Overview

overview

10

Static

static

10

33283eed43...d5.msi

windows7-x64

10

33283eed43...d5.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 02:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    33283eed43cb365ae5f4541f387ea4f4e81667573b3c890be5606fc53c5852d5.msi

  • Size

    2.9MB

  • MD5

    a49092bd08748f5fe5e51ffcb63325f5

  • SHA1

    1f5101843913e1f053442b7412635855ed80e16d

  • SHA256

    33283eed43cb365ae5f4541f387ea4f4e81667573b3c890be5606fc53c5852d5

  • SHA512

    126e5eebd2eb640a181d2e7567120c8a98e6feb94236206995f48932dd90c7448ee6bd7449c6b947bf49f84fbaa2e4894008f63a56a56bc87501bcc75cc5383c

  • SSDEEP

    49152:w+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:w+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\33283eed43cb365ae5f4541f387ea4f4e81667573b3c890be5606fc53c5852d5.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1284
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:552
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BD2FB47FCB8678F846CB913D19E41821
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIAAFE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241150937 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2192
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIADAF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241151437 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4240
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIB234.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241152609 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3060
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIBCE7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241155343 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:440
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E2045ECC195B506431E0E97C2CF2D422 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3160
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2456
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1720
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000ND5FxIAL" /AgentId="f47c648c-4807-4bbc-bfe6-5e17d7069f7b"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4424
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 71801A1BB6363635310FF74FDAC43840 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8682ADBD-A59E-4F96-8973-F6DF80844C4B}
          3⤵
          • Executes dropped EXE
          PID:4772
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF031EEE-3FB8-4658-B08B-B11521CC3F54}
          3⤵
          • Executes dropped EXE
          PID:4948
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A1278A24-F4F3-4AA8-8162-08D3C653E464}
          3⤵
          • Executes dropped EXE
          PID:552
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7484F657-8746-40F2-8BB0-7639AB8DCD6A}
          3⤵
          • Executes dropped EXE
          PID:5060
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2370AB65-1314-4F7D-A4E6-ED20F06B0E05}
          3⤵
          • Executes dropped EXE
          PID:4428
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{002F4650-4771-49E3-95AD-98DED3A464CD}
          3⤵
          • Executes dropped EXE
          PID:4088
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C2225BAC-B5BB-42D4-A840-D21DEBD82041}
          3⤵
          • Executes dropped EXE
          PID:3032
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{98A7E3CF-D936-4753-991E-65328E0EAB92}
          3⤵
          • Executes dropped EXE
          PID:2352
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDC4AE53-68EC-4800-BE45-3A148F5DCA41}
          3⤵
          • Executes dropped EXE
          PID:3976
        • C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe
          C:\Windows\TEMP\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isFBBE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{30FE54BD-EEE4-497B-B147-BE45D6720D88}
          3⤵
          • Executes dropped EXE
          PID:4432
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3692
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2296
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:764
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4972
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4568
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4340
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4616
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3028
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3252
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2296
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2136
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4744
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3952
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1848
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2712
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4948
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3688
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1712
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1540
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5211E484-3810-4B85-8263-50D3C8E09EB7}
          3⤵
          • Executes dropped EXE
          PID:3144
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{353099C0-4C75-46F7-BBFC-CDF4A7B9FB8A}
          3⤵
          • Executes dropped EXE
          PID:3116
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AFF6F81B-6B94-4965-9172-1556C7F268CD}
          3⤵
          • Executes dropped EXE
          PID:556
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C70B1846-2808-411C-A9DD-0D0A5D6395F1}
          3⤵
          • Executes dropped EXE
          PID:2736
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EEF3E462-B125-4F7B-B95D-89910505F0E1}
          3⤵
          • Executes dropped EXE
          PID:4428
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DF36404C-D200-4DC8-88FD-E832B9D9ABA6}
          3⤵
          • Executes dropped EXE
          PID:2076
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C0EBA7F1-6A9C-4B4A-A0BB-74830067B389}
          3⤵
          • Executes dropped EXE
          PID:4340
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3446A6CC-2725-42A4-8CC4-19D91FE70FEF}
          3⤵
          • Executes dropped EXE
          PID:892
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1A29C70F-B54E-4D51-A88D-0064D99E656A}
          3⤵
          • Executes dropped EXE
          PID:4668
        • C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
          C:\Windows\TEMP\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{915883AC-75F6-4551-9FDA-A0BA6EEA1F89}
          3⤵
          • Executes dropped EXE
          PID:4880
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52408E35-0B13-4CCD-888D-6CA203F444A4}
          3⤵
          • Executes dropped EXE
          PID:1104
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA4809BF-25E5-4675-878F-F21F1E6575FB}
          3⤵
          • Executes dropped EXE
          PID:4668
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{02B57614-4087-4A9A-9AB3-A80D5AE4AAD4}
          3⤵
          • Executes dropped EXE
          PID:4876
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{31EC3D2E-D89A-48EA-AD30-11899333DC16}
          3⤵
          • Executes dropped EXE
          PID:1680
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{79699304-2084-4C2D-9F3E-693B4785037A}
          3⤵
          • Executes dropped EXE
          PID:1284
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{24DF3421-FE37-45C0-8E0B-C5EC7240501B}
          3⤵
          • Executes dropped EXE
          PID:2764
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2D737F0F-15D3-4D7C-B70F-B7DC0156D05C}
          3⤵
          • Executes dropped EXE
          PID:2900
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{11031150-B530-4E75-8BF0-5B7BC44126C7}
          3⤵
          • Executes dropped EXE
          PID:688
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5D90925-457C-4BC5-8184-D43B7C697A11}
          3⤵
          • Executes dropped EXE
          PID:4880
        • C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe
          C:\Windows\TEMP\{46B606C6-24C2-472F-962D-528D7F27302C}\_is10DE.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F07956E1-FFD5-4015-A21A-9DFFC270AD03}
          3⤵
          • Executes dropped EXE
          PID:5072
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1284
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3856
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5060
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:2352
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:2712
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4972
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B4E1849-D72C-4181-9EBC-59424AAAB089}
              3⤵
              • Executes dropped EXE
              PID:4848
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73F75406-F789-4C52-85BF-42BD2D871085}
              3⤵
              • Executes dropped EXE
              PID:2712
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7F1E04A-83F2-4F5C-8661-9A26F793A684}
              3⤵
              • Executes dropped EXE
              PID:1840
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2574C3B5-75F8-4BE1-B9CF-916047E6A4F6}
              3⤵
              • Executes dropped EXE
              PID:2312
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{10E816DE-532B-4E54-829A-B72CFFCE5323}
              3⤵
              • Executes dropped EXE
              PID:2716
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6C928D52-680A-4438-82BF-A03912D205CB}
              3⤵
              • Executes dropped EXE
              PID:2184
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{153E589B-8145-4430-93E0-28DBCF16B4CC}
              3⤵
              • Executes dropped EXE
              PID:2076
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3705930-B677-43F3-82A8-EAD0EC7B5866}
              3⤵
              • Executes dropped EXE
              PID:920
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7546CC7D-E888-4DF1-AA1A-45E9F864E3A8}
              3⤵
              • Executes dropped EXE
              PID:892
            • C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe
              C:\Windows\TEMP\{C5259BDC-91E6-4845-8FCD-E2E4012629B4}\_is2265.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F7CAD6CF-06A1-454D-BE47-4D4E87688982}
              3⤵
              • Executes dropped EXE
              PID:4432
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2712
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C05422C-D735-4FD7-840C-836792CE3B2C}
              3⤵
              • Executes dropped EXE
              PID:4428
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9FCCB4F-F969-4F0F-8F75-F7C8EFB90712}
              3⤵
              • Executes dropped EXE
              PID:3496
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E16C454-5F1D-4D95-83A6-4876A71C0E87}
              3⤵
              • Executes dropped EXE
              PID:5092
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DBB7285-4C0C-4214-A41B-3A4EC2D6975F}
              3⤵
              • Executes dropped EXE
              PID:920
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13FFA64D-EDA6-4D30-ACDE-688511B44485}
              3⤵
              • Executes dropped EXE
              PID:3412
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{833488D6-57BF-4C49-B951-8BC71312F46F}
              3⤵
              • Executes dropped EXE
              PID:3336
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6F6583E-1E4B-489E-8142-01DBA0016D1E}
              3⤵
              • Executes dropped EXE
              PID:4576
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{36D0B813-D791-4F4D-893F-AB1C79994A0E}
              3⤵
              • Executes dropped EXE
              PID:2352
            • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
              C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{856DB3D3-A9AE-4AB1-8D8C-4379A0F233B1}
              3⤵
                PID:3488
              • C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe
                C:\Windows\TEMP\{CCFE3CE3-CAD9-46FF-AC4B-6D6A9DCD3041}\_is268C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C6D5951-E31D-4B69-9B53-179CC578CFD4}
                3⤵
                  PID:1656
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3616
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding E3C5376A29A4AC3A667010CFDBA96FAC E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:6056
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI6846.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241199187 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3100
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI6912.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241199375 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • System Location Discovery: System Language Discovery
                  PID:3236
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI6B94.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241200000 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:6020
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5512
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5712
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:6064
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2472
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:6072
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5516
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI8ABD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241207984 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:4476
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:1928
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="c068d047-a68b-41d0-aba1-34e38da8f10a"
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:6004
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:2104
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4368
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:1756
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "c421c270-76bb-4a48-aee0-cbb96a34716b" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000ND5FxIAL
                2⤵
                • Executes dropped EXE
                PID:1916
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "b102d1a5-e416-42bc-bbb9-37535c32bdf9" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000ND5FxIAL
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                PID:2952
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "1ee1fef6-8567-43f1-8bfe-846339da8c11" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000ND5FxIAL
                2⤵
                • Executes dropped EXE
                PID:920
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "88d6c172-a364-4e73-a5bd-3575752ce92a" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000ND5FxIAL
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5016
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2352
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:2488
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "26424563-8f61-43ab-8874-bb914a9a9939" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000ND5FxIAL
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1772
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2632
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3052
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3516
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "defc3f0b-88ee-4cf2-aab5-0a654a0607be" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000ND5FxIAL
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1572
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:3308
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4088
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "1ebfd50c-a5ed-4e70-a6c1-9658c3d4ef33" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000ND5FxIAL
                2⤵
                  PID:2004
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    3⤵
                      PID:1680
                      • C:\Windows\system32\cscript.exe
                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                        4⤵
                        • Modifies data under HKEY_USERS
                        PID:1836
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "6b60cee5-75dc-4967-bafc-4be18b81f1ac" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000ND5FxIAL
                    2⤵
                      PID:1916
                      • C:\Windows\SYSTEM32\msiexec.exe
                        "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                        3⤵
                        • Modifies data under HKEY_USERS
                        PID:1264
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "1299b63d-f9f8-46b2-8caa-bf1cdf466ba6" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000ND5FxIAL
                      2⤵
                      • Drops file in System32 directory
                      • Modifies registry class
                      PID:1540
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "b5fe526b-d943-4fc1-a549-73305895638b" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000ND5FxIAL
                      2⤵
                      • Modifies data under HKEY_USERS
                      PID:1796
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=80b709d4037adf126c312ed0681c2f85&rmm_session_pwd_ttl=86400"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5240
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "e794afa4-c63e-4247-9781-69771695462f" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000ND5FxIAL
                      2⤵
                        PID:5332
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "617b375e-fff8-4c72-b9ae-649b4b38bfd3" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000ND5FxIAL
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:5480
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "2bc3068d-b7b6-4a5a-8623-360826b6dfb4" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000ND5FxIAL
                        2⤵
                        • Drops file in Program Files directory
                        PID:5492
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "69eaca54-fbfa-4435-83d1-02229fe14a82" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000ND5FxIAL
                        2⤵
                          PID:5680
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "ab5d0e42-3e44-4d94-a604-926b85800da7" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000ND5FxIAL
                          2⤵
                            PID:5888
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:5716
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:4336
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "0904b316-e5d3-453b-9774-a14a20cabdce" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000ND5FxIAL
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            PID:4040
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "b2227fbf-0728-4526-8d1d-66215938cc1e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000ND5FxIAL
                            2⤵
                            • Drops file in System32 directory
                            PID:5128
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "1802e44e-7c9a-4520-8225-342b860929c3" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000ND5FxIAL
                            2⤵
                              PID:5020
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "0ecd219d-20fb-4b8b-8c6e-9fbee816ab59" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000ND5FxIAL
                              2⤵
                              • Writes to the Master Boot Record (MBR)
                              • Drops file in Program Files directory
                              PID:5196
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "3059bd78-5b9f-4290-ae05-98d1c021f656" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000ND5FxIAL
                              2⤵
                                PID:5384
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                              1⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:920
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3712
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                  -h
                                  3⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4428
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4936
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                    4⤵
                                      PID:1680
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3952
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3268
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                      SRUtility.exe -r
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4340
                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5752
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                      4⤵
                                        PID:5432
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ver
                                          5⤵
                                            PID:4260
                                          • C:\Windows\system32\sc.exe
                                            sc query ddmgr
                                            5⤵
                                            • Launches sc.exe
                                            PID:3976
                                          • C:\Windows\system32\sc.exe
                                            sc query lci_proxykmd
                                            5⤵
                                            • Launches sc.exe
                                            PID:4240
                                          • C:\Windows\system32\rundll32.exe
                                            rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                            5⤵
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Checks SCSI registry key(s)
                                            • Modifies data under HKEY_USERS
                                            PID:1448
                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                    1⤵
                                    • Drops file in Program Files directory
                                    • Modifies data under HKEY_USERS
                                    PID:5596
                                    • C:\Windows\System32\sc.exe
                                      "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                      2⤵
                                      • Launches sc.exe
                                      PID:3856
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "a97f69b9-7ac7-4f88-8ea3-419eae34cfaf" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000ND5FxIAL
                                      2⤵
                                        PID:5240
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "ad66dbf4-f0f8-48bc-8e1b-eec59164f23d" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000ND5FxIAL
                                        2⤵
                                          PID:5284
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "ed5b2b9d-3bea-4781-a0ad-4ef24e466df2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000ND5FxIAL
                                          2⤵
                                            PID:2928
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "b13444a7-c5b8-42b0-a10c-3ee69136a9c7" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000ND5FxIAL
                                            2⤵
                                            • Drops file in Program Files directory
                                            • Modifies data under HKEY_USERS
                                            PID:5424
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                              3⤵
                                                PID:3432
                                                • C:\Windows\system32\cscript.exe
                                                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                  4⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:6084
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "6105b50e-9106-48bc-9805-e3bfb9fd3c86" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000ND5FxIAL
                                              2⤵
                                                PID:1616
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "a468bf38-6485-46f4-b863-337b948b068f" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000ND5FxIAL
                                                2⤵
                                                  PID:4056
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "9e589405-bfac-49fd-99f9-cd2652f74d68" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000ND5FxIAL
                                                  2⤵
                                                    PID:3032
                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=80b709d4037adf126c312ed0681c2f85&rmm_session_pwd_ttl=86400"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5644
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "9d23ee5b-fac3-405e-852b-70a5d9b0a6f4" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000ND5FxIAL
                                                    2⤵
                                                    • Drops file in Program Files directory
                                                    PID:6028
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "6748d780-69fe-47dd-af8c-012d0d2cd06e" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000ND5FxIAL
                                                    2⤵
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:4472
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "9b6a966a-859f-427b-90db-3d9cb36f4068" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000ND5FxIAL
                                                    2⤵
                                                      PID:5928
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "a50eebef-b6e6-4e47-bf28-9c0bf6877640" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000ND5FxIAL
                                                      2⤵
                                                        PID:4668
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                          3⤵
                                                          • System Time Discovery
                                                          PID:4240
                                                          • C:\Program Files\dotnet\dotnet.exe
                                                            dotnet --list-runtimes
                                                            4⤵
                                                            • System Time Discovery
                                                            PID:5964
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "c6063077-48aa-447f-bc2c-35758dfd30a5" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000ND5FxIAL
                                                        2⤵
                                                          PID:5736
                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "7855c6f1-f2bd-47ac-80fc-f76dd497709b" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000ND5FxIAL
                                                          2⤵
                                                            PID:1072
                                                            • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                              "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "f47c648c-4807-4bbc-bfe6-5e17d7069f7b" "7855c6f1-f2bd-47ac-80fc-f76dd497709b" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000ND5FxIAL"
                                                              3⤵
                                                                PID:5320
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "044acc81-502e-423b-a234-3198c39fca86" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000ND5FxIAL
                                                              2⤵
                                                              • Modifies registry class
                                                              PID:1036
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" f47c648c-4807-4bbc-bfe6-5e17d7069f7b "ad66dbf4-f0f8-48bc-8e1b-eec59164f23d" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000ND5FxIAL
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:2640
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                            1⤵
                                                            • Checks SCSI registry key(s)
                                                            PID:5800
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:5160
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000154" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:6080
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "000000000000017C"
                                                              2⤵
                                                              • Drops file in Drivers directory
                                                              • Drops file in System32 directory
                                                              • Checks SCSI registry key(s)
                                                              PID:3832
                                                            • C:\Windows\system32\DrvInst.exe
                                                              DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                              2⤵
                                                              • Drops file in Drivers directory
                                                              • Drops file in Windows directory
                                                              • Checks SCSI registry key(s)
                                                              PID:3248

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Persistence

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Privilege Escalation

                                                          Event Triggered Execution

                                                          2
                                                          T1546

                                                          Component Object Model Hijacking

                                                          1
                                                          T1546.015

                                                          Installer Packages

                                                          1
                                                          T1546.016

                                                          Defense Evasion

                                                          Modify Registry

                                                          1
                                                          T1112

                                                          Pre-OS Boot

                                                          1
                                                          T1542

                                                          Bootkit

                                                          1
                                                          T1542.003

                                                          Subvert Trust Controls

                                                          1
                                                          T1553

                                                          Install Root Certificate

                                                          1
                                                          T1553.004

                                                          System Binary Proxy Execution

                                                          1
                                                          T1218

                                                          Msiexec

                                                          1
                                                          T1218.007

                                                          Credential Access

                                                          Discovery

                                                          Peripheral Device Discovery

                                                          2
                                                          T1120

                                                          Query Registry

                                                          4
                                                          T1012

                                                          System Information Discovery

                                                          3
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          System Time Discovery

                                                          1
                                                          T1124

                                                          Lateral Movement

                                                          Collection

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Config.Msi\e5faa82.rbs
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            a0d8347106282accee2c38d366bf8275

                                                            SHA1

                                                            22d68b6fc46011f6478ce82e37440cb85a08a0a6

                                                            SHA256

                                                            fc4953dc9630e87a50a896fabc0d733ddd39e32d64ce43eafc92c6223ee2bbc9

                                                            SHA512

                                                            1e3c766f86fba770314e9bfc2e2dcef55be7ba0aa0c2e9f756d036e5c45f92ee66b5c6b67a2449485156540b2a6c43b9b553547523c359c85038357555d5d346

                                                            Download Submit

                                                          • C:\Config.Msi\e5faa87.rbs
                                                            Filesize

                                                            74KB

                                                            MD5

                                                            84446123e8ff2d0ac7388776b588047b

                                                            SHA1

                                                            5afcd8f31002596911043829d6a96a3a09fa6420

                                                            SHA256

                                                            65a9b827eed9cd263123c21d33e2f7219754d9fcf71d907caa915224132916c2

                                                            SHA512

                                                            9d41121dd49c9d7b9cb6ab3e803b2bf01677cc196967c77289a1dbafd4f96bdaaa93c3a7c87a463aff34b2fcc537bca3db95bbe37cc7f23c5394a06105c60d87

                                                            Download Submit

                                                          • C:\Config.Msi\e5faa89.rbs
                                                            Filesize

                                                            464B

                                                            MD5

                                                            df0ddfd9e66ffbf916637669b2e3f797

                                                            SHA1

                                                            5be91ab92bfbf3bc51539be3f3ff6dcfea6bbb64

                                                            SHA256

                                                            0b3bd96f713f382d6bd0617c24c8f7672e104f32aea4164b2e802d8d80bdd213

                                                            SHA512

                                                            32c34e7436b763c57cda388694839cf77e56b4fa7e38e166082fb1a5acd16adac183d2881d404813c5671b3b5d7fd3ef857b66ae6414308a3b31d47517dd38b3

                                                            Download Submit

                                                          • C:\Config.Msi\e5faa8f.rbs
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            3848f64d4f061b6ee9189907c3ef02f1

                                                            SHA1

                                                            546faec19d5e8dcbf35886c1cdf6f67fa48264ae

                                                            SHA256

                                                            054552a141241780a33d4de3d3a1822b8d929789ab4ea25a420b214636f7d495

                                                            SHA512

                                                            f0f783689c33d44385c856d8294821dd05dfc054375612057095602ec98d4e416425ddefde7d11ec6ee56181d57fce500a51395385b6e614df73c08d57b860cd

                                                            Download Submit

                                                          • C:\Config.Msi\e5faa97.rbs
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            97c127d788eaf9de4811767805332d7e

                                                            SHA1

                                                            22ef92c8b9cb8a86ee30ac277596c6d239fba1e2

                                                            SHA256

                                                            eb82f73a9537a401bd6a88bfe40b98f19b99cfe2fb8afaaed667270f349dc474

                                                            SHA512

                                                            ccbe669d908ab99bba0f3af7fc0ddbd7192d40eff0332b87ef9b728b7d31875d6937dc334f9e67935563ed6d64e38b9f43d2efb3cb7023df07cd3afaaccd283e

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            753B

                                                            MD5

                                                            8298451e4dee214334dd2e22b8996bdc

                                                            SHA1

                                                            bc429029cc6b42c59c417773ea5df8ae54dbb971

                                                            SHA256

                                                            6fbf5845a6738e2dc2aa67dd5f78da2c8f8cb41d866bbba10e5336787c731b25

                                                            SHA512

                                                            cda4ffd7d6c6dff90521c6a67a3dba27bf172cc87cee2986ae46dccd02f771d7e784dcad8aea0ad10decf46a1c8ae1041c184206ec2796e54756e49b9217d7ba

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                            Filesize

                                                            142KB

                                                            MD5

                                                            477293f80461713d51a98a24023d45e8

                                                            SHA1

                                                            e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                            SHA256

                                                            a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                            SHA512

                                                            23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            b3bb71f9bb4de4236c26578a8fae2dcd

                                                            SHA1

                                                            1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                            SHA256

                                                            e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                            SHA512

                                                            fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                            Filesize

                                                            210KB

                                                            MD5

                                                            c106df1b5b43af3b937ace19d92b42f3

                                                            SHA1

                                                            7670fc4b6369e3fb705200050618acaa5213637f

                                                            SHA256

                                                            2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                            SHA512

                                                            616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                            Filesize

                                                            693KB

                                                            MD5

                                                            2c4d25b7fbd1adfd4471052fa482af72

                                                            SHA1

                                                            fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                            SHA256

                                                            2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                            SHA512

                                                            f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                            Filesize

                                                            157KB

                                                            MD5

                                                            242d415e238789fbc57c5ac7e8ca5d02

                                                            SHA1

                                                            09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                            SHA256

                                                            7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                            SHA512

                                                            ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                            Filesize

                                                            51KB

                                                            MD5

                                                            3180c705182447f4bcc7ce8e2820b25d

                                                            SHA1

                                                            ad6486557819a33d3f29b18d92b43b11707aae6e

                                                            SHA256

                                                            5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                            SHA512

                                                            228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                            Filesize

                                                            12B

                                                            MD5

                                                            dc63026e80d2bb04f71e41916f807e33

                                                            SHA1

                                                            6cda386d2c365f94ea3de41e2390fd916622eb51

                                                            SHA256

                                                            3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                            SHA512

                                                            61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                            Filesize

                                                            173KB

                                                            MD5

                                                            31def444e6135301ea3c38a985341837

                                                            SHA1

                                                            f135be75c721af2d5291cb463cbc22a32467084a

                                                            SHA256

                                                            36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                            SHA512

                                                            bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                            Filesize

                                                            546B

                                                            MD5

                                                            158fb7d9323c6ce69d4fce11486a40a1

                                                            SHA1

                                                            29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                            SHA256

                                                            5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                            SHA512

                                                            7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Atera.AgentPackage.Common.dll
                                                            Filesize

                                                            94KB

                                                            MD5

                                                            9d8b5941ea5b905e8197a175ef2b15a9

                                                            SHA1

                                                            86a078e94b5578ec4125f50f78c8518a8ce1d086

                                                            SHA256

                                                            c6f05b647dbadc15ab97d31790fc8ace054986ec33e9178feead4235ad15cb0d

                                                            SHA512

                                                            fab5fe82873862ce8ed1a427482093cca307f6663e9f6497fdc244ce461312872d419ff274cdca0c496414c28681901f335c9911b95d2a7c112d30e32d74e498

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                            Filesize

                                                            688KB

                                                            MD5

                                                            ba66874c510645c1fb5fe74f85b32e98

                                                            SHA1

                                                            e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                            SHA256

                                                            12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                            SHA512

                                                            44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                            Filesize

                                                            27KB

                                                            MD5

                                                            797c9554ec56fd72ebb3f6f6bef67fb5

                                                            SHA1

                                                            40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                            SHA256

                                                            7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                            SHA512

                                                            4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                            Filesize

                                                            214KB

                                                            MD5

                                                            01807774f043028ec29982a62fa75941

                                                            SHA1

                                                            afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                            SHA256

                                                            9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                            SHA512

                                                            33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                            Filesize

                                                            37KB

                                                            MD5

                                                            efb4712c8713cb05eb7fe7d87a83a55a

                                                            SHA1

                                                            c94d106bba77aecf88540807da89349b50ea5ae7

                                                            SHA256

                                                            30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                            SHA512

                                                            3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                            Filesize

                                                            3.4MB

                                                            MD5

                                                            e010d1f614b1a830482d3df4ba056f24

                                                            SHA1

                                                            5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                            SHA256

                                                            98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                            SHA512

                                                            727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                            Filesize

                                                            389KB

                                                            MD5

                                                            5e3252e0248b484e76fcdbf8b42a645d

                                                            SHA1

                                                            11ae92fd16ac87f6ab755911e85e263253c16516

                                                            SHA256

                                                            01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                            SHA512

                                                            540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            3b66a04c5c9e7a7f9aaf0e71475bc2cb

                                                            SHA1

                                                            71e42eef4f52642736eac61b4492b05781416a12

                                                            SHA256

                                                            325d93007a36d40704408e6a059ae31a984b711e8911d6965dc7c25426719118

                                                            SHA512

                                                            aa56ebfc1f9a6aee7edd9f0f73b3ec9be344958e6541db943cae0fe6fa5e860bbe27ae9297cda1a170e3181af41f73e0b8581ac29db7305c2fd2a0d30becb237

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                            Filesize

                                                            196KB

                                                            MD5

                                                            5f782d0cb0f717ae9dfd1b4da1295f15

                                                            SHA1

                                                            b33575e428e19940f0585c747e054ca70a12d454

                                                            SHA256

                                                            0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                            SHA512

                                                            e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                            Filesize

                                                            55KB

                                                            MD5

                                                            a739b889642ca9ce4ad3a37a3c521604

                                                            SHA1

                                                            18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                            SHA256

                                                            44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                            SHA512

                                                            92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            9d1528a2ce17522f6de064ae2c2b608e

                                                            SHA1

                                                            2f1ce8b589e57ab300bb93dde176689689f75114

                                                            SHA256

                                                            11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                            SHA512

                                                            a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.4040.update
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            14ffcf07375b3952bd3f2fe52bb63c14

                                                            SHA1

                                                            ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                            SHA256

                                                            6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                            SHA512

                                                            14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                            Filesize

                                                            8KB

                                                            MD5

                                                            bc3fb593d59c6f62f17a30bfbb722e7e

                                                            SHA1

                                                            58b9c33f5eb3464db35c8ac2a5732cae475cdfa4

                                                            SHA256

                                                            6cb03a2882a469345f065efd6dfd1eea894a1ac80c6c6c7d387f99270b9f3924

                                                            SHA512

                                                            4c68e2085e79109b1337fe5e5311608a274ee452f64f9e636a2ca185853e2dfa093c7ae96596e75baed7bbfaca8530ab755eabf7f33a5f5e544d1ff921f6e333

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                            Filesize

                                                            2B

                                                            MD5

                                                            81051bcc2cf1bedf378224b0a93e2877

                                                            SHA1

                                                            ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                            SHA256

                                                            7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                            SHA512

                                                            1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                            Filesize

                                                            54KB

                                                            MD5

                                                            77c613ffadf1f4b2f50d31eeec83af30

                                                            SHA1

                                                            76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                            SHA256

                                                            2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                            SHA512

                                                            29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                            Filesize

                                                            334KB

                                                            MD5

                                                            b3e14504a48bed32c53ec7aab2cb2c8f

                                                            SHA1

                                                            0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                            SHA256

                                                            adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                            SHA512

                                                            e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                            Filesize

                                                            72KB

                                                            MD5

                                                            749c51599fbf82422791e0df1c1e841c

                                                            SHA1

                                                            bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                            SHA256

                                                            c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                            SHA512

                                                            f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                            Filesize

                                                            50KB

                                                            MD5

                                                            c0f02eaa3eb28659d8f1bcba8de48479

                                                            SHA1

                                                            5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                            SHA256

                                                            6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                            SHA512

                                                            47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                            Filesize

                                                            32KB

                                                            MD5

                                                            f531d3157e9ff57eea92db36c40e283e

                                                            SHA1

                                                            d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                            SHA256

                                                            30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                            SHA512

                                                            27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                            Filesize

                                                            54KB

                                                            MD5

                                                            d11b2139d29e79d795054c3866898b7f

                                                            SHA1

                                                            020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                            SHA256

                                                            11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                            SHA512

                                                            de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                            Filesize

                                                            588KB

                                                            MD5

                                                            17d74c03b6bcbcd88b46fcc58fc79a0d

                                                            SHA1

                                                            bc0316e11c119806907c058d62513eb8ce32288c

                                                            SHA256

                                                            13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                            SHA512

                                                            f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                            Download Submit

                                                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                            Filesize

                                                            223B

                                                            MD5

                                                            e3704ea58c7ffc03e4d878339aea96b1

                                                            SHA1

                                                            99f71b6d7e88354d936d2492fd74e8bf68faab9e

                                                            SHA256

                                                            9e422d6b3a387dd8bacef60e7e0c136c1c202fc6c6f7eadd524d5c7f1d2e428a

                                                            SHA512

                                                            19ffeef9f9b3d93668440121fefa54b64de77d9f4ef74df03a26b5ea50d824f41e51dc4ba523ceac051b9e9c452a59d734117cc43d8a2976e418a00b911d79db

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                            Filesize

                                                            9KB

                                                            MD5

                                                            1ef7574bc4d8b6034935d99ad884f15b

                                                            SHA1

                                                            110709ab33f893737f4b0567f9495ac60c37667c

                                                            SHA256

                                                            0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                            SHA512

                                                            947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            f512536173e386121b3ebd22aac41a4e

                                                            SHA1

                                                            74ae133215345beaebb7a95f969f34a40dda922a

                                                            SHA256

                                                            a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                            SHA512

                                                            1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                            Filesize

                                                            76KB

                                                            MD5

                                                            b40fe65431b18a52e6452279b88954af

                                                            SHA1

                                                            c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                            SHA256

                                                            800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                            SHA512

                                                            e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                            Download Submit

                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                            Filesize

                                                            80KB

                                                            MD5

                                                            3904d0698962e09da946046020cbcb17

                                                            SHA1

                                                            edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                            SHA256

                                                            a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                            SHA512

                                                            c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            287B

                                                            MD5

                                                            fcad4da5d24f95ebf38031673ddbcdb8

                                                            SHA1

                                                            3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                            SHA256

                                                            7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                            SHA512

                                                            1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                            Filesize

                                                            717B

                                                            MD5

                                                            ef0a07aec4367a64c16c581da2657aa9

                                                            SHA1

                                                            13011a5abcbadb3424fb6ecee560665556bb1d24

                                                            SHA256

                                                            f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                            SHA512

                                                            35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                            Filesize

                                                            7KB

                                                            MD5

                                                            362ce475f5d1e84641bad999c16727a0

                                                            SHA1

                                                            6b613c73acb58d259c6379bd820cca6f785cc812

                                                            SHA256

                                                            1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                            SHA512

                                                            7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                            Filesize

                                                            1.9MB

                                                            MD5

                                                            8de5a7a19d882820893d8b911c1710fb

                                                            SHA1

                                                            95cdf5855bc5e454c8944952697ab142f77124f7

                                                            SHA256

                                                            2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                            SHA512

                                                            3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            9a9b1fd85b5f1dcd568a521399a0d057

                                                            SHA1

                                                            34ed149b290a3a94260d889ba50cb286f1795fa6

                                                            SHA256

                                                            88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                            SHA512

                                                            7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                            Filesize

                                                            375KB

                                                            MD5

                                                            3c93b399b417b0d6a232d386e65a8b46

                                                            SHA1

                                                            bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                            SHA256

                                                            29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                            SHA512

                                                            a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                            Filesize

                                                            321KB

                                                            MD5

                                                            d3901e62166e9c42864fe3062cb4d8d5

                                                            SHA1

                                                            c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                            SHA256

                                                            dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                            SHA512

                                                            ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                            Filesize

                                                            814KB

                                                            MD5

                                                            9b1f97a41bfb95f148868b49460d9d04

                                                            SHA1

                                                            768031d5e877e347a249dfdeab7c725df941324b

                                                            SHA256

                                                            09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                            SHA512

                                                            9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            e74d2a16da1ddb7f9c54f72b8a25897c

                                                            SHA1

                                                            32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                            SHA256

                                                            a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                            SHA512

                                                            52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                            Filesize

                                                            11B

                                                            MD5

                                                            5eda46a55c61b07029e7202f8cf1781c

                                                            SHA1

                                                            862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                            SHA256

                                                            12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                            SHA512

                                                            4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                            Filesize

                                                            12B

                                                            MD5

                                                            5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                            SHA1

                                                            93012724e6cc0a298838aede678806e6c0c6517d

                                                            SHA256

                                                            a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                            SHA512

                                                            890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            b4a865268d5aca5f93bab91d7d83c800

                                                            SHA1

                                                            95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                            SHA256

                                                            5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                            SHA512

                                                            c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            47594637ae058a52ed761ad6a439e2a8

                                                            SHA1

                                                            bd2e0d8b36ac84041a28d4ed957745462acb3c30

                                                            SHA256

                                                            941e38764a77f3376a5341cc4234f758b800d5e98930f2235731165380cff416

                                                            SHA512

                                                            245ffa1b8957982fea54615e137f5cf043ed32d89e7d79f0735d0c7e7370228ca365199962aa6fa4c821e604c92a501c3a29381fdab093a0ef69ca9f6402c909

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            e745dc8426bc4a45a47f975b7c572ff4

                                                            SHA1

                                                            8685be3dbc2edb4372056b6f43c63a52f12ffebc

                                                            SHA256

                                                            57aa0ab083eedd3dc0ae8e566c806c0abfe6704832f3aeeea9fc2adc61f97516

                                                            SHA512

                                                            0f5a08974524c73f13233f86e30df129f63b82e10de33de75bdabe8bb43a3a9aa10321cbb63625ec57e2cc2945f87e65970c278fd58ac485b3a4e93fee8c9886

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                            Filesize

                                                            2.8MB

                                                            MD5

                                                            91453d3e1e2bc9586cf5495073fb3cf7

                                                            SHA1

                                                            09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                            SHA256

                                                            5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                            SHA512

                                                            462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            384d6da5c34ff401b18f0af41e3a2643

                                                            SHA1

                                                            3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                            SHA256

                                                            0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                            SHA512

                                                            5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            6c6f85e896655a6eb726482f04c49086

                                                            SHA1

                                                            2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                            SHA256

                                                            e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                            SHA512

                                                            b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                            Filesize

                                                            541B

                                                            MD5

                                                            d0efb0a6d260dbe5d8c91d94b77d7acd

                                                            SHA1

                                                            e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                            SHA256

                                                            7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                            SHA512

                                                            a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                            Filesize

                                                            12B

                                                            MD5

                                                            3d66ae5ed06891e8ce75a39a24070844

                                                            SHA1

                                                            368064119835d4376727a14706c41384446183e8

                                                            SHA256

                                                            73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                            SHA512

                                                            c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                            Filesize

                                                            646KB

                                                            MD5

                                                            7895698867d1ad33934a8553b4806dc5

                                                            SHA1

                                                            32704df55deaff9bf0b4ee0b887541856578938b

                                                            SHA256

                                                            ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                            SHA512

                                                            20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                            Filesize

                                                            3.1MB

                                                            MD5

                                                            85e1898362165fc1315d18abb73c1b37

                                                            SHA1

                                                            289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                            SHA256

                                                            d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                            SHA512

                                                            49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                            Download Submit

                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                            Filesize

                                                            569KB

                                                            MD5

                                                            9614d1da18956de06747c03068208d66

                                                            SHA1

                                                            fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                            SHA256

                                                            dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                            SHA512

                                                            d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                            Download Submit

                                                          • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\3d17899d42f7243670d1ddf69c84502f
                                                            Filesize

                                                            16KB

                                                            MD5

                                                            b2e89027a140a89b6e3eb4e504e93d96

                                                            SHA1

                                                            f3b1b34874b73ae3032decb97ef96a53a654228f

                                                            SHA256

                                                            5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                            SHA512

                                                            93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                            Download Submit

                                                          • C:\ProgramData\chocolatey\config\chocolatey.config
                                                            Filesize

                                                            809B

                                                            MD5

                                                            8b6737800745d3b99886d013b3392ac3

                                                            SHA1

                                                            bb94da3f294922d9e8d31879f2d145586a182e19

                                                            SHA256

                                                            86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                            SHA512

                                                            654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                            Download Submit

                                                          • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            f271b012199f964e29cc2bb0a2b79224

                                                            SHA1

                                                            80fdfb33d298dbd9c1e2510d0e20107c5f6222c2

                                                            SHA256

                                                            7cb6d9289667716b19dbeff88a262f3c77f993ae5ae0e5b10b2f32fc2821418b

                                                            SHA512

                                                            e5a133d270881768e03b853d77c68bb896aefc859825fb22206bec325c81ded9e43839fdefa4ec52d3cf5991a3ab5c2fc4556b5743124de7bdf35eff1801fd43

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            Filesize

                                                            471B

                                                            MD5

                                                            7795df33fc7dd3aa62e0bc052f9dfbad

                                                            SHA1

                                                            ea227ec994561b5bce01c5228f9c337286fbec9c

                                                            SHA256

                                                            6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736

                                                            SHA512

                                                            de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            727B

                                                            MD5

                                                            2a98ceecefb9f6844026540ae1b998a7

                                                            SHA1

                                                            4772a0e71f59385f9e527b8d320e192731c20db5

                                                            SHA256

                                                            7d1a90367c7942850083e30715173daf58eef172176871649b6d2e7a9e0c3727

                                                            SHA512

                                                            6eb16bded3d769ea3a4742cc89b24b810764ce2c0db8bf76eae5dfac92910a37b4dfa4c0ec494c7430c6a8a6cbb17b8e56b6ecfe9029e9d078b2f50dd2338925

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            727B

                                                            MD5

                                                            f0339c0506fe0b51215f7227b14e656f

                                                            SHA1

                                                            cf937eeed1483e23e81244baa03d5e8f112c56d5

                                                            SHA256

                                                            47bf8749c1ac54c6586d625c99219f03c6a073f3b3f5689444985aae85a3e5b1

                                                            SHA512

                                                            afb55465411bce78b7453e17aca382e0add24a1b0dd7f116cb077a2641abcbde8684e076d69ca6a3a61a3e47d156f85c80621082ab1a80f4a5b3b1b75f20d5bc

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                            Filesize

                                                            400B

                                                            MD5

                                                            b00b07d26a77d26801148d83e549013c

                                                            SHA1

                                                            de2f46b355e5929553b8484111ebeb1252f560d4

                                                            SHA256

                                                            b90c4395c86aa5d5a3a2f8aa9bd90964e540ab60d9fe7320883e84d97e49e6db

                                                            SHA512

                                                            35c9a12c3e53d2236afaee495202aa3b8678421517047ca61388ede03ef1ae1a449a569511355a75ed754d2e2113fdbcefdb6a153d87127aa229b9f6d8882b00

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            404B

                                                            MD5

                                                            9f95c686e5fec7103ef7e3097fb8e701

                                                            SHA1

                                                            21c491880cce10662f75cff6cf042aa003126d22

                                                            SHA256

                                                            530a10ad4e2c476242d59ff22aa0cc2f326cdaba2fdff12fc057dc27713db555

                                                            SHA512

                                                            6e7bcd70db2495d8dd3654fc45a56fa3634e0bbdd31e7618839221ca0c928495bde3f8890c3df545bac2bb3dde548bc8f0923e0f58607beabf22b94d3fc70467

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            412B

                                                            MD5

                                                            4f180ece0956fc7f43d2caa92c380189

                                                            SHA1

                                                            f5b98eb048c8cc90b8f09ce569ce1228a547a7c6

                                                            SHA256

                                                            aaaace5e583e212e2ae5508681075e04f0e6eb96e5d3c4474db91565c14e3e68

                                                            SHA512

                                                            3d08c21e5e2bce4e8f4d57a3285673c9947ab99bafaff26fa690805bd85c120da41f1932568602fdccbed4943b0c6a85dbf3d59d0704c643adfc8defa597b901

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                            Filesize

                                                            651B

                                                            MD5

                                                            9bbfe11735bac43a2ed1be18d0655fe2

                                                            SHA1

                                                            61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                            SHA256

                                                            549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                            SHA512

                                                            a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                            Download Submit

                                                          • C:\Windows\Installer\MSI102F.tmp
                                                            Filesize

                                                            4.5MB

                                                            MD5

                                                            2207f96731ce2f9d9327c0baaf4959ef

                                                            SHA1

                                                            f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                            SHA256

                                                            e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                            SHA512

                                                            7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                            Download Submit

                                                          • C:\Windows\Installer\MSI6846.tmp-\System.Management.dll
                                                            Filesize

                                                            60KB

                                                            MD5

                                                            878e361c41c05c0519bfc72c7d6e141c

                                                            SHA1

                                                            432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                            SHA256

                                                            24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                            SHA512

                                                            59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIAAFE.tmp
                                                            Filesize

                                                            509KB

                                                            MD5

                                                            88d29734f37bdcffd202eafcdd082f9d

                                                            SHA1

                                                            823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                            SHA256

                                                            87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                            SHA512

                                                            1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIAAFE.tmp-\AlphaControlAgentInstallation.dll
                                                            Filesize

                                                            25KB

                                                            MD5

                                                            aa1b9c5c685173fad2dabebeb3171f01

                                                            SHA1

                                                            ed756b1760e563ce888276ff248c734b7dd851fb

                                                            SHA256

                                                            e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                            SHA512

                                                            d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIAAFE.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            1a5caea6734fdd07caa514c3f3fb75da

                                                            SHA1

                                                            f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                            SHA256

                                                            cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                            SHA512

                                                            a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIADAF.tmp-\CustomAction.config
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            bc17e956cde8dd5425f2b2a68ed919f8

                                                            SHA1

                                                            5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                            SHA256

                                                            e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                            SHA512

                                                            02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIADAF.tmp-\Newtonsoft.Json.dll
                                                            Filesize

                                                            695KB

                                                            MD5

                                                            715a1fbee4665e99e859eda667fe8034

                                                            SHA1

                                                            e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                            SHA256

                                                            c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                            SHA512

                                                            bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                            Download Submit

                                                          • C:\Windows\Installer\MSIB3AD.tmp
                                                            Filesize

                                                            211KB

                                                            MD5

                                                            a3ae5d86ecf38db9427359ea37a5f646

                                                            SHA1

                                                            eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                            SHA256

                                                            c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                            SHA512

                                                            96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                            Download Submit

                                                          • C:\Windows\Installer\e5faa81.msi
                                                            Filesize

                                                            2.9MB

                                                            MD5

                                                            a49092bd08748f5fe5e51ffcb63325f5

                                                            SHA1

                                                            1f5101843913e1f053442b7412635855ed80e16d

                                                            SHA256

                                                            33283eed43cb365ae5f4541f387ea4f4e81667573b3c890be5606fc53c5852d5

                                                            SHA512

                                                            126e5eebd2eb640a181d2e7567120c8a98e6feb94236206995f48932dd90c7448ee6bd7449c6b947bf49f84fbaa2e4894008f63a56a56bc87501bcc75cc5383c

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{76fe1b34-e1aa-dc4c-9164-72d4f49ed3c0}\lci_iddcx.cat
                                                            Filesize

                                                            10KB

                                                            MD5

                                                            62458e58313475c9a3642a392363e359

                                                            SHA1

                                                            e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                            SHA256

                                                            85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                            SHA512

                                                            49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{76fe1b34-e1aa-dc4c-9164-72d4f49ed3c0}\lci_iddcx.inf
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            1cec22ca85e1b5a8615774fca59a420b

                                                            SHA1

                                                            049a651751ef38321a1088af6a47c4380f9293fc

                                                            SHA256

                                                            60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                            SHA512

                                                            0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{76fe1b34-e1aa-dc4c-9164-72d4f49ed3c0}\x64\lci_iddcx.dll
                                                            Filesize

                                                            52KB

                                                            MD5

                                                            01e8bc64139d6b74467330b11331858d

                                                            SHA1

                                                            b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                            SHA256

                                                            148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                            SHA512

                                                            4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{77980952-999d-734c-a62a-adec183bf8d1}\lci_proxywddm.cat
                                                            Filesize

                                                            12KB

                                                            MD5

                                                            8e16d54f986dbe98812fd5ec04d434e8

                                                            SHA1

                                                            8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                            SHA256

                                                            7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                            SHA512

                                                            e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{77980952-999d-734c-a62a-adec183bf8d1}\lci_proxywddm.inf
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            0315a579f5afe989154cb7c6a6376b05

                                                            SHA1

                                                            e352ff670358cf71e0194918dfe47981e9ccbb88

                                                            SHA256

                                                            d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                            SHA512

                                                            c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{77980952-999d-734c-a62a-adec183bf8d1}\x64\lci_proxyumd.dll
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            4dc11547a5fc28ca8f6965fa21573481

                                                            SHA1

                                                            d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                            SHA256

                                                            e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                            SHA512

                                                            bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{77980952-999d-734c-a62a-adec183bf8d1}\x64\lci_proxyumd32.dll
                                                            Filesize

                                                            135KB

                                                            MD5

                                                            67ae7b2c36c9c70086b9d41b4515b0a8

                                                            SHA1

                                                            ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                            SHA256

                                                            79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                            SHA512

                                                            4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                            Download Submit

                                                          • C:\Windows\System32\DriverStore\Temp\{77980952-999d-734c-a62a-adec183bf8d1}\x64\lci_proxywddm.sys
                                                            Filesize

                                                            119KB

                                                            MD5

                                                            b9b0e9b4d93b18b99ece31a819d71d00

                                                            SHA1

                                                            2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                            SHA256

                                                            0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                            SHA512

                                                            465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                            Download Submit

                                                          • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-02-25-48.dat
                                                            Filesize

                                                            602B

                                                            MD5

                                                            360437116ed4aad52fb38caef207bde5

                                                            SHA1

                                                            b8d71bec7cf59e0b3696af2d83144b183bfafbcb

                                                            SHA256

                                                            f7a9596d765c690e3a7a70b6f01b91a0ffebbb67252b7bdaf69a551cc20d3675

                                                            SHA512

                                                            76dad1d2c85d3ec8710608f49b3922de611ca5fc8b220b7781886853dd69c59131e6ca97cece167d3a1991dc38e49782e676d4e5af18298497cf43252861ab64

                                                            Download Submit

                                                          • C:\Windows\Temp\InstallUtil.log
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            0fb7a45e5bf2bf874027b4d3636ee03b

                                                            SHA1

                                                            1d0d2fbb846b50fb3279cc8f209ff60d4e8b51fa

                                                            SHA256

                                                            1d6f4a8af17a4e7d1e613748add44417206fdd17a1adc014e4f42446868dfbd9

                                                            SHA512

                                                            5ec2f17d1ebdad2b39d95e97df8acba936a400bba113da53e70245e698b9f65539d2734e7e5bf0fb6bfe94e6d791819c7f96e5887d0e0863c0176f014bbb3cb9

                                                            Download Submit

                                                          • C:\Windows\Temp\InstallUtil.log
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            c97f7585f63ae36cb3376bd1b5883c06

                                                            SHA1

                                                            945ea58221fcf080a6d06ae720dafd84602223db

                                                            SHA256

                                                            f9fdcdbd796b85154b848a5b0e5fdaa1eac4593b48b82edfabc1222e88936e6a

                                                            SHA512

                                                            b99bd7ce10353a2abf347453c13e2cab47837a7a750313b7e4daa37bd715b4b43da511c22d6f3c14daddda0f789dd4947c7c781949cdfc726851a8cb4e5e82b8

                                                            Download Submit

                                                          • C:\Windows\Temp\PreVer.log
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            098cbdcf9bf21400c4c9baf0e8f1f495

                                                            SHA1

                                                            35e5a35830d5657fe7d86e7ce5ea8e96c332d124

                                                            SHA256

                                                            c431ef1015972f642e621e0755b91cb1f6830b67561710d43f84c3dd5510fce0

                                                            SHA512

                                                            a1e05f7e584d301d9511a34b2b99573b91499a47e18286a531b804a5c5db262b349046d17264855df3d76db1f89d54a7d6255965c6bde3399c918fb9b47eb4c0

                                                            Download Submit

                                                          • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                            Filesize

                                                            3.2MB

                                                            MD5

                                                            a7ce785b6cd1c9657040ca9b6cbeed10

                                                            SHA1

                                                            4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                            SHA256

                                                            7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                            SHA512

                                                            39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                            Download Submit

                                                          • C:\Windows\Temp\{344D4447-C09B-4094-A719-DF4B68BAC040}\ISRT.dll
                                                            Filesize

                                                            427KB

                                                            MD5

                                                            85315ad538fa5af8162f1cd2fce1c99d

                                                            SHA1

                                                            31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                            SHA256

                                                            70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                            SHA512

                                                            877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                            Download Submit

                                                          • C:\Windows\Temp\{344D4447-C09B-4094-A719-DF4B68BAC040}\_isres_0x0409.dll
                                                            Filesize

                                                            1.8MB

                                                            MD5

                                                            befe2ef369d12f83c72c5f2f7069dd87

                                                            SHA1

                                                            b89c7f6da1241ed98015dc347e70322832bcbe50

                                                            SHA256

                                                            9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                            SHA512

                                                            760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                            Download Submit

                                                          • C:\Windows\Temp\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\IsConfig.ini
                                                            Filesize

                                                            571B

                                                            MD5

                                                            38370175ce7d8dd5c3581030a9104259

                                                            SHA1

                                                            bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                            SHA256

                                                            ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                            SHA512

                                                            e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                            Download Submit

                                                          • C:\Windows\Temp\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\String1033.txt
                                                            Filesize

                                                            182KB

                                                            MD5

                                                            37a2c4ef0ff41955f1cb884b7790699f

                                                            SHA1

                                                            8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                            SHA256

                                                            6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                            SHA512

                                                            fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                            Download Submit

                                                          • C:\Windows\Temp\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\_is6EB.exe
                                                            Filesize

                                                            179KB

                                                            MD5

                                                            7a1c100df8065815dc34c05abc0c13de

                                                            SHA1

                                                            3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                            SHA256

                                                            e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                            SHA512

                                                            bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                            Download Submit

                                                          • C:\Windows\Temp\{E6E2A544-F2C7-4DB2-A007-DBEDB342E8D2}\setup.inx
                                                            Filesize

                                                            345KB

                                                            MD5

                                                            0376dd5b7e37985ea50e693dc212094c

                                                            SHA1

                                                            02859394164c33924907b85ab0aaddc628c31bf1

                                                            SHA256

                                                            c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                            SHA512

                                                            69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                            Download Submit

                                                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                            Filesize

                                                            404B

                                                            MD5

                                                            532574de7a56a316fd5ef0f2357b5ee5

                                                            SHA1

                                                            99efd437186d8469682d02d8d2655b2e3467c6c6

                                                            SHA256

                                                            ff2e1053c56cb656d951a0d3f3cf7250146db6e7b8d37c066f03ca8d673442d7

                                                            SHA512

                                                            45cb4d746b07d5941fe34f139e021dbeb39f46f4c8cc4e16fcf810f5dc63484984c9591140dee9c93938ba5b439bab785c6671ebd9e53f9b31b9fcf6d9fcd293

                                                            Download Submit

                                                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                            Filesize

                                                            412B

                                                            MD5

                                                            7d9f20346cc0d520777597b04920d2a4

                                                            SHA1

                                                            947088a8f358886261ca38c46bcf42afbb615f7d

                                                            SHA256

                                                            61a18e3fea6f71c7a0906568080fc25185f1fff82907bdf1b77c633cc90ee615

                                                            SHA512

                                                            0d50ef68bed05075c675150b5a78c0b39b1a9ed450fa06733997134575bbe356d902fd73909fe1ff3dd11a1b06923ff79f5f3cc19ee6abd3d286d16abf4084cf

                                                            Download Submit

                                                          • memory/1540-1398-0x000001E9EE430000-0x000001E9EE448000-memory.dmp

                                                            Filesize

                                                            96KB

                                                            Download

                                                          • memory/1540-1372-0x000001E9EDBD0000-0x000001E9EDBDC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/1540-1446-0x000001E9EED00000-0x000001E9EEDB2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1540-1493-0x000001E9EEC40000-0x000001E9EEC60000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/1572-361-0x0000015CEC6C0000-0x0000015CEC772000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1572-359-0x0000015CEBA30000-0x0000015CEBA3A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/1572-368-0x0000015CEC510000-0x0000015CEC536000-memory.dmp

                                                            Filesize

                                                            152KB

                                                            Download

                                                          • memory/1572-367-0x0000015CEC830000-0x0000015CEC86A000-memory.dmp

                                                            Filesize

                                                            232KB

                                                            Download

                                                          • memory/1572-366-0x0000015CEC540000-0x0000015CEC56A000-memory.dmp

                                                            Filesize

                                                            168KB

                                                            Download

                                                          • memory/1572-353-0x0000015CEB180000-0x0000015CEB1E4000-memory.dmp

                                                            Filesize

                                                            400KB

                                                            Download

                                                          • memory/1572-354-0x0000015CEBBB0000-0x0000015CEBBFA000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/1572-365-0x0000015CEC780000-0x0000015CEC7E8000-memory.dmp

                                                            Filesize

                                                            416KB

                                                            Download

                                                          • memory/1572-364-0x0000015CEC500000-0x0000015CEC508000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1572-363-0x0000015CEC3E0000-0x0000015CEC3E8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1572-362-0x0000015CEC3D0000-0x0000015CEC3D8000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1572-355-0x0000015CEBB60000-0x0000015CEBB7C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/1572-360-0x0000015CEC5E0000-0x0000015CEC6BC000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/1572-356-0x0000015CEC320000-0x0000015CEC36C000-memory.dmp

                                                            Filesize

                                                            304KB

                                                            Download

                                                          • memory/1572-358-0x0000015CEBA20000-0x0000015CEBA28000-memory.dmp

                                                            Filesize

                                                            32KB

                                                            Download

                                                          • memory/1572-357-0x0000015CEC370000-0x0000015CEC3B8000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/1772-313-0x000002520A5A0000-0x000002520A5BC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/1772-312-0x0000025222E50000-0x0000025222F02000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/1772-311-0x0000025209D40000-0x0000025209D56000-memory.dmp

                                                            Filesize

                                                            88KB

                                                            Download

                                                          • memory/1912-911-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/1912-489-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/1912-492-0x0000000003A50000-0x0000000003C17000-memory.dmp

                                                            Filesize

                                                            1.8MB

                                                            Download

                                                          • memory/1912-523-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/1912-914-0x0000000003A90000-0x0000000003C57000-memory.dmp

                                                            Filesize

                                                            1.8MB

                                                            Download

                                                          • memory/1912-1053-0x0000000010000000-0x0000000010114000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/1916-1256-0x000001BDEEB80000-0x000001BDEEB9C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/1916-1626-0x000001BDEF420000-0x000001BDEF474000-memory.dmp

                                                            Filesize

                                                            336KB

                                                            Download

                                                          • memory/1916-284-0x000002544D9D0000-0x000002544DA00000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1916-287-0x0000025466B50000-0x0000025466C00000-memory.dmp

                                                            Filesize

                                                            704KB

                                                            Download

                                                          • memory/1916-1255-0x000001BDEE320000-0x000001BDEE332000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/1916-1257-0x000001BDEF480000-0x000001BDEF532000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/2192-39-0x0000000004FE0000-0x000000000500E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                            Download

                                                          • memory/2192-43-0x0000000004FD0000-0x0000000004FDC000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/2952-289-0x00000202CE2B0000-0x00000202CE2CC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/3060-110-0x00000000049E0000-0x0000000004A46000-memory.dmp

                                                            Filesize

                                                            408KB

                                                            Download

                                                          • memory/3712-1219-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3712-2317-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3712-1220-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3712-1146-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/3712-1144-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/3712-2318-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4040-1812-0x000001B4EA660000-0x000001B4EACBC000-memory.dmp

                                                            Filesize

                                                            6.4MB

                                                            Download

                                                          • memory/4040-1797-0x000001B4D0C30000-0x000001B4D0C40000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/4040-1800-0x000001B4D0C80000-0x000001B4D0CA0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4040-1795-0x000001B4D0400000-0x000001B4D0410000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/4040-1814-0x000001B4EA000000-0x000001B4EA046000-memory.dmp

                                                            Filesize

                                                            280KB

                                                            Download

                                                          • memory/4040-1799-0x000001B4E9590000-0x000001B4E9642000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4240-80-0x0000000005060000-0x00000000053B4000-memory.dmp

                                                            Filesize

                                                            3.3MB

                                                            Download

                                                          • memory/4240-76-0x0000000004FA0000-0x0000000005052000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4240-79-0x0000000004F30000-0x0000000004F52000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/4368-241-0x0000020CF7670000-0x0000020CF76A8000-memory.dmp

                                                            Filesize

                                                            224KB

                                                            Download

                                                          • memory/4368-200-0x0000020CF7110000-0x0000020CF71C2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/4368-202-0x0000020CF7080000-0x0000020CF70A2000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/4424-165-0x000001375F620000-0x000001375F65C000-memory.dmp

                                                            Filesize

                                                            240KB

                                                            Download

                                                          • memory/4424-164-0x0000013746CA0000-0x0000013746CB2000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/4424-148-0x00000137450C0000-0x00000137450E8000-memory.dmp

                                                            Filesize

                                                            160KB

                                                            Download

                                                          • memory/4424-160-0x000001375F6C0000-0x000001375F758000-memory.dmp

                                                            Filesize

                                                            608KB

                                                            Download

                                                          • memory/4428-1154-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4428-1228-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4428-2319-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4428-1227-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4428-2320-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4936-1232-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/4936-1231-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4936-1158-0x0000000073160000-0x000000007327C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                            Download

                                                          • memory/4936-1161-0x0000000072D90000-0x000000007315D000-memory.dmp

                                                            Filesize

                                                            3.8MB

                                                            Download

                                                          • memory/5020-1801-0x0000023B19710000-0x0000023B19724000-memory.dmp

                                                            Filesize

                                                            80KB

                                                            Download

                                                          • memory/5020-1798-0x0000023B19C60000-0x0000023B19CC6000-memory.dmp

                                                            Filesize

                                                            408KB

                                                            Download

                                                          • memory/5020-1793-0x0000023B196B0000-0x0000023B196D0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/5020-1796-0x0000023B32400000-0x0000023B324B2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5020-1792-0x0000023B19210000-0x0000023B19220000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/5128-1802-0x0000027D450E0000-0x0000027D451BC000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/5128-1790-0x0000027D2BD70000-0x0000027D2BD80000-memory.dmp

                                                            Filesize

                                                            64KB

                                                            Download

                                                          • memory/5128-1791-0x0000027D44DF0000-0x0000027D44E3A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5128-1794-0x0000027D44DC0000-0x0000027D44DDC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5332-1544-0x000002CCEE560000-0x000002CCEE57A000-memory.dmp

                                                            Filesize

                                                            104KB

                                                            Download

                                                          • memory/5332-1543-0x000002CCEE0C0000-0x000002CCEE0CA000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/5332-1589-0x000002CCEF2B0000-0x000002CCEF362000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5332-1806-0x000002CCEF9A0000-0x000002CCEFEC8000-memory.dmp

                                                            Filesize

                                                            5.2MB

                                                            Download

                                                          • memory/5480-1625-0x000001A27F5E0000-0x000001A27F5FC000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5480-1803-0x000001A27FFE0000-0x000001A280092000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5480-1652-0x000001A27F600000-0x000001A27F618000-memory.dmp

                                                            Filesize

                                                            96KB

                                                            Download

                                                          • memory/5480-1586-0x000001A27F630000-0x000001A27F67A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5480-1809-0x000001A280180000-0x000001A28025C000-memory.dmp

                                                            Filesize

                                                            880KB

                                                            Download

                                                          • memory/5480-1708-0x000001A27F160000-0x000001A27F16A000-memory.dmp

                                                            Filesize

                                                            40KB

                                                            Download

                                                          • memory/5480-1556-0x000001A27ED80000-0x000001A27EDB4000-memory.dmp

                                                            Filesize

                                                            208KB

                                                            Download

                                                          • memory/5480-1758-0x000001A27FED0000-0x000001A27FF1A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5492-1583-0x00000200D1860000-0x00000200D189A000-memory.dmp

                                                            Filesize

                                                            232KB

                                                            Download

                                                          • memory/5492-1805-0x00000200EA950000-0x00000200EA96C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5492-1804-0x00000200EAA10000-0x00000200EAAC2000-memory.dmp

                                                            Filesize

                                                            712KB

                                                            Download

                                                          • memory/5492-1811-0x00000200EA9C0000-0x00000200EAA08000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/5680-1813-0x00000273F9930000-0x00000273F99E0000-memory.dmp

                                                            Filesize

                                                            704KB

                                                            Download

                                                          • memory/5680-1624-0x00000273F8640000-0x00000273F864C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/5680-1701-0x00000273F9670000-0x00000273F968C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5680-1657-0x00000273F96C0000-0x00000273F970A000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download

                                                          • memory/5888-1638-0x0000024073F20000-0x0000024073F32000-memory.dmp

                                                            Filesize

                                                            72KB

                                                            Download

                                                          • memory/5888-1788-0x0000024074400000-0x000002407441C000-memory.dmp

                                                            Filesize

                                                            112KB

                                                            Download

                                                          • memory/5888-1654-0x0000024074FB0000-0x0000024074FFA000-memory.dmp

                                                            Filesize

                                                            296KB

                                                            Download