Overview

overview

10

Static

static

10

b8788ba7d7...99.msi

windows7-x64

10

b8788ba7d7...99.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 03:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8788ba7d7d7f8fce00f8446b778b9f9b9852e4ec2f3766d6e32c68b50950899.msi

  • Size

    2.9MB

  • MD5

    6e58d9af76a06f068fc49d0f5f895966

  • SHA1

    6eaf5813536f716cab6ccdda47e8f0beaa74b30c

  • SHA256

    b8788ba7d7d7f8fce00f8446b778b9f9b9852e4ec2f3766d6e32c68b50950899

  • SHA512

    4d314dcc18f09ce95453470101efc55e690657e2288728839f04d7060a1f767a4be0d1b48cc0a980979d35c440144cc2cbffd767732b19e4af4c5333a8fc93e9

  • SSDEEP

    49152:1+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:1+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b8788ba7d7d7f8fce00f8446b778b9f9b9852e4ec2f3766d6e32c68b50950899.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1968
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 063F313846D666EF5D5205003AD2FC3C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIAD86.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240627281 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4936
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIB017.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240627750 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIB5C5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240629203 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4136
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIC192.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240632203 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1552
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AEE62E3CC76BE135711AF7BAA8ED8B6E E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:340
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:716
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="22" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="21" /AccountId="0013z00002eDbtlAAC" /AgentId="6f2e08e8-2024-4987-b3e9-3ab65728559c"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4108
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 691B6A0218EB8A277F80C5054F02C9CB E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{44D50979-2531-41D7-A90B-2C600453333D}
        3⤵
        • Executes dropped EXE
        PID:1696
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A302EA9C-2F6D-40B5-B856-F6612DC6B92E}
        3⤵
        • Executes dropped EXE
        PID:4400
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43EECB15-4010-49A9-8D1F-78C04868D0CF}
        3⤵
        • Executes dropped EXE
        PID:4452
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2BED70E1-13EE-41A3-AD7F-70732AAC9680}
        3⤵
        • Executes dropped EXE
        PID:3252
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AA05AC73-1AA9-461E-AAAC-259A14E68BF3}
        3⤵
        • Executes dropped EXE
        PID:1092
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{92996A2D-5090-4AB8-8A5D-8C157676EE85}
        3⤵
        • Executes dropped EXE
        PID:4496
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83547C4F-EB1E-4949-AA7A-C6A2E5257C41}
        3⤵
        • Executes dropped EXE
        PID:4084
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CCA6D8DE-3018-46EB-992A-6694B2C6DA25}
        3⤵
        • Executes dropped EXE
        PID:4368
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9281F438-20BB-4C2F-9701-CC5CE96FC92F}
        3⤵
        • Executes dropped EXE
        PID:3776
      • C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe
        C:\Windows\TEMP\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isFA5E.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D97DC551-2F0B-468B-9D88-FBBDA6DE98F2}
        3⤵
        • Executes dropped EXE
        PID:60
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4824
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3672
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3684
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3252
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2948
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1560
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1092
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4768
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3620
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3240
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3064
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4472
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4400
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1364
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3480
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:684
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:4108
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1560
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1860
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A93511C9-5234-4036-8E2A-59D0654DA06F}
        3⤵
        • Executes dropped EXE
        PID:2804
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C35B35A8-0651-4F92-9CD0-5B9A3D3BA51A}
        3⤵
        • Executes dropped EXE
        PID:3780
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46466D29-9EE2-4EDA-8525-12C22B088E18}
        3⤵
        • Executes dropped EXE
        PID:3776
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E02A79C3-CAEF-4076-A540-1A6AB9991764}
        3⤵
        • Executes dropped EXE
        PID:3544
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{23BBC3D9-8F1D-41DF-84EC-7E1045E459AA}
        3⤵
        • Executes dropped EXE
        PID:4368
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F26ED824-A4CE-474C-944D-80DF2F1F0396}
        3⤵
        • Executes dropped EXE
        PID:3580
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ACB74725-B92A-479C-A9E5-F78971676040}
        3⤵
        • Executes dropped EXE
        PID:4236
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{50923829-4128-42E2-9B08-FD5D7C0A2FB0}
        3⤵
        • Executes dropped EXE
        PID:3672
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{576A2311-0682-434C-B4F3-E16C0D35031D}
        3⤵
        • Executes dropped EXE
        PID:4784
      • C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
        C:\Windows\TEMP\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA232D93-9AD6-4CF4-8A1E-A2CF9CD8361A}
        3⤵
        • Executes dropped EXE
        PID:2804
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DB341036-CB60-4F94-BFB0-88CE997309FF}
        3⤵
        • Executes dropped EXE
        PID:3580
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{152F8199-C49A-4B77-85D5-D295C1AE1C88}
        3⤵
        • Executes dropped EXE
        PID:3672
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{08A40FF2-67CB-4E07-A828-3DB43050F397}
        3⤵
        • Executes dropped EXE
        PID:5060
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{77852E48-8D8B-4EC9-9343-6D2EDF1070B3}
        3⤵
        • Executes dropped EXE
        PID:4676
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{873EDA2A-37D0-4CD7-85CA-9E63844FE40C}
        3⤵
        • Executes dropped EXE
        PID:4524
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6BA8A7DB-E407-4240-89E1-5B14189BB0A3}
        3⤵
        • Executes dropped EXE
        PID:1500
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E04487AE-96D3-4B8A-8336-3E5E90811E40}
        3⤵
        • Executes dropped EXE
        PID:1424
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CD9FDBFF-5FAD-44D5-A660-99E27D1E5F92}
        3⤵
        • Executes dropped EXE
        PID:4108
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5AECAD9D-2060-4E40-9AD0-997092C775A4}
        3⤵
        • Executes dropped EXE
        PID:3780
      • C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe
        C:\Windows\TEMP\{F1D54372-E501-4824-8361-D4CC0C01B61D}\_is1133.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BBFB8AD7-F769-44C9-B13A-C77DD706805A}
        3⤵
        • Executes dropped EXE
        PID:2148
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2148
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:832
      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3580
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
          4⤵
            PID:3252
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4368
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4496
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D5A4857E-CC63-42C4-8B4E-52407E3923F9}
            3⤵
            • Executes dropped EXE
            PID:3692
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB69293D-BC2A-4B93-B9B5-4F6C0F8CEBFB}
            3⤵
            • Executes dropped EXE
            PID:2804
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F3039B4-11A2-429F-9114-46B40391E8DB}
            3⤵
            • Executes dropped EXE
            PID:5044
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FEE187E6-5F95-43BA-8838-68A2A2489334}
            3⤵
            • Executes dropped EXE
            PID:4448
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{481D164C-CAA1-4711-B769-8D42382033A7}
            3⤵
            • Executes dropped EXE
            PID:3544
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE4A4495-9144-48C5-BB4A-6DFEC25AC892}
            3⤵
            • Executes dropped EXE
            PID:1544
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{13059146-4CFA-4170-AEE6-4886A5A8D8F3}
            3⤵
            • Executes dropped EXE
            PID:1860
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4526B882-A22B-4FF5-B756-6876CAF9E6A5}
            3⤵
            • Executes dropped EXE
            PID:5128
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CFADA882-14D6-4038-84CD-D7B1D25C78B5}
            3⤵
            • Executes dropped EXE
            PID:5160
          • C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe
            C:\Windows\TEMP\{5B9346E6-FD80-495D-A02E-8AA6DF2B6D83}\_is2394.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC9F1DAA-343F-4B99-BF90-1FD91A84C5FB}
            3⤵
            • Executes dropped EXE
            PID:5196
          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:5244
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14977663-27DB-4AA7-9A5A-C069D44AEE68}
            3⤵
            • Executes dropped EXE
            PID:5388
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C323556-960A-43CA-B3E8-5040B947B28D}
            3⤵
            • Executes dropped EXE
            PID:5424
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{39435DFE-22E1-44D5-8B97-97D4372F1C06}
            3⤵
            • Executes dropped EXE
            PID:5456
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{489CA65D-38A1-4FFE-BE50-598C38A7C0E2}
            3⤵
            • Executes dropped EXE
            PID:5492
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B4397732-D5BF-4069-ADA4-3B6687A58063}
            3⤵
            • Executes dropped EXE
            PID:5532
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{589D67E0-341A-4252-8F50-2956AC7BDB13}
            3⤵
            • Executes dropped EXE
            PID:5604
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61209837-25CA-41CB-A1E7-F02E06149269}
            3⤵
            • Executes dropped EXE
            PID:5636
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ECD67229-A7EA-4B5C-A078-A4C4E33F8DEC}
            3⤵
            • Executes dropped EXE
            PID:5668
          • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
            C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81535EAF-0AC1-4CF6-943F-A10E62B44C2C}
            3⤵
              PID:5700
            • C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe
              C:\Windows\TEMP\{1F226416-AB13-4A78-9AA1-8A27D208A5D8}\_is2700.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BFD87B4A-C2A1-4E72-AFC5-141412443734}
              3⤵
                PID:5732
              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5796
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding AB43628CBC65AE5BF3B9BBC0915EB61F E Global\MSI0000
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5632
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI681E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240674906 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                3⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2832
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI6948.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240675187 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                3⤵
                • Blocklisted process makes network request
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5124
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI6C08.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240675828 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                3⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:6128
              • C:\Windows\SysWOW64\NET.exe
                "NET" STOP AteraAgent
                3⤵
                • System Location Discovery: System Language Discovery
                PID:6104
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 STOP AteraAgent
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5732
              • C:\Windows\SysWOW64\TaskKill.exe
                "TaskKill.exe" /f /im AteraAgent.exe
                3⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4652
              • C:\Windows\syswow64\NET.exe
                "NET" STOP AteraAgent
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5704
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 STOP AteraAgent
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1464
              • C:\Windows\syswow64\TaskKill.exe
                "TaskKill.exe" /f /im AteraAgent.exe
                3⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:3176
              • C:\Windows\SysWOW64\rundll32.exe
                rundll32.exe "C:\Windows\Installer\MSI8AF3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240683734 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                3⤵
                • Blocklisted process makes network request
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:640
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
              2⤵
              • Drops file in System32 directory
              PID:5204
            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="b690e525-5589-417b-8ffe-39544e90f180"
              2⤵
              • Drops file in Program Files directory
              • Modifies data under HKEY_USERS
              PID:2524
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4688
          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
            "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
            1⤵
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4860
            • C:\Windows\System32\sc.exe
              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
              2⤵
              • Launches sc.exe
              PID:3684
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "a52fa527-3da1-49bb-a7e3-84ebb6e351a3" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002eDbtlAAC
              2⤵
              • Executes dropped EXE
              PID:512
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "59c62839-6eef-40c9-bce3-77a3622a73d1" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002eDbtlAAC
              2⤵
              • Executes dropped EXE
              PID:3876
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "a42f9921-2005-46dd-94f5-68bdbe79f13a" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 0013z00002eDbtlAAC
              2⤵
              • Executes dropped EXE
              PID:3400
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "54e469f5-51b3-40a6-bcc7-ae758cda20d2" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 0013z00002eDbtlAAC
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2364
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3760
                • C:\Windows\system32\cscript.exe
                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  4⤵
                  • Modifies data under HKEY_USERS
                  PID:3780
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "0422534d-9549-42c3-a8d4-e28bbb3accee" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 0013z00002eDbtlAAC
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2872
              • C:\Windows\TEMP\SplashtopStreamer.exe
                "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3996
                • C:\Windows\Temp\unpack\PreVerCheck.exe
                  "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1732
                  • C:\Windows\SysWOW64\msiexec.exe
                    msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4432
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "30abf71e-6fa3-463c-a607-863a7806d100" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 0013z00002eDbtlAAC
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:444
          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
            "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
            1⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2472
            • C:\Windows\System32\sc.exe
              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
              2⤵
              • Launches sc.exe
              PID:2672
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "c058347d-3b4e-48ae-ba1a-801c4f81a520" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002eDbtlAAC
              2⤵
                PID:5248
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:1144
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:1732
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "7d9112fa-9ce4-4a0d-a9b2-c13113217fda" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002eDbtlAAC
                  2⤵
                    PID:404
                    • C:\Windows\SYSTEM32\msiexec.exe
                      "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                      3⤵
                        PID:5148
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "6befa995-642d-4221-b9e0-88897ef40870" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002eDbtlAAC
                      2⤵
                        PID:5264
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=f0bf4246ef4d30d21c52259f69068180&rmm_session_pwd_ttl=86400"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4612
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "c8100e20-6b1a-4668-8e6f-2ddfda785fc9" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002eDbtlAAC
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        PID:2872
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "50526531-c161-4943-b017-21b87a855922" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002eDbtlAAC
                        2⤵
                        • Drops file in System32 directory
                        PID:5592
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "03c29967-1c73-4634-93b0-5b72cc458948" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002eDbtlAAC
                        2⤵
                        • Drops file in System32 directory
                        PID:4156
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "6a61646e-5de6-41af-9e62-b86a629a4795" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002eDbtlAAC
                        2⤵
                        • Writes to the Master Boot Record (MBR)
                        PID:1252
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "1a7f3186-5396-44f8-8dad-34dab1e9a48e" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002eDbtlAAC
                        2⤵
                          PID:5304
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "00ed3873-a215-466d-8e8b-1f9be5145cec" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002eDbtlAAC
                          2⤵
                          • Drops file in System32 directory
                          • Modifies registry class
                          PID:2996
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "5e317d89-612e-4ba4-99ed-fedc9ca067df" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002eDbtlAAC
                          2⤵
                          • Drops file in System32 directory
                          PID:5888
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "0f4db047-520b-4ed6-8f2c-d13e90d5167a" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002eDbtlAAC
                          2⤵
                          • Drops file in System32 directory
                          PID:5484
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "29e485de-82a1-4803-8192-ea54f811d4bf" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002eDbtlAAC
                          2⤵
                          • Drops file in System32 directory
                          PID:2432
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "ed273a09-8ba4-494a-897c-c2c4d96ce5b5" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002eDbtlAAC
                          2⤵
                          • Drops file in System32 directory
                          PID:1772
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "1f6a9ae2-63d7-4d65-bce5-c5f9d2b7d280" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002eDbtlAAC
                          2⤵
                            PID:6088
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:1780
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:5740
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                          1⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5848
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                            2⤵
                            • Drops file in System32 directory
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5916
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                              -h
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:5136
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                              3⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5180
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                4⤵
                                  PID:5492
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                PID:5188
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5280
                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                  SRUtility.exe -r
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2044
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:4472
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                  4⤵
                                    PID:3764
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ver
                                      5⤵
                                        PID:5496
                                      • C:\Windows\system32\sc.exe
                                        sc query ddmgr
                                        5⤵
                                        • Launches sc.exe
                                        PID:5732
                                      • C:\Windows\system32\sc.exe
                                        sc query lci_proxykmd
                                        5⤵
                                        • Launches sc.exe
                                        PID:4840
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                        5⤵
                                        • Drops file in Windows directory
                                        • Checks SCSI registry key(s)
                                        • Modifies data under HKEY_USERS
                                        PID:2688
                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                1⤵
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                PID:1472
                                • C:\Windows\System32\sc.exe
                                  "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                  2⤵
                                  • Launches sc.exe
                                  PID:2624
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "b00d8331-4ebc-4b43-8a0e-da8801e0ca28" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002eDbtlAAC
                                  2⤵
                                  • Drops file in Program Files directory
                                  PID:3588
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                    3⤵
                                      PID:5056
                                      • C:\Windows\system32\cscript.exe
                                        cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                        4⤵
                                        • Modifies data under HKEY_USERS
                                        PID:3648
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "ee9368d1-7975-47bf-95f6-eac4ca03ad42" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002eDbtlAAC
                                    2⤵
                                    • Drops file in Program Files directory
                                    PID:1252
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "bbcd6b23-dc5a-4c7c-923a-f98c412384d0" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002eDbtlAAC
                                    2⤵
                                      PID:5500
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "bea027b8-bc13-406a-813a-1831c1f163a5" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002eDbtlAAC
                                      2⤵
                                        PID:5768
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "72df4642-0865-4939-a8b7-353f2cce8622" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002eDbtlAAC
                                        2⤵
                                          PID:2652
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "c279df27-2b46-49ab-b38b-d4633099b8c2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002eDbtlAAC
                                          2⤵
                                            PID:5392
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                              3⤵
                                              • System Time Discovery
                                              PID:2572
                                              • C:\Program Files\dotnet\dotnet.exe
                                                dotnet --list-runtimes
                                                4⤵
                                                • System Time Discovery
                                                PID:6092
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "83bdcd5e-14c7-4b9e-a4b6-0714f961d8bb" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002eDbtlAAC
                                            2⤵
                                            • Modifies data under HKEY_USERS
                                            PID:5296
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "ecff2206-e5c5-4b5d-a874-1b4137564a39" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002eDbtlAAC
                                            2⤵
                                              PID:3040
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "5190ea39-8714-4ed3-b3a8-a1c3d609a603" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002eDbtlAAC
                                              2⤵
                                                PID:3848
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "fd29a2cc-b2bf-49ad-affa-52536f0bb88d" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002eDbtlAAC
                                                2⤵
                                                • Writes to the Master Boot Record (MBR)
                                                PID:5636
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "53c74c8b-4c93-410b-ac32-25d0722ef082" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002eDbtlAAC
                                                2⤵
                                                  PID:4488
                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=f0bf4246ef4d30d21c52259f69068180&rmm_session_pwd_ttl=86400"
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2204
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "fd0370e7-c836-4dcd-b4a6-4354b7a860e3" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002eDbtlAAC
                                                  2⤵
                                                  • Drops file in Program Files directory
                                                  PID:2456
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "e5501079-c452-45f5-b4d0-287733366aa8" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002eDbtlAAC
                                                  2⤵
                                                  • Modifies registry class
                                                  PID:5980
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "11c83f1c-e82e-491d-899f-7d570c159028" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002eDbtlAAC
                                                  2⤵
                                                    PID:3040
                                                    • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                      "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "6f2e08e8-2024-4987-b3e9-3ab65728559c" "11c83f1c-e82e-491d-899f-7d570c159028" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "0013z00002eDbtlAAC"
                                                      3⤵
                                                        PID:5720
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 6f2e08e8-2024-4987-b3e9-3ab65728559c "83bdcd5e-14c7-4b9e-a4b6-0714f961d8bb" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002eDbtlAAC
                                                      2⤵
                                                        PID:4652
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                      1⤵
                                                      • Drops file in Windows directory
                                                      • Checks SCSI registry key(s)
                                                      PID:6104
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:2136
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000154" "WinSta0\Default" "0000000000000148" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:5788
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000154"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:5608
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Checks SCSI registry key(s)
                                                        PID:5644

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Event Triggered Execution

                                                    2
                                                    T1546

                                                    Component Object Model Hijacking

                                                    1
                                                    T1546.015

                                                    Installer Packages

                                                    1
                                                    T1546.016

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Privilege Escalation

                                                    Event Triggered Execution

                                                    2
                                                    T1546

                                                    Component Object Model Hijacking

                                                    1
                                                    T1546.015

                                                    Installer Packages

                                                    1
                                                    T1546.016

                                                    Defense Evasion

                                                    Modify Registry

                                                    1
                                                    T1112

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    System Binary Proxy Execution

                                                    1
                                                    T1218

                                                    Msiexec

                                                    1
                                                    T1218.007

                                                    Credential Access

                                                    Discovery

                                                    Peripheral Device Discovery

                                                    2
                                                    T1120

                                                    Query Registry

                                                    4
                                                    T1012

                                                    System Information Discovery

                                                    3
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    System Time Discovery

                                                    1
                                                    T1124

                                                    Lateral Movement

                                                    Collection

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Config.Msi\e57ad0a.rbs
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      d1c31768b4c47211bf5a80ebbb9b595d

                                                      SHA1

                                                      5a444140ca91fd4625bc99a9ff36fbc4b1928d23

                                                      SHA256

                                                      1a9b77cb0974b3f1828c5eda8f27528c64fd5f604a36249425773a5c6a77c343

                                                      SHA512

                                                      97f88edf1f5391bb465f9f2a81655d3e1194717f4cb8f758f40e5e63292511d9a8bea0b85903c62f66c36233b3bb2f5e53dc5cb32c8f07fe7e24196e95c77e00

                                                      Download Submit

                                                    • C:\Config.Msi\e57ad0f.rbs
                                                      Filesize

                                                      74KB

                                                      MD5

                                                      ca9b0710ca6d532e50078138bcc9131d

                                                      SHA1

                                                      192c7b783c4c0ed9f684042f818c387256d354a9

                                                      SHA256

                                                      c82db3ef3c46b73f9d3f1ff031f96539a5fcf80ab1a87cfada197a79bf32bebb

                                                      SHA512

                                                      9ec48eb46e270f786dfdfe1ef67a55c22adb3cdb838ee7006b26b6ba8538dafecc6527bd6647f13693f64ec3ba60954d4cb2e541869590c6aa2349e2ef9ba412

                                                      Download Submit

                                                    • C:\Config.Msi\e57ad11.rbs
                                                      Filesize

                                                      464B

                                                      MD5

                                                      fce4aaf943d745e661dfea2a2c4c68e2

                                                      SHA1

                                                      a977ed9d74d9fd151b4501b0e0a91f6ab40d3640

                                                      SHA256

                                                      04140f72a2d106665c9ab3565f051bb39619fa9dee39c5e0f9e7f119a457f7be

                                                      SHA512

                                                      fee9e5345aa346999b309bdcc1a2d88f8e2e74999eca98de60666c69d1d9e379aa4a245ec1d20019f25e17ec44c8b062dc47455b77231944257446cef7c93765

                                                      Download Submit

                                                    • C:\Config.Msi\e57ad17.rbs
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      6ae3fba9a46055f3965a7adfae6dd59f

                                                      SHA1

                                                      e42aa43d697bf1d5d4a85ba8be234c949b3087db

                                                      SHA256

                                                      9dc487a9cf6272c59dcde1af2f2e98bac4295621dd7d4a3926f7e841114c2081

                                                      SHA512

                                                      02ade1960d02f62fd3110b1dd9241d2a394e5810396218aed1c2f7ef733906629dcc225c6a0a8a6316197379f7ac99cfe9085c281be62cf9541081c689bfb7c9

                                                      Download Submit

                                                    • C:\Config.Msi\e57ad1f.rbs
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      cf582255c4c968247824847aaaec6138

                                                      SHA1

                                                      e3e58cf9ae5b2a6e3867bf25ca7bd3b5b1889754

                                                      SHA256

                                                      de904b6999021e1623044417142da0689e8398c38c6281ddca504ff3b02b9949

                                                      SHA512

                                                      4efe905c8b9be9420b92d374ce374c85b6fdd94b946d8c4a89c9fcc46d33bd6a3f8b7b373ca2e969d18ca96e87b6d0baf766b54cdc65ca6f3966c0bd2fc97f3b

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3840b31c383fdf49bfd6740d945c9032

                                                      SHA1

                                                      a6f50164a69718bcef4664d7c47534f0d721866a

                                                      SHA256

                                                      1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                      SHA512

                                                      f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                      Filesize

                                                      142KB

                                                      MD5

                                                      477293f80461713d51a98a24023d45e8

                                                      SHA1

                                                      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                      SHA256

                                                      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                      SHA512

                                                      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                      SHA1

                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                      SHA256

                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                      SHA512

                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                      Filesize

                                                      210KB

                                                      MD5

                                                      c106df1b5b43af3b937ace19d92b42f3

                                                      SHA1

                                                      7670fc4b6369e3fb705200050618acaa5213637f

                                                      SHA256

                                                      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                      SHA512

                                                      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                      Filesize

                                                      693KB

                                                      MD5

                                                      2c4d25b7fbd1adfd4471052fa482af72

                                                      SHA1

                                                      fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                      SHA256

                                                      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                      SHA512

                                                      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                      Filesize

                                                      157KB

                                                      MD5

                                                      242d415e238789fbc57c5ac7e8ca5d02

                                                      SHA1

                                                      09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                      SHA256

                                                      7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                      SHA512

                                                      ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                      Filesize

                                                      51KB

                                                      MD5

                                                      3180c705182447f4bcc7ce8e2820b25d

                                                      SHA1

                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                      SHA256

                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                      SHA512

                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                      Filesize

                                                      12B

                                                      MD5

                                                      dc63026e80d2bb04f71e41916f807e33

                                                      SHA1

                                                      6cda386d2c365f94ea3de41e2390fd916622eb51

                                                      SHA256

                                                      3b54d00f00aa80384de88e4f4005e9d4d889a2ccf64b56e0c29d274352495c85

                                                      SHA512

                                                      61da550efd55187978872f5d8e88164a6181a11c8a720684eaa737e0846fe20b9e82b73e1f689a6585834b84c4cee8dd949af43e76fd0158f6cafa704ab25183

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                      Filesize

                                                      173KB

                                                      MD5

                                                      31def444e6135301ea3c38a985341837

                                                      SHA1

                                                      f135be75c721af2d5291cb463cbc22a32467084a

                                                      SHA256

                                                      36704967877e4117405bde5ec30beaf31e7492166714f3ffb2ceb262bf2fb571

                                                      SHA512

                                                      bd654388202cb5090c860a7229950b1184620746f4c584ab864eade831168bc7fae0b5e59b90165b1a9e4ba2bd154f235749718ae2df35d3dd10403092185ed1

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                      Filesize

                                                      546B

                                                      MD5

                                                      158fb7d9323c6ce69d4fce11486a40a1

                                                      SHA1

                                                      29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                      SHA256

                                                      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                      SHA512

                                                      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                      Filesize

                                                      688KB

                                                      MD5

                                                      ba66874c510645c1fb5fe74f85b32e98

                                                      SHA1

                                                      e33c7e6991a25cc40d9e0dcc260b5a27f4a34e6c

                                                      SHA256

                                                      12d64550cb536a067d8afff42864836f6d41566e18f46d3ca92cb68726bdd4e9

                                                      SHA512

                                                      44e8caa916ab98da36af02b84ac944fbf0a65c80b0adbdc1a087f8ed3eff71c750fb6116f2c12034f9f9b429d6915db8f88511b79507cc4d063bab40c4eaa568

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                      Filesize

                                                      27KB

                                                      MD5

                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                      SHA1

                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                      SHA256

                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                      SHA512

                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                      Filesize

                                                      214KB

                                                      MD5

                                                      01807774f043028ec29982a62fa75941

                                                      SHA1

                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                      SHA256

                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                      SHA512

                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                      Filesize

                                                      37KB

                                                      MD5

                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                      SHA1

                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                      SHA256

                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                      SHA512

                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                      Filesize

                                                      3.4MB

                                                      MD5

                                                      e010d1f614b1a830482d3df4ba056f24

                                                      SHA1

                                                      5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                      SHA256

                                                      98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                      SHA512

                                                      727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                      Filesize

                                                      389KB

                                                      MD5

                                                      5e3252e0248b484e76fcdbf8b42a645d

                                                      SHA1

                                                      11ae92fd16ac87f6ab755911e85e263253c16516

                                                      SHA256

                                                      01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                      SHA512

                                                      540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      6129b4ede8b5ab2a91c59c0d9f3ef9cf

                                                      SHA1

                                                      928dd2bf851b0d10650b478d951fd76a26eee36e

                                                      SHA256

                                                      84c0c7aa67e8dae04b834f6cd9f07288b694226ef0f2a910a95dbbe78c976946

                                                      SHA512

                                                      a15326d70630f9dcd0728b9224d08a2fa12a8f0ef9631b5f29fe3702f3413b11108525c7a4603be890d87c4ba91f9acb67cf966147fd5d40589b76c2fec7f8df

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                      Filesize

                                                      196KB

                                                      MD5

                                                      5f782d0cb0f717ae9dfd1b4da1295f15

                                                      SHA1

                                                      b33575e428e19940f0585c747e054ca70a12d454

                                                      SHA256

                                                      0f233bd5fe96cf5f7efea0fa0634f98c37a3a095f72acc79a3544590bf228b43

                                                      SHA512

                                                      e373be20e06f31f81a8c0368e8fbee0bd7e98095a6e1f85ecb8969a35caf32e22194e2448de9213bb86478f454e708363ea6ab990648422b57f057a0516959ed

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                      Filesize

                                                      55KB

                                                      MD5

                                                      a739b889642ca9ce4ad3a37a3c521604

                                                      SHA1

                                                      18bcf6fd14c5aece67ae795a3c505a0c1a9d5175

                                                      SHA256

                                                      44b96244b823052fb19509b1f9576488750c4edab61840af24b10c208b47fc92

                                                      SHA512

                                                      92243e80fd77b9c3f9231c750935b34d9adcdc76e1a45a445c47888a1e98faca1c26f617459db0c1af4860a5172401f03e64039888e6f84726d2457cc550bae0

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      9d1528a2ce17522f6de064ae2c2b608e

                                                      SHA1

                                                      2f1ce8b589e57ab300bb93dde176689689f75114

                                                      SHA256

                                                      11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                      SHA512

                                                      a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.2872.update
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      14ffcf07375b3952bd3f2fe52bb63c14

                                                      SHA1

                                                      ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                      SHA256

                                                      6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                      SHA512

                                                      14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      d32070ebb8ad122d20168f1e6bc02064

                                                      SHA1

                                                      1336c179e154f2f9deb04303d03c7ac4ccc6d21f

                                                      SHA256

                                                      8bb779b4f4990a7e02485cac6a5d01d15d2e687d2fa4a57b73058874b3aed249

                                                      SHA512

                                                      1cc3dbfe9369cfa74222d94541c804e312b1882204bdf90da09aa42124c3cdbf83db71734e82df4be132003f5093ce095f60cf2bd97edc9c4555fe5b9d458ecd

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                      Filesize

                                                      2B

                                                      MD5

                                                      81051bcc2cf1bedf378224b0a93e2877

                                                      SHA1

                                                      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                      SHA256

                                                      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                      SHA512

                                                      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                      Filesize

                                                      54KB

                                                      MD5

                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                      SHA1

                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                      SHA256

                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                      SHA512

                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                      Filesize

                                                      334KB

                                                      MD5

                                                      b3e14504a48bed32c53ec7aab2cb2c8f

                                                      SHA1

                                                      0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                      SHA256

                                                      adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                      SHA512

                                                      e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                      Filesize

                                                      72KB

                                                      MD5

                                                      749c51599fbf82422791e0df1c1e841c

                                                      SHA1

                                                      bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                      SHA256

                                                      c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                      SHA512

                                                      f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                      Filesize

                                                      50KB

                                                      MD5

                                                      c0f02eaa3eb28659d8f1bcba8de48479

                                                      SHA1

                                                      5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                      SHA256

                                                      6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                      SHA512

                                                      47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                      Filesize

                                                      32KB

                                                      MD5

                                                      f531d3157e9ff57eea92db36c40e283e

                                                      SHA1

                                                      d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                      SHA256

                                                      30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                      SHA512

                                                      27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                      Filesize

                                                      54KB

                                                      MD5

                                                      d11b2139d29e79d795054c3866898b7f

                                                      SHA1

                                                      020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                      SHA256

                                                      11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                      SHA512

                                                      de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                      Filesize

                                                      588KB

                                                      MD5

                                                      17d74c03b6bcbcd88b46fcc58fc79a0d

                                                      SHA1

                                                      bc0316e11c119806907c058d62513eb8ce32288c

                                                      SHA256

                                                      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                      SHA512

                                                      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                      Filesize

                                                      216B

                                                      MD5

                                                      27d038d4ef96ae5759824ea2303357cc

                                                      SHA1

                                                      a4fa8eca2b9ac00d6a9964d2da6fa9069d3d3d04

                                                      SHA256

                                                      9dc645f68abc4d670ed34abce8525723384d459a7538454b0da5d93548159b18

                                                      SHA512

                                                      58f88e3f47c569a463e2ce5c01c031eeaf5fedd0f14d17eaeca6d1f585253825f3981c2ae6dbc07033a8cbeb6306cef1436ab39155c1f3dedfa7203a7d7b462d

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                      SHA1

                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                      SHA256

                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                      SHA512

                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      f512536173e386121b3ebd22aac41a4e

                                                      SHA1

                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                      SHA256

                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                      SHA512

                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                      Filesize

                                                      76KB

                                                      MD5

                                                      b40fe65431b18a52e6452279b88954af

                                                      SHA1

                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                      SHA256

                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                      SHA512

                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                      Filesize

                                                      80KB

                                                      MD5

                                                      3904d0698962e09da946046020cbcb17

                                                      SHA1

                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                      SHA256

                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                      SHA512

                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      287B

                                                      MD5

                                                      fcad4da5d24f95ebf38031673ddbcdb8

                                                      SHA1

                                                      3f68c81b47e6b4aebd08100c97de739c98f57deb

                                                      SHA256

                                                      7e1def23e5ab80fea0688c3f9dbe81c0ab4ec9e7bdbcc0a4f9cd413832755e63

                                                      SHA512

                                                      1694957720b7a2137f5c96874b1eb814725bdba1f60b0106073fa921da00038a532764ec9a5501b6ffb9904ee485ce42ff2a61c41f88b5ff9b0afde93d6f7f3d

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      717B

                                                      MD5

                                                      ef0a07aec4367a64c16c581da2657aa9

                                                      SHA1

                                                      13011a5abcbadb3424fb6ecee560665556bb1d24

                                                      SHA256

                                                      f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                      SHA512

                                                      35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      362ce475f5d1e84641bad999c16727a0

                                                      SHA1

                                                      6b613c73acb58d259c6379bd820cca6f785cc812

                                                      SHA256

                                                      1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                      SHA512

                                                      7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                      Filesize

                                                      1.9MB

                                                      MD5

                                                      8de5a7a19d882820893d8b911c1710fb

                                                      SHA1

                                                      95cdf5855bc5e454c8944952697ab142f77124f7

                                                      SHA256

                                                      2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                      SHA512

                                                      3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                      SHA1

                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                      SHA256

                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                      SHA512

                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                      Filesize

                                                      375KB

                                                      MD5

                                                      3c93b399b417b0d6a232d386e65a8b46

                                                      SHA1

                                                      bb26deae135f405229d6f76eb6faaeb9a3c45624

                                                      SHA256

                                                      29bc4577588116cbfea928b2587db3d0d26254163095e7fbbcde6e86fd0022d7

                                                      SHA512

                                                      a963f5cf2221436938f031b65079bea7c4bafbd48833a9e11cd9bdd1548d68ed968d9279299aa2adfc23311a6744d516cc50e6537aa45321e5653755ed56f149

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                      Filesize

                                                      321KB

                                                      MD5

                                                      d3901e62166e9c42864fe3062cb4d8d5

                                                      SHA1

                                                      c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                      SHA256

                                                      dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                      SHA512

                                                      ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                      Filesize

                                                      814KB

                                                      MD5

                                                      9b1f97a41bfb95f148868b49460d9d04

                                                      SHA1

                                                      768031d5e877e347a249dfdeab7c725df941324b

                                                      SHA256

                                                      09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                      SHA512

                                                      9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                      Filesize

                                                      1.2MB

                                                      MD5

                                                      e74d2a16da1ddb7f9c54f72b8a25897c

                                                      SHA1

                                                      32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                      SHA256

                                                      a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                      SHA512

                                                      52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                      Filesize

                                                      11B

                                                      MD5

                                                      5eda46a55c61b07029e7202f8cf1781c

                                                      SHA1

                                                      862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                      SHA256

                                                      12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                      SHA512

                                                      4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                      Filesize

                                                      12B

                                                      MD5

                                                      5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                      SHA1

                                                      93012724e6cc0a298838aede678806e6c0c6517d

                                                      SHA256

                                                      a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                      SHA512

                                                      890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      913fbc8319fad66fec2ea8f8716f3985

                                                      SHA1

                                                      e4641fece57c206d58e819e5b8b7079059375af7

                                                      SHA256

                                                      74efa8bd07012724e3a0357e28837309387ef8de7f378dbde05233706aa25df1

                                                      SHA512

                                                      1ee4746cd004c869f597444d2b594cadc9b271f15cac1a06a831ac3ee81f6e0e970c963af70d37ab999c1a72562c92afb12f04a3c97c95d7d66477a6cc6d85cc

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      92e348d894621a8b95aa507a146f1e57

                                                      SHA1

                                                      1e2d15137346fd76eb6b5f5cf1bea79c593eebee

                                                      SHA256

                                                      cfb1e659d4c333fbc5e5cc8b4b025e48ef02991559a33b20a3e694d2f67a6731

                                                      SHA512

                                                      85ce1ad9d6bbe066c257190fc5043be645fd4de54afd5976df56eebae3b475df1fe78b092ac64a27089f73cc314286845e303eb4161a8d435cc96ec9834c586c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                      Filesize

                                                      2.8MB

                                                      MD5

                                                      91453d3e1e2bc9586cf5495073fb3cf7

                                                      SHA1

                                                      09cfa9dc27545fb600dd7a60e44258c511eb43c4

                                                      SHA256

                                                      5d398c6ce0636eadd4b7f6920dbd6127388f698e9bc1a440cb7db3992acb6557

                                                      SHA512

                                                      462d59453ed01d8ddf54e06319aaefc0ab5ef70ed7b0a45ffd4d3f049692044acf0dee3599173e58a4c281bc69af63d8b64f9586a1b2f04991adfa6747f19bdc

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      384d6da5c34ff401b18f0af41e3a2643

                                                      SHA1

                                                      3ddfbcf79e55904df77df2125f2112cfe7703eec

                                                      SHA256

                                                      0699c4ccaa2f9e6768475f7fbd0dd93dab1a0a0dc8859e9ee8f8a48ad1075d7d

                                                      SHA512

                                                      5b63245bedfc7260b27254a33f621a8b626a36c13c8f8ad516f51013bd6751770d37afdc1ff8f7646d9f972081acd24776314405cc397762a4f58d6dca0a7f32

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      6c6f85e896655a6eb726482f04c49086

                                                      SHA1

                                                      2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                      SHA256

                                                      e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                      SHA512

                                                      b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                      Filesize

                                                      541B

                                                      MD5

                                                      d0efb0a6d260dbe5d8c91d94b77d7acd

                                                      SHA1

                                                      e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                      SHA256

                                                      7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                      SHA512

                                                      a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                      Filesize

                                                      12B

                                                      MD5

                                                      3d66ae5ed06891e8ce75a39a24070844

                                                      SHA1

                                                      368064119835d4376727a14706c41384446183e8

                                                      SHA256

                                                      73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                      SHA512

                                                      c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                      Filesize

                                                      646KB

                                                      MD5

                                                      7895698867d1ad33934a8553b4806dc5

                                                      SHA1

                                                      32704df55deaff9bf0b4ee0b887541856578938b

                                                      SHA256

                                                      ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                      SHA512

                                                      20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                      Filesize

                                                      3.1MB

                                                      MD5

                                                      85e1898362165fc1315d18abb73c1b37

                                                      SHA1

                                                      289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                      SHA256

                                                      d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                      SHA512

                                                      49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                      Filesize

                                                      569KB

                                                      MD5

                                                      9614d1da18956de06747c03068208d66

                                                      SHA1

                                                      fea2680ddb9e4ceea8489a132df9a1542febfe88

                                                      SHA256

                                                      dde9e0ca3fd274902f1a4c22cfec6870c6c4dbbccad17d2189477ab60f769dab

                                                      SHA512

                                                      d8e46a5819e9dced61471966646de153bf3480933054c50190d50de4900685265367b12c9147630f184ce8809786fc010bf6fcd1884035fb4c77cfde660a8b9d

                                                      Download Submit

                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\bab1f5ff19abda9b438b0326caca9dfb
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                      SHA1

                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                      SHA256

                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                      SHA512

                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                      Download Submit

                                                    • C:\ProgramData\chocolatey\config\chocolatey.config
                                                      Filesize

                                                      809B

                                                      MD5

                                                      8b6737800745d3b99886d013b3392ac3

                                                      SHA1

                                                      bb94da3f294922d9e8d31879f2d145586a182e19

                                                      SHA256

                                                      86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                      SHA512

                                                      654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                      Download Submit

                                                    • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                      Filesize

                                                      12KB

                                                      MD5

                                                      20e74305515ad351cd3a02098b0caadf

                                                      SHA1

                                                      b50c319d82097747031c18f1e9e7c60ecefd821b

                                                      SHA256

                                                      759b6051d5e553a246bc3b97e89951b3d44f5cad7607233e5a73b98d57663f10

                                                      SHA512

                                                      3e5fc216f60dde1fe5b8df05262e605819a56f08accfc513beffff7bf291afa5d03f2e7dc1e43cc773b0937d5e026d77c2382c0901116bdd32a2c751072950b0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                      Filesize

                                                      471B

                                                      MD5

                                                      7795df33fc7dd3aa62e0bc052f9dfbad

                                                      SHA1

                                                      ea227ec994561b5bce01c5228f9c337286fbec9c

                                                      SHA256

                                                      6ad47d714f3dd55b2fe9072e829542851d2ecf60cb88254002c60449e8aca736

                                                      SHA512

                                                      de11027f0ca32119ebbb17976ecbe6582ab6af8caa7ce522d75c4185da722550f1f981064db9be6074eb1c6c096c933c2de7ee42b1f31b4fedc9982f87157f9d

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      727B

                                                      MD5

                                                      2a98ceecefb9f6844026540ae1b998a7

                                                      SHA1

                                                      4772a0e71f59385f9e527b8d320e192731c20db5

                                                      SHA256

                                                      7d1a90367c7942850083e30715173daf58eef172176871649b6d2e7a9e0c3727

                                                      SHA512

                                                      6eb16bded3d769ea3a4742cc89b24b810764ce2c0db8bf76eae5dfac92910a37b4dfa4c0ec494c7430c6a8a6cbb17b8e56b6ecfe9029e9d078b2f50dd2338925

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      727B

                                                      MD5

                                                      f0339c0506fe0b51215f7227b14e656f

                                                      SHA1

                                                      cf937eeed1483e23e81244baa03d5e8f112c56d5

                                                      SHA256

                                                      47bf8749c1ac54c6586d625c99219f03c6a073f3b3f5689444985aae85a3e5b1

                                                      SHA512

                                                      afb55465411bce78b7453e17aca382e0add24a1b0dd7f116cb077a2641abcbde8684e076d69ca6a3a61a3e47d156f85c80621082ab1a80f4a5b3b1b75f20d5bc

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                      Filesize

                                                      400B

                                                      MD5

                                                      d1c39d5416b497a1c345cf6b031818f1

                                                      SHA1

                                                      a836542c2201fed4e84fb5497bd2af7d5df518e4

                                                      SHA256

                                                      20f46773abda78ffa184da918314f3882b9bf9c52c3d80bc60237328b8141866

                                                      SHA512

                                                      2d12440427264e368c19597ac516512bdb5f46b90dc89932d1fa3503bbd93d15e93ed0eff74435064be190e4176df9c201c459292a810c99e07c7e395254fbb7

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      404B

                                                      MD5

                                                      0d227cb0279ba496dc245d61149253cf

                                                      SHA1

                                                      aef951304b148bea6bbf00b4aca0f7e4303b79c9

                                                      SHA256

                                                      5a3b8ec3e7fb4b7601f550e51ffb50f8b9af029412617a0ae4a55470bc019c23

                                                      SHA512

                                                      5963ef46f01c85d7558d905166ae1026991e41da774085f988825ccaf401638fc5aa52bb267f2aae4499756c03abdf3bf482c1aa9e714c0602f4a2bdc14ab402

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      412B

                                                      MD5

                                                      5747639165563ff3137dc8915bc56b1d

                                                      SHA1

                                                      11b951ddd8e03c0c19562f95982f66f00fcb8880

                                                      SHA256

                                                      5f3932f9ac5c7f7fb259a1bc9eed8c62de3062f8f8af7092eb968609f1be4534

                                                      SHA512

                                                      bcf18dfa55324a2a2f753b606af51ffd413f5ceb90f62fb449d7d7fdf9f11ac8ef51d9a85cef2816788f193cb070502b79d4cbe6394b675dc6e922ac11b9e0e0

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                      Filesize

                                                      651B

                                                      MD5

                                                      9bbfe11735bac43a2ed1be18d0655fe2

                                                      SHA1

                                                      61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                      SHA256

                                                      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                      SHA512

                                                      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI1084.tmp
                                                      Filesize

                                                      4.5MB

                                                      MD5

                                                      2207f96731ce2f9d9327c0baaf4959ef

                                                      SHA1

                                                      f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                      SHA256

                                                      e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                      SHA512

                                                      7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI681E.tmp-\System.Management.dll
                                                      Filesize

                                                      60KB

                                                      MD5

                                                      878e361c41c05c0519bfc72c7d6e141c

                                                      SHA1

                                                      432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                      SHA256

                                                      24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                      SHA512

                                                      59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIAD86.tmp
                                                      Filesize

                                                      509KB

                                                      MD5

                                                      88d29734f37bdcffd202eafcdd082f9d

                                                      SHA1

                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                      SHA256

                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                      SHA512

                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIAD86.tmp-\AlphaControlAgentInstallation.dll
                                                      Filesize

                                                      25KB

                                                      MD5

                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                      SHA1

                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                      SHA256

                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                      SHA512

                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIAD86.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                      SHA1

                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                      SHA256

                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                      SHA512

                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIB017.tmp-\CustomAction.config
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                      SHA1

                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                      SHA256

                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                      SHA512

                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIB017.tmp-\Newtonsoft.Json.dll
                                                      Filesize

                                                      695KB

                                                      MD5

                                                      715a1fbee4665e99e859eda667fe8034

                                                      SHA1

                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                      SHA256

                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                      SHA512

                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIB74E.tmp
                                                      Filesize

                                                      211KB

                                                      MD5

                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                      SHA1

                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                      SHA256

                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                      SHA512

                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                      Download Submit

                                                    • C:\Windows\Installer\e57ad09.msi
                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      6e58d9af76a06f068fc49d0f5f895966

                                                      SHA1

                                                      6eaf5813536f716cab6ccdda47e8f0beaa74b30c

                                                      SHA256

                                                      b8788ba7d7d7f8fce00f8446b778b9f9b9852e4ec2f3766d6e32c68b50950899

                                                      SHA512

                                                      4d314dcc18f09ce95453470101efc55e690657e2288728839f04d7060a1f767a4be0d1b48cc0a980979d35c440144cc2cbffd767732b19e4af4c5333a8fc93e9

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{4fd28f6d-c9b8-a84b-a6fc-0914249c7249}\lci_proxywddm.cat
                                                      Filesize

                                                      12KB

                                                      MD5

                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                      SHA1

                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                      SHA256

                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                      SHA512

                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{4fd28f6d-c9b8-a84b-a6fc-0914249c7249}\lci_proxywddm.inf
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      0315a579f5afe989154cb7c6a6376b05

                                                      SHA1

                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                      SHA256

                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                      SHA512

                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{4fd28f6d-c9b8-a84b-a6fc-0914249c7249}\x64\lci_proxyumd.dll
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      4dc11547a5fc28ca8f6965fa21573481

                                                      SHA1

                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                      SHA256

                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                      SHA512

                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{4fd28f6d-c9b8-a84b-a6fc-0914249c7249}\x64\lci_proxyumd32.dll
                                                      Filesize

                                                      135KB

                                                      MD5

                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                      SHA1

                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                      SHA256

                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                      SHA512

                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{4fd28f6d-c9b8-a84b-a6fc-0914249c7249}\x64\lci_proxywddm.sys
                                                      Filesize

                                                      119KB

                                                      MD5

                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                      SHA1

                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                      SHA256

                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                      SHA512

                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{89cb1ff9-4d1e-3e46-9cab-2c82c36a17a9}\lci_iddcx.cat
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      62458e58313475c9a3642a392363e359

                                                      SHA1

                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                      SHA256

                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                      SHA512

                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{89cb1ff9-4d1e-3e46-9cab-2c82c36a17a9}\lci_iddcx.inf
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      1cec22ca85e1b5a8615774fca59a420b

                                                      SHA1

                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                      SHA256

                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                      SHA512

                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{89cb1ff9-4d1e-3e46-9cab-2c82c36a17a9}\x64\lci_iddcx.dll
                                                      Filesize

                                                      52KB

                                                      MD5

                                                      01e8bc64139d6b74467330b11331858d

                                                      SHA1

                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                      SHA256

                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                      SHA512

                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                      Download Submit

                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-03-30-19.dat
                                                      Filesize

                                                      602B

                                                      MD5

                                                      92cb349333388ddf056f75f07c1030db

                                                      SHA1

                                                      8480ffdf5887cbd9b63536d8d8ce8499f960faf3

                                                      SHA256

                                                      e27db692ec53d2ff0e80376ac8857903153870be3e8afc31c8c65749be6fdcd9

                                                      SHA512

                                                      8dec4a87fb1b7c1d1836fc5a7a95dbbeec9cee0b383ee1e9006e6e71b187b583e6bb1f6ebd77d9ee70f2d14fd034cdb21d795967dbe69cfc8a17e939cec8e777

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      7aea661eddf7582ae3dd92cf1ae27f35

                                                      SHA1

                                                      9ec5f699613716527acaac365c3cce63467fc05e

                                                      SHA256

                                                      83286e12645f2003c30c6e42368479e5256ff9f3e594d35a09812759ddf2ca8f

                                                      SHA512

                                                      bd42b351db0f21bf9d0229ec097146c383a83de5cf4eeb503d7e083de6d8f607f451a76fd77c8b49a325d7e8e2d62b796a23672e5db37e8ad9a63479373ca8fe

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      708B

                                                      MD5

                                                      21e8494165bf6db709e1eb10f0ad6fea

                                                      SHA1

                                                      6c64e90cb7f817904bdde8a108d837c66d16120b

                                                      SHA256

                                                      484090ea923a2df0f9728d0c7c139f0d0d056c40f820c77f5505b10974f36815

                                                      SHA512

                                                      182449a06714b99a4e1acb7c890f39b801dfd12ac9a51f494693db9496a66987cae779e6b442bc8524e804e0a8dc6b06821ba69c5ea1bb606bfeafea5e10f80b

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      fbdffbeb7760672acb5487d59c20b2e9

                                                      SHA1

                                                      be2de13935f96083c963d0e9192079ece004745b

                                                      SHA256

                                                      06df0209d544282d0882ddf06c5cb69f2a243903f88862a2f9d028f473410a26

                                                      SHA512

                                                      0ccc7f3475744d71634c0138f1b9fdcad7c3ab357d050b48bb3553f2b99ea1a4d12a61d1186cfc4514d278a8090f037a5e458b1617265168e221357dba3dc1ed

                                                      Download Submit

                                                    • C:\Windows\Temp\PreVer.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      18b5ae81278f7648af95777b474bb7c3

                                                      SHA1

                                                      0190ed92582f9d556ecb54fc347ed582ead8df35

                                                      SHA256

                                                      78a93d61c9e66c5c0a394b0994362edfb6b481e6a0036cc17c1482dc27f86f39

                                                      SHA512

                                                      b8275e154c818d8db90009e28e0f9854e0664d9ca96acab81dac22796eda0ffc10acbcd35439fad46d659d2bf353b689ee1b6b8dbcbf45d5d09906c0740fdbb2

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack.log
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      88dfade1eebfeb690444040f85a339dd

                                                      SHA1

                                                      5a7a00e685d6dce00ab959782cd8e149295d3c11

                                                      SHA256

                                                      9e0a9dbc8e55e44c1a981e30a6eca48b401f215437716ecd2ba810d14f04ba21

                                                      SHA512

                                                      f605c9c621ad5ce519e48e40b61aed8ff47115307a8769234ba92adfd4e0b8e468553de5872c832887cf9849788c565c490920d74ddde9216929bff02a5fc08c

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack.log
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      62b44a856b23072e5b7c819caeeee067

                                                      SHA1

                                                      0b5a7522348812182017bf51df487948b7d73a3e

                                                      SHA256

                                                      51666e664b5dfae290baa8e28d0313cb9cb329307f2d071fd24c8e50ce994f7a

                                                      SHA512

                                                      275391c68dc59b84e62beb13dff8fefe1bf4df0414b481ec27a7a2fc04d0e9a53067526e55e842b64e1dcd965a57af919f7834f6d7367df6bb546c7682c47c40

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                      Filesize

                                                      3.2MB

                                                      MD5

                                                      a7ce785b6cd1c9657040ca9b6cbeed10

                                                      SHA1

                                                      4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                      SHA256

                                                      7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                      SHA512

                                                      39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                      Download Submit

                                                    • C:\Windows\Temp\{307CF473-0964-4906-A9F2-BD01A54F456B}\IsConfig.ini
                                                      Filesize

                                                      571B

                                                      MD5

                                                      38370175ce7d8dd5c3581030a9104259

                                                      SHA1

                                                      bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                      SHA256

                                                      ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                      SHA512

                                                      e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                      Download Submit

                                                    • C:\Windows\Temp\{307CF473-0964-4906-A9F2-BD01A54F456B}\String1033.txt
                                                      Filesize

                                                      182KB

                                                      MD5

                                                      37a2c4ef0ff41955f1cb884b7790699f

                                                      SHA1

                                                      8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                      SHA256

                                                      6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                      SHA512

                                                      fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                      Download Submit

                                                    • C:\Windows\Temp\{307CF473-0964-4906-A9F2-BD01A54F456B}\_is674.exe
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      7a1c100df8065815dc34c05abc0c13de

                                                      SHA1

                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                      SHA256

                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                      SHA512

                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                      Download Submit

                                                    • C:\Windows\Temp\{307CF473-0964-4906-A9F2-BD01A54F456B}\setup.inx
                                                      Filesize

                                                      345KB

                                                      MD5

                                                      0376dd5b7e37985ea50e693dc212094c

                                                      SHA1

                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                      SHA256

                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                      SHA512

                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                      Download Submit

                                                    • C:\Windows\Temp\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\ISRT.dll
                                                      Filesize

                                                      427KB

                                                      MD5

                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                      SHA1

                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                      SHA256

                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                      SHA512

                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                      Download Submit

                                                    • C:\Windows\Temp\{C96A69C1-E9DD-4885-A0D6-3293D11B44F4}\_isres_0x0409.dll
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                      SHA1

                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                      SHA256

                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                      SHA512

                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                      Download Submit

                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      404B

                                                      MD5

                                                      e48454ceaf97128701b9741ebae75fd9

                                                      SHA1

                                                      45ceccb097924904edb53acec5c50cf61e6418ae

                                                      SHA256

                                                      8c98447b3bf40922d316ab163a8dd31b1f139f4c408dde2945922e3c3144b4fc

                                                      SHA512

                                                      d31f5ab3b00855d561ef68bd62be582b2756ad7b93014b551aaa1d2ddada568a33892dbcfbdfe4a4eeacc9b7ff331f329564e78b73a18939554288d6059aeb72

                                                      Download Submit

                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      412B

                                                      MD5

                                                      6d8263f3ee8a69b2423a5a3da72d9513

                                                      SHA1

                                                      7ba0a08edcb5e9bfbdb677c8e66c747debbd412b

                                                      SHA256

                                                      7720f90bb5fce73901e09e3af225bba43bdd9e05031850db6c148a1cd83e6892

                                                      SHA512

                                                      e22114fd2037f6b171e5df1b79450ad0094ce97155803d2e3854d2c9b9519444c195658da41551eee469bd5c51b94dfa43239dc0f9e147360ccf2cb5fa6d8c56

                                                      Download Submit

                                                    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                      Filesize

                                                      24.1MB

                                                      MD5

                                                      8eaa7d70b7e7c772200ba1552d88c1e6

                                                      SHA1

                                                      ca49a4e7d53c3ebcf58c09fda8cf18ab56c57446

                                                      SHA256

                                                      270645db9ebe143d1a3db870971909b9f72597209155a85a8f00907e0b4977af

                                                      SHA512

                                                      447f75930702af565366e608229a8b9fc9c82fff0162b3997b7b31af5069013af92b6f7b54ecffe9e89189c89f0b8ca5ad618d82530d3266aef90272eba9ef87

                                                      Download Submit

                                                    • \??\Volume{77a2731a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ee508dba-b207-4c99-9fc7-46454ca61344}_OnDiskSnapshotProp
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      b0a95bdc51b72e1560d44827f110ec7b

                                                      SHA1

                                                      da0264af77aa293b94043253c071bdc179231681

                                                      SHA256

                                                      9430d2e2a1c4be2d35ae1c9faf2d743d7a15ea9def5cb6bf29ae145af55c49c0

                                                      SHA512

                                                      fffd277ad9ab01df03c404d5db761899bc6800158638f3b65fd14225a84853cffd269daeced1146cdcb195a6cf1fe840d87c91b4b746947294e4e37768992e6a

                                                      Download Submit

                                                    • memory/404-1579-0x0000019C3AA50000-0x0000019C3AAA4000-memory.dmp

                                                      Filesize

                                                      336KB

                                                      Download

                                                    • memory/404-1328-0x0000019C3AAB0000-0x0000019C3AB62000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/404-1325-0x0000019C218F0000-0x0000019C21902000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/404-1326-0x0000019C21CF0000-0x0000019C21D0C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/444-351-0x0000029ECBAE0000-0x0000029ECBAE8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/444-342-0x0000029EB2780000-0x0000029EB27E4000-memory.dmp

                                                      Filesize

                                                      400KB

                                                      Download

                                                    • memory/444-352-0x0000029ECBAF0000-0x0000029ECBAF8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/444-353-0x0000029ECBB00000-0x0000029ECBB08000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/444-349-0x0000029ECBBB0000-0x0000029ECBC8C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/444-346-0x0000029ECB980000-0x0000029ECB9C8000-memory.dmp

                                                      Filesize

                                                      288KB

                                                      Download

                                                    • memory/444-347-0x0000029EB3050000-0x0000029EB3058000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/444-348-0x0000029ECB840000-0x0000029ECB84A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/444-345-0x0000029ECB930000-0x0000029ECB97C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                      Download

                                                    • memory/444-344-0x0000029EB3030000-0x0000029EB304C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/444-343-0x0000029ECB890000-0x0000029ECB8DA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/444-350-0x0000029ECBC90000-0x0000029ECBD42000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/444-357-0x0000029ECBB10000-0x0000029ECBB36000-memory.dmp

                                                      Filesize

                                                      152KB

                                                      Download

                                                    • memory/444-356-0x0000029ECBE00000-0x0000029ECBE3A000-memory.dmp

                                                      Filesize

                                                      232KB

                                                      Download

                                                    • memory/444-355-0x0000029ECBB40000-0x0000029ECBB6A000-memory.dmp

                                                      Filesize

                                                      168KB

                                                      Download

                                                    • memory/444-354-0x0000029ECBD50000-0x0000029ECBDB8000-memory.dmp

                                                      Filesize

                                                      416KB

                                                      Download

                                                    • memory/512-274-0x000002074C460000-0x000002074C490000-memory.dmp

                                                      Filesize

                                                      192KB

                                                      Download

                                                    • memory/512-277-0x000002074CEB0000-0x000002074CF60000-memory.dmp

                                                      Filesize

                                                      704KB

                                                      Download

                                                    • memory/512-278-0x000002074C930000-0x000002074C94C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/1568-82-0x0000000004D40000-0x0000000005094000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/1568-81-0x0000000004C10000-0x0000000004C32000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/1568-78-0x0000000004C80000-0x0000000004D32000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/1772-1862-0x00000158ADAC0000-0x00000158ADAD8000-memory.dmp

                                                      Filesize

                                                      96KB

                                                      Download

                                                    • memory/1772-1859-0x00000158AD680000-0x00000158AD69C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/1772-1864-0x00000158ADB60000-0x00000158ADBAA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/1772-1850-0x00000158AD1B0000-0x00000158AD1E4000-memory.dmp

                                                      Filesize

                                                      208KB

                                                      Download

                                                    • memory/1772-1863-0x00000158AD6A0000-0x00000158AD6AA000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/1772-1855-0x00000158ADA50000-0x00000158ADA9A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/1772-1872-0x00000158C6770000-0x00000158C684C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/1772-1871-0x00000158C65D0000-0x00000158C6682000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2432-1856-0x000002B2F4B70000-0x000002B2F4BBA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/2432-1858-0x000002B2F43E0000-0x000002B2F43FC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/2432-1851-0x000002B2F3A80000-0x000002B2F3A8C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/2872-1461-0x0000023B53130000-0x0000023B53140000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/2872-1462-0x0000023B534F0000-0x0000023B53500000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/2872-1853-0x0000023B6D560000-0x0000023B6DBBC000-memory.dmp

                                                      Filesize

                                                      6.4MB

                                                      Download

                                                    • memory/2872-1463-0x0000023B6C390000-0x0000023B6C442000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2872-1464-0x0000023B53520000-0x0000023B53540000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/2872-302-0x00000175AAF20000-0x00000175AAF3C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/2872-301-0x00000175C3800000-0x00000175C38B2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2872-300-0x00000175AA6C0000-0x00000175AA6D6000-memory.dmp

                                                      Filesize

                                                      88KB

                                                      Download

                                                    • memory/2996-1842-0x0000023ACB380000-0x0000023ACB3A0000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/2996-1818-0x0000023ACB440000-0x0000023ACB4F2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2996-1799-0x0000023AB2B70000-0x0000023AB2B88000-memory.dmp

                                                      Filesize

                                                      96KB

                                                      Download

                                                    • memory/2996-1713-0x0000023AB2310000-0x0000023AB231C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/4008-903-0x0000000003D00000-0x0000000003EC7000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/4008-1081-0x0000000003D20000-0x0000000003EE7000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/4008-478-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/4008-481-0x0000000003CF0000-0x0000000003EB7000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/4008-512-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/4008-900-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/4008-1015-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/4008-1045-0x0000000003D10000-0x0000000003ED7000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/4108-150-0x0000024A98CB0000-0x0000024A98CD8000-memory.dmp

                                                      Filesize

                                                      160KB

                                                      Download

                                                    • memory/4108-162-0x0000024A9A9C0000-0x0000024A9AA58000-memory.dmp

                                                      Filesize

                                                      608KB

                                                      Download

                                                    • memory/4108-166-0x0000024A990D0000-0x0000024A990E2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/4108-167-0x0000024A9A8E0000-0x0000024A9A91C000-memory.dmp

                                                      Filesize

                                                      240KB

                                                      Download

                                                    • memory/4136-112-0x00000000052B0000-0x0000000005316000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/4156-1623-0x0000019B21A10000-0x0000019B21A18000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/4156-1518-0x0000019B21960000-0x0000019B2197C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/4156-1513-0x0000019B219C0000-0x0000019B21A0A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/4156-1511-0x0000019B21120000-0x0000019B21130000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/4156-1567-0x0000019B3A460000-0x0000019B3A53C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/4156-1581-0x0000019B3A540000-0x0000019B3A5F2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/4860-194-0x000001D03B7B0000-0x000001D03B862000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/4860-203-0x000001D03B6F0000-0x000001D03B712000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/4860-243-0x000001D03BCB0000-0x000001D03BCE8000-memory.dmp

                                                      Filesize

                                                      224KB

                                                      Download

                                                    • memory/4936-39-0x0000000004910000-0x000000000493E000-memory.dmp

                                                      Filesize

                                                      184KB

                                                      Download

                                                    • memory/4936-44-0x0000000004950000-0x000000000495C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5136-1222-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5136-2443-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5136-3289-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5136-3288-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5136-1144-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5136-1145-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5136-1223-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5136-2444-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5180-1146-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5180-1282-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5180-1283-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5484-1852-0x000001A2876C0000-0x000001A2876DA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                      Download

                                                    • memory/5484-1849-0x000001A287220000-0x000001A28722A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/5484-1860-0x000001A287D20000-0x000001A287DD2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5592-1517-0x0000015C6CFC0000-0x0000015C6CFE0000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/5592-1543-0x0000015C6E160000-0x0000015C6E1C6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/5592-1545-0x0000015C6D020000-0x0000015C6D034000-memory.dmp

                                                      Filesize

                                                      80KB

                                                      Download

                                                    • memory/5592-1542-0x0000015C6D7F0000-0x0000015C6D8A2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5592-1500-0x0000015C6C660000-0x0000015C6C670000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5888-1869-0x000001A5EA060000-0x000001A5EA0A8000-memory.dmp

                                                      Filesize

                                                      288KB

                                                      Download

                                                    • memory/5888-1866-0x000001A5E9380000-0x000001A5E939C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5888-1843-0x000001A5E8EF0000-0x000001A5E8F2A000-memory.dmp

                                                      Filesize

                                                      232KB

                                                      Download

                                                    • memory/5888-1865-0x000001A5EA0D0000-0x000001A5EA182000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5916-1281-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5916-1280-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5916-1138-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5916-1139-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5916-1214-0x0000000073D10000-0x0000000073E2C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5916-1215-0x0000000073940000-0x0000000073D0D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/6088-1861-0x0000020D52290000-0x0000020D522AC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/6088-1854-0x0000020D51A40000-0x0000020D51A52000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/6088-1873-0x0000020D6AF50000-0x0000020D6B02C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/6088-1870-0x0000020D6ADB0000-0x0000020D6AE62000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/6088-1857-0x0000020D6AB00000-0x0000020D6AB4A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download