2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/4828-823-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4828-965-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4828-402-0x0000000002E30000-0x0000000002FF7000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                      Download

                                                                    • memory/4828-826-0x0000000003400000-0x00000000035C7000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                      Download

                                                                    • memory/4828-399-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4828-435-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/4868-124-0x0000020D23C70000-0x0000020D23C92000-memory.dmp

                                                                      Filesize

                                                                      136KB

                                                                      Download

                                                                    • memory/4868-130-0x0000020D24250000-0x0000020D24288000-memory.dmp

                                                                      Filesize

                                                                      224KB

                                                                      Download

                                                                    • memory/4868-119-0x0000020D23D00000-0x0000020D23DB2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5028-265-0x000002A758710000-0x000002A758718000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/5028-264-0x000002A7581F0000-0x000002A7581F8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/5028-257-0x000002A7586C0000-0x000002A758708000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                      Download

                                                                    • memory/5028-268-0x000002A771100000-0x000002A771168000-memory.dmp

                                                                      Filesize

                                                                      416KB

                                                                      Download

                                                                    • memory/5028-270-0x000002A7710C0000-0x000002A7710EA000-memory.dmp

                                                                      Filesize

                                                                      168KB

                                                                      Download

                                                                    • memory/5028-255-0x000002A758670000-0x000002A7586BC000-memory.dmp

                                                                      Filesize

                                                                      304KB

                                                                      Download

                                                                    • memory/5028-250-0x000002A758160000-0x000002A7581AA000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5028-274-0x000002A771090000-0x000002A7710B6000-memory.dmp

                                                                      Filesize

                                                                      152KB

                                                                      Download

                                                                    • memory/5028-273-0x000002A771F90000-0x000002A771FCA000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                      Download

                                                                    • memory/5028-252-0x000002A758110000-0x000002A75812C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5028-258-0x000002A758130000-0x000002A758138000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/5028-259-0x000002A758140000-0x000002A75814A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/5028-247-0x000002A757CF0000-0x000002A757D54000-memory.dmp

                                                                      Filesize

                                                                      400KB

                                                                      Download

                                                                    • memory/5028-266-0x000002A758720000-0x000002A758728000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/5028-261-0x000002A771170000-0x000002A77124C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/5028-263-0x000002A771250000-0x000002A771302000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5280-1699-0x000001DDFA7C0000-0x000001DDFA7CA000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/5280-1716-0x000001DDFB310000-0x000001DDFB3C2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5280-1697-0x000001DDFA7A0000-0x000001DDFA7BC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5280-1717-0x000001DDFB4B0000-0x000001DDFB58C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/5280-1691-0x000001DDFA7F0000-0x000001DDFA83A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5280-1698-0x000001DDFA840000-0x000001DDFA858000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                      Download

                                                                    • memory/5280-1682-0x000001DDF9F20000-0x000001DDF9F54000-memory.dmp

                                                                      Filesize

                                                                      208KB

                                                                      Download

                                                                    • memory/5280-1701-0x000001DDFB100000-0x000001DDFB14A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5516-1708-0x0000025FAB4F0000-0x0000025FAB5A0000-memory.dmp

                                                                      Filesize

                                                                      704KB

                                                                      Download

                                                                    • memory/5516-1718-0x0000025FAB680000-0x0000025FAB75C000-memory.dmp

                                                                      Filesize

                                                                      880KB

                                                                      Download

                                                                    • memory/5516-1688-0x0000025F92AE0000-0x0000025F92AFC000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5516-1667-0x0000025F92170000-0x0000025F9217C000-memory.dmp

                                                                      Filesize

                                                                      48KB

                                                                      Download

                                                                    • memory/5516-1674-0x0000025F92B10000-0x0000025F92B5A000-memory.dmp

                                                                      Filesize

                                                                      296KB

                                                                      Download

                                                                    • memory/5544-1683-0x0000021C00180000-0x0000021C001E6000-memory.dmp

                                                                      Filesize

                                                                      408KB

                                                                      Download

                                                                    • memory/5544-1663-0x0000021BFFFD0000-0x0000021BFFFF0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5544-1662-0x0000021BFFD00000-0x0000021BFFD10000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                      Download

                                                                    • memory/5544-1672-0x0000021C000C0000-0x0000021C00172000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5544-1684-0x0000021C00000000-0x0000021C00014000-memory.dmp

                                                                      Filesize

                                                                      80KB

                                                                      Download

                                                                    • memory/5760-1223-0x00000135801E0000-0x00000135801F2000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                      Download

                                                                    • memory/5760-1224-0x0000013580A40000-0x0000013580A5C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/5760-1692-0x0000013599F80000-0x0000013599FD4000-memory.dmp

                                                                      Filesize

                                                                      336KB

                                                                      Download

                                                                    • memory/5760-1240-0x0000013599340000-0x00000135993F2000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5892-1673-0x000002BDEC8D0000-0x000002BDEC982000-memory.dmp

                                                                      Filesize

                                                                      712KB

                                                                      Download

                                                                    • memory/5892-1664-0x000002BDD3790000-0x000002BDD379A000-memory.dmp

                                                                      Filesize

                                                                      40KB

                                                                      Download

                                                                    • memory/5892-1665-0x000002BDD3D10000-0x000002BDD3D2A000-memory.dmp

                                                                      Filesize

                                                                      104KB

                                                                      Download

                                                                    • memory/5892-1704-0x000002BDECFE0000-0x000002BDED508000-memory.dmp

                                                                      Filesize

                                                                      5.2MB

                                                                      Download

                                                                    • memory/5964-1997-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5964-1071-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5964-1072-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5964-2148-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/5964-2147-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/5964-1998-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/6088-2379-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/6088-2380-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/6088-3072-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/6088-3071-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download

                                                                    • memory/6088-1121-0x00000000721E0000-0x00000000725AD000-memory.dmp

                                                                      Filesize

                                                                      3.8MB

                                                                      Download

                                                                    • memory/6088-1120-0x00000000725B0000-0x00000000726CC000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                      Download