Overview

overview

10

Static

static

10

LaudoBombeirosPDF.msi

windows7-x64

10

LaudoBombeirosPDF.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 10:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LaudoBombeirosPDF.msi

  • Size

    2.9MB

  • MD5

    72108ae3791d6199697c5447ff2ffc6b

  • SHA1

    2ac85588e9b673881a827bebdfa1eb6e9bed15ff

  • SHA256

    533becd0cc4cf29897da93ef4c5cedfedcfde7649e69d387e614bd30798db0fc

  • SHA512

    45f411856a0c711071247d02d913b405f8b47900cd1e80ca568baf0f8a3f908a90f6d5c207642498af1eed25af8bfa92db865f9e1724e0aeeeab1c65f5cb9591

  • SSDEEP

    49152:K+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:K+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LaudoBombeirosPDF.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3632
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4416
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BE364D01BEBAAFEB8D893AC5AD9F4EB6
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID050.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636312 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4752
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID3DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636937 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4608
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID92C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638281 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2476
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIE660.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240641671 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:736
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 160915FC443708EAEA7BA5CE601E56C3 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1980
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1748
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000MwPsfIAF" /AgentId="83799ea6-fb76-4ca0-a825-876e75392c9a"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4308
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 977E05F2D5E5A14C2A49FD308BBA2AC8 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5572
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDE88EC4-E144-45EF-8287-EFC2F66A1397}
          3⤵
          • Executes dropped EXE
          PID:5748
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7F79B4EB-6F87-4657-A2D3-026D2AD1185A}
          3⤵
          • Executes dropped EXE
          PID:5784
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0EC2A48D-883E-4413-9B13-2B51B7B5CB2C}
          3⤵
          • Executes dropped EXE
          PID:5816
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49F5C9AC-071E-41C9-933C-1D00D1AD0094}
          3⤵
          • Executes dropped EXE
          PID:5848
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1822C6A-EA46-4594-95CB-57CF63E22902}
          3⤵
          • Executes dropped EXE
          PID:5880
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1D339E4A-F5DD-48AE-B87C-EEA9CF90C05E}
          3⤵
          • Executes dropped EXE
          PID:5960
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{01FFD9A0-0CF9-4204-A55D-C5C5EC72B453}
          3⤵
          • Executes dropped EXE
          PID:6004
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{12C8AEFD-2863-447B-8AE4-03036028C119}
          3⤵
          • Executes dropped EXE
          PID:6036
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{838E57FF-0CE2-4D78-94CF-C3593AC3F1E3}
          3⤵
          • Executes dropped EXE
          PID:6068
        • C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe
          C:\Windows\TEMP\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_is3023.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{970226A6-4049-4438-BB22-F1738255965D}
          3⤵
          • Executes dropped EXE
          PID:6100
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5124
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3976
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1032
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2348
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2980
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5228
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5148
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5248
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5272
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5328
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5356
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4444
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5144
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5388
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5516
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5468
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5548
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5624
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1744
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5244
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7CA7BA2B-28CA-4863-BF7B-F5E5EEC79746}
          3⤵
          • Executes dropped EXE
          PID:5764
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2018C1A3-E8ED-4E0F-B36C-5E49D028F4CF}
          3⤵
          • Executes dropped EXE
          PID:5800
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17A993E6-F587-465E-8D8F-2C603BECB23D}
          3⤵
          • Executes dropped EXE
          PID:5832
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5F6AD9BA-5599-4E36-AB62-18BF2082FEEA}
          3⤵
          • Executes dropped EXE
          PID:5864
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{80068F97-4E61-42A3-823A-0C0A9BFFE9E9}
          3⤵
          • Executes dropped EXE
          PID:5896
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DED81C0B-33EE-4411-BD8D-499F5E5695E0}
          3⤵
          • Executes dropped EXE
          PID:6008
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2384D176-5894-4304-976A-4DBBE16F92FB}
          3⤵
          • Executes dropped EXE
          PID:6052
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{535B04EB-A80E-4295-8286-AE0E0DC8986B}
          3⤵
          • Executes dropped EXE
          PID:6084
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C332F62-D0E3-4033-9CC9-EA96211C0259}
          3⤵
          • Executes dropped EXE
          PID:2468
        • C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
          C:\Windows\TEMP\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{685A19CE-CD41-47DB-9DF3-9AFF561E0D43}
          3⤵
          • Executes dropped EXE
          PID:4648
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0465A08A-D878-43EC-BBDD-10C4DBBDDDD7}
          3⤵
          • Executes dropped EXE
          PID:1748
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E65F8640-4604-4710-995F-C81298F64E4B}
          3⤵
          • Executes dropped EXE
          PID:3920
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E47994D-B9E7-405C-8216-52EFD22A8674}
          3⤵
          • Executes dropped EXE
          PID:4408
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8E534381-DD6A-42E1-845F-D93778145351}
          3⤵
          • Executes dropped EXE
          PID:4216
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B77F73B1-2357-42A4-98D1-B9BE3EB08C1E}
          3⤵
          • Executes dropped EXE
          PID:2664
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{926EA5C9-30DD-4EA8-83D2-11088DA38122}
          3⤵
          • Executes dropped EXE
          PID:5292
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8D2A236-412A-4698-B275-2DF4161D18C4}
          3⤵
          • Executes dropped EXE
          PID:5288
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D54051B-002A-47D0-AA39-ADE833E2C6B7}
          3⤵
          • Executes dropped EXE
          PID:5308
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C47F5CDD-9745-4D4D-AA62-BE66D11FCF72}
          3⤵
          • Executes dropped EXE
          PID:4200
        • C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe
          C:\Windows\TEMP\{40AE6163-6BD9-4C9C-94F1-8AF4BEB0E133}\_is564B.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A53047A-7145-4579-BB00-869C3452A0BF}
          3⤵
          • Executes dropped EXE
          PID:4484
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4244
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5436
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5652
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:5776
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:5916
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4648
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71D5BA32-6F71-4089-811F-FBE71BD98640}
              3⤵
              • Executes dropped EXE
              PID:4180
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8DBDEFBF-E625-4BD6-8D45-45C6C490C418}
              3⤵
              • Executes dropped EXE
              PID:2308
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E5C9B0F8-CB17-4AD0-B5A7-6B2873B68DBC}
              3⤵
              • Executes dropped EXE
              PID:1208
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7A6A67D-409E-41EE-89C4-80E934A4E7E7}
              3⤵
              • Executes dropped EXE
              PID:6048
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7FD65986-A32B-4148-A802-E9BA2F700225}
              3⤵
              • Executes dropped EXE
              PID:1896
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{39787B13-27F4-4945-9B1B-123D2F85D9A5}
              3⤵
              • Executes dropped EXE
              PID:5220
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F6564454-89A2-4F4A-81B6-7BFD1B940D64}
              3⤵
              • Executes dropped EXE
              PID:4260
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D591B30-1B87-468C-AA3B-898E7A6BCBC6}
              3⤵
              • Executes dropped EXE
              PID:4436
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A952B93B-646E-46C8-B622-73BF65CDFBDC}
              3⤵
              • Executes dropped EXE
              PID:5016
            • C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe
              C:\Windows\TEMP\{8ED4A62C-A4D4-4BE2-852B-6D10B57825A8}\_is6B3C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4ADD0BC1-98F6-4CD8-861B-FE8E3279FDCE}
              3⤵
              • Executes dropped EXE
              PID:5336
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5140
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AF6F3E9D-76B2-4745-B954-0576027642FC}
              3⤵
              • Executes dropped EXE
              PID:5504
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C681886-87F1-43E8-9C16-5186AF33D0F0}
              3⤵
              • Executes dropped EXE
              PID:4640
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2630202B-888B-4514-A49B-5C650CE52B7D}
              3⤵
              • Executes dropped EXE
              PID:1304
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF616DCF-42DE-4F17-B1B1-F116ECA94BB9}
              3⤵
              • Executes dropped EXE
              PID:5644
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F83FF2D-144B-4330-A0EE-0C8653F15EA3}
              3⤵
              • Executes dropped EXE
              PID:4732
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DCA4F22-D22E-4B2C-ADB1-BF3C091B3F18}
              3⤵
              • Executes dropped EXE
              PID:5164
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9EF2ADAA-E466-49A1-B799-AC5D25A6DA25}
              3⤵
              • Executes dropped EXE
              PID:5964
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{839E4F0B-9728-41FD-80EA-0581BEBFE619}
              3⤵
              • Executes dropped EXE
              PID:5668
            • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
              C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED38CFB7-ABC6-4664-BC71-B02168DE2D4A}
              3⤵
                PID:5684
              • C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe
                C:\Windows\TEMP\{FC609949-90AF-450A-801B-2F1C232475BF}\_is7129.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C46D67B6-D860-48A8-AE07-5559DD26E35F}
                3⤵
                  PID:5780
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5820
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 113262D4721028A6393761662826A004 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5548
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIF4FC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710968 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5164
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIF636.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711203 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3160
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIF8F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240711921 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4108
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5132
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5160
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:1524
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3000
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:368
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:1244
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI16E7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240719562 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5180
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:6016
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="b920f34f-9cc5-445b-95e2-eb84640d1ee5"
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5476
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:3004
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1440
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:208
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "eb600569-36e8-4cee-b334-5c9d5c0208ff" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MwPsfIAF
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                PID:2024
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "40f03fa1-e08f-4379-b805-831f660549b7" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000MwPsfIAF
                2⤵
                • Executes dropped EXE
                PID:4872
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "a9a06b7b-f98b-44cf-a16d-0edbc154fe36" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000MwPsfIAF
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1064
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3588
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    • Modifies system certificate store
                    PID:4732
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "3275bdc3-3b7f-4f54-bce5-79baf9c4ee08" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000MwPsfIAF
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:856
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5180
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5420
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5508
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "b5f06c86-7e9b-427d-8473-9c862c961e2f" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000MwPsfIAF
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies data under HKEY_USERS
                PID:3204
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:548
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:4160
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "84db83b2-8a18-470d-beba-f6979a7c1dbc" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000MwPsfIAF
                2⤵
                • Executes dropped EXE
                PID:2408
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "92499e12-65c8-4cff-82f0-25dfee6bbd7a" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MwPsfIAF
                2⤵
                • Modifies data under HKEY_USERS
                PID:5480
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:2360
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:2144
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "565e8aca-d84a-4dd3-ac88-7c017ea4ca2b" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000MwPsfIAF
                  2⤵
                  • Drops file in Program Files directory
                  PID:5936
                  • C:\Windows\SYSTEM32\msiexec.exe
                    "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:2444
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "4d89b861-7620-4615-9bf2-8e6da7a762a4" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MwPsfIAF
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:5160
                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                    "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=5120a9c46ce031333e3fa065bd9090ba&rmm_session_pwd_ttl=86400"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5868
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "7f57feaa-3ba1-44e3-9b9d-e945aca46561" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MwPsfIAF
                  2⤵
                  • Drops file in System32 directory
                  PID:4624
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "8b6948e8-a521-43f0-8b06-575a9d40ad8b" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MwPsfIAF
                  2⤵
                    PID:1204
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "7d5848f4-6ba7-4c80-a767-623085eb9c5b" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000MwPsfIAF
                    2⤵
                    • Modifies registry class
                    PID:6112
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "21c4685b-3431-45c1-8519-72e947ad9955" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MwPsfIAF
                    2⤵
                    • Drops file in System32 directory
                    PID:5576
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "36064ea0-3fc7-4f0e-bcdc-3319b4c97e2b" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MwPsfIAF
                    2⤵
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    PID:1744
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                      3⤵
                      • System Time Discovery
                      PID:3512
                      • C:\Program Files\dotnet\dotnet.exe
                        dotnet --list-runtimes
                        4⤵
                        • System Time Discovery
                        PID:3600
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "7183bf49-4388-4114-ba63-1de685023fd0" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MwPsfIAF
                    2⤵
                    • Writes to the Master Boot Record (MBR)
                    PID:2896
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "5df98888-a37e-4ac9-b076-f0a4c2fb831b" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MwPsfIAF
                    2⤵
                      PID:4556
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "3dc74883-ca23-43d2-ac15-0e362cc278ff" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MwPsfIAF
                      2⤵
                      • Drops file in System32 directory
                      PID:2160
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "7608a73f-9bf4-4567-802a-5045fd1df7fb" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MwPsfIAF
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      PID:1224
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "1ef3bb0f-bbe9-4cae-b666-3f6a33173e4a" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MwPsfIAF
                      2⤵
                      • Drops file in System32 directory
                      PID:6084
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "a14752c8-0ca1-406a-b31a-8040f1cc2112" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MwPsfIAF
                      2⤵
                        PID:2948
                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5880
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4516
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                          -h
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:3472
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4364
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                            4⤵
                              PID:5040
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            PID:5952
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5280
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                              SRUtility.exe -r
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2388
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3600
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                              4⤵
                                PID:4832
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ver
                                  5⤵
                                    PID:1404
                                  • C:\Windows\system32\sc.exe
                                    sc query ddmgr
                                    5⤵
                                    • Launches sc.exe
                                    PID:5496
                                  • C:\Windows\system32\sc.exe
                                    sc query lci_proxykmd
                                    5⤵
                                    • Launches sc.exe
                                    PID:5484
                                  • C:\Windows\system32\rundll32.exe
                                    rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                    5⤵
                                    • Drops file in System32 directory
                                    • Checks SCSI registry key(s)
                                    • Modifies data under HKEY_USERS
                                    PID:5772
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                            1⤵
                            • Drops file in Windows directory
                            • Checks SCSI registry key(s)
                            PID:5324
                            • C:\Windows\system32\DrvInst.exe
                              DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                              2⤵
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Checks SCSI registry key(s)
                              • Modifies data under HKEY_USERS
                              PID:4948
                            • C:\Windows\system32\DrvInst.exe
                              DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000158" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                              2⤵
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Checks SCSI registry key(s)
                              • Modifies data under HKEY_USERS
                              PID:5528
                            • C:\Windows\system32\DrvInst.exe
                              DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000154"
                              2⤵
                              • Drops file in Drivers directory
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Checks SCSI registry key(s)
                              PID:5176
                            • C:\Windows\system32\DrvInst.exe
                              DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                              2⤵
                              • Drops file in Drivers directory
                              • Drops file in Windows directory
                              • Checks SCSI registry key(s)
                              PID:5300
                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                            1⤵
                            • Drops file in Program Files directory
                            • Modifies data under HKEY_USERS
                            PID:844
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                              2⤵
                              • Launches sc.exe
                              PID:4696
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "09f8b536-128a-47da-a631-0c5d32ed4108" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000MwPsfIAF
                              2⤵
                                PID:5736
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  3⤵
                                    PID:2380
                                    • C:\Windows\system32\cscript.exe
                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      4⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5404
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "2b332d94-b554-4377-8946-b55b7d4261d0" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000MwPsfIAF
                                  2⤵
                                    PID:5220
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "1e0fec3d-7541-4579-ab5a-860b2dedf125" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000MwPsfIAF
                                    2⤵
                                      PID:5528
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "ee953a7f-7e34-4a10-9a55-11c945a72722" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000MwPsfIAF
                                      2⤵
                                        PID:5776
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "47a667c8-8c41-4ee7-a176-4711e4c974a8" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000MwPsfIAF
                                        2⤵
                                          PID:3972
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "ba92cac3-64b3-43ba-ad90-baae73105054" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000MwPsfIAF
                                          2⤵
                                            PID:5172
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "64fa04f4-df74-4867-9b72-21376c05dc49" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000MwPsfIAF
                                            2⤵
                                            • Writes to the Master Boot Record (MBR)
                                            PID:4232
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "53dde632-7db4-4518-9df9-0f66200c66cd" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000MwPsfIAF
                                            2⤵
                                              PID:5920
                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=5120a9c46ce031333e3fa065bd9090ba&rmm_session_pwd_ttl=86400"
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2972
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "9d8eaeee-079e-41da-9b54-9d0144a083c5" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000MwPsfIAF
                                              2⤵
                                                PID:6096
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "b324bf63-d798-40cd-8797-a826082107c2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000MwPsfIAF
                                                2⤵
                                                  PID:4328
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                    3⤵
                                                    • System Time Discovery
                                                    PID:1956
                                                    • C:\Program Files\dotnet\dotnet.exe
                                                      dotnet --list-runtimes
                                                      4⤵
                                                      • System Time Discovery
                                                      PID:1448
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "161caae5-0e86-4213-b96a-00764b9af224" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000MwPsfIAF
                                                  2⤵
                                                    PID:4856
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 83799ea6-fb76-4ca0-a825-876e75392c9a "4b3b45d1-fc86-4ede-8a68-607a7e3485b2" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000MwPsfIAF
                                                    2⤵
                                                      PID:5452

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Persistence

                                                  Event Triggered Execution

                                                  2
                                                  T1546

                                                  Component Object Model Hijacking

                                                  1
                                                  T1546.015

                                                  Installer Packages

                                                  1
                                                  T1546.016

                                                  Pre-OS Boot

                                                  1
                                                  T1542

                                                  Bootkit

                                                  1
                                                  T1542.003

                                                  Privilege Escalation

                                                  Event Triggered Execution

                                                  2
                                                  T1546

                                                  Component Object Model Hijacking

                                                  1
                                                  T1546.015

                                                  Installer Packages

                                                  1
                                                  T1546.016

                                                  Defense Evasion

                                                  Modify Registry

                                                  1
                                                  T1112

                                                  Pre-OS Boot

                                                  1
                                                  T1542

                                                  Bootkit

                                                  1
                                                  T1542.003

                                                  Subvert Trust Controls

                                                  1
                                                  T1553

                                                  Install Root Certificate

                                                  1
                                                  T1553.004

                                                  System Binary Proxy Execution

                                                  1
                                                  T1218

                                                  Msiexec

                                                  1
                                                  T1218.007

                                                  Credential Access

                                                  Discovery

                                                  Peripheral Device Discovery

                                                  2
                                                  T1120

                                                  Query Registry

                                                  4
                                                  T1012

                                                  System Information Discovery

                                                  3
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  System Time Discovery

                                                  1
                                                  T1124

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Config.Msi\e57cf86.rbs
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    524e362695373077c49ede813b82c5a2

                                                    SHA1

                                                    d376ebf5ce53c3566f7a1997d564280a1ac7781f

                                                    SHA256

                                                    328514e46269eea18e4ebdd7cac31fc2f107aef212da3c643fc24a65868f0ded

                                                    SHA512

                                                    2f14d7034f3086ba054ae98d856da20bd7cdca5b83f430edd20e1131a50f9c9f6ab7f3ecaa86d610343cb455ba7e7e843e633c499309d8e881e755e8c042f6b0

                                                    Download Submit

                                                  • C:\Config.Msi\e57cf8b.rbs
                                                    Filesize

                                                    74KB

                                                    MD5

                                                    dea65bbe53819cfc6c41cd21f90026bb

                                                    SHA1

                                                    792d2fc0ee8c67602d579b057229318fd5eff27b

                                                    SHA256

                                                    d17e5a7ea503f9b804c62866e53c2f00c401f47e855ddf6b46a51584af33c963

                                                    SHA512

                                                    6565f0c7f95512083d9266d223b646ecdb9c639ea924fa613e4307bbe74acfd1998a24e0d65226b18c520b8aa3affdec71182567fb18cb1a0827014f83302334

                                                    Download Submit

                                                  • C:\Config.Msi\e57cf8d.rbs
                                                    Filesize

                                                    464B

                                                    MD5

                                                    8e0a274f25b793f1abbfc3976ed608b7

                                                    SHA1

                                                    f3334fbe6efe26f1c0adaedcf8017a82a4086bf2

                                                    SHA256

                                                    6256fd4cb32806993c59fbe0dc468b4140306968fc248504fd12765d802a60de

                                                    SHA512

                                                    3fb8d55e057484492b39407c894da7a7c47784c9082e7949b7daf85720a0a6b1350272f7e9d68f0d05b6d83189b3ba41f1cc59d50f310f3c948d0c1dace7a045

                                                    Download Submit

                                                  • C:\Config.Msi\e57cf93.rbs
                                                    Filesize

                                                    9KB

                                                    MD5

                                                    04d52ef64c89ce4edca247c6dc33f781

                                                    SHA1

                                                    58632f298703a1cf98f708f9eb604ed777288927

                                                    SHA256

                                                    ea0a7cf5e9601ee21a59c750bfc20555efcb455d12122f38ac71065f5b4ec545

                                                    SHA512

                                                    2a324b5e03f740e741f8ea7b97d0986fe89d5ce89c844f839324ceec8fd5605cd4becd66e1c2d0476a6da0d8e4a192aa8df30858f3a38c5d33cc49224ca0a13c

                                                    Download Submit

                                                  • C:\Config.Msi\e57cf9b.rbs
                                                    Filesize

                                                    8KB

                                                    MD5

                                                    b368d2c56aee3abc12b30a8d77c809d2

                                                    SHA1

                                                    abd67810f254967bc5f5bf9c1f3c7fa41206660c

                                                    SHA256

                                                    3d34cbae6d6983cc23436cb6d43a5098eed9d2fe2ee5180ed23ef024953d78da

                                                    SHA512

                                                    9d5f251bd51d06aac067f35a70300b5ae993c4d1c69aa62c42e1bfa83430674d7b41eaa723c23009e7f440dd62d438fe9a6e8597cb76285158dfc03162d7ed09

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    337079222a6f6c6edf58f3f981ff20ae

                                                    SHA1

                                                    1f705fc0faa84c69e1fe936b34783b301323e255

                                                    SHA256

                                                    ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                    SHA512

                                                    ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                    Filesize

                                                    142KB

                                                    MD5

                                                    477293f80461713d51a98a24023d45e8

                                                    SHA1

                                                    e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                    SHA256

                                                    a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                    SHA512

                                                    23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    b3bb71f9bb4de4236c26578a8fae2dcd

                                                    SHA1

                                                    1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                    SHA256

                                                    e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                    SHA512

                                                    fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                    Filesize

                                                    210KB

                                                    MD5

                                                    c106df1b5b43af3b937ace19d92b42f3

                                                    SHA1

                                                    7670fc4b6369e3fb705200050618acaa5213637f

                                                    SHA256

                                                    2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                    SHA512

                                                    616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                    Filesize

                                                    693KB

                                                    MD5

                                                    2c4d25b7fbd1adfd4471052fa482af72

                                                    SHA1

                                                    fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                    SHA256

                                                    2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                    SHA512

                                                    f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                    Filesize

                                                    157KB

                                                    MD5

                                                    242d415e238789fbc57c5ac7e8ca5d02

                                                    SHA1

                                                    09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                    SHA256

                                                    7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                    SHA512

                                                    ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                    Filesize

                                                    51KB

                                                    MD5

                                                    3180c705182447f4bcc7ce8e2820b25d

                                                    SHA1

                                                    ad6486557819a33d3f29b18d92b43b11707aae6e

                                                    SHA256

                                                    5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                    SHA512

                                                    228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                    Filesize

                                                    12B

                                                    MD5

                                                    eb053699fc80499a7185f6d5f7d55bfe

                                                    SHA1

                                                    9700472d22b1995c320507917fa35088ae4e5f05

                                                    SHA256

                                                    bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                    SHA512

                                                    d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                    Filesize

                                                    173KB

                                                    MD5

                                                    fd9df72620bca7c4d48bc105c89dffd2

                                                    SHA1

                                                    2e537e504704670b52ce775943f14bfbaf175c1b

                                                    SHA256

                                                    847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                    SHA512

                                                    47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                    Filesize

                                                    546B

                                                    MD5

                                                    158fb7d9323c6ce69d4fce11486a40a1

                                                    SHA1

                                                    29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                    SHA256

                                                    5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                    SHA512

                                                    7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                    Filesize

                                                    688KB

                                                    MD5

                                                    3ef8d12aa1d48dec3ac19a0ceabd4fd8

                                                    SHA1

                                                    c81b7229a9bd55185a0edccb7e6df3b8e25791cf

                                                    SHA256

                                                    18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

                                                    SHA512

                                                    0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                    Filesize

                                                    27KB

                                                    MD5

                                                    797c9554ec56fd72ebb3f6f6bef67fb5

                                                    SHA1

                                                    40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                    SHA256

                                                    7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                    SHA512

                                                    4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                    Filesize

                                                    214KB

                                                    MD5

                                                    01807774f043028ec29982a62fa75941

                                                    SHA1

                                                    afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                    SHA256

                                                    9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                    SHA512

                                                    33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                    Filesize

                                                    37KB

                                                    MD5

                                                    efb4712c8713cb05eb7fe7d87a83a55a

                                                    SHA1

                                                    c94d106bba77aecf88540807da89349b50ea5ae7

                                                    SHA256

                                                    30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                    SHA512

                                                    3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                    Filesize

                                                    3.4MB

                                                    MD5

                                                    e010d1f614b1a830482d3df4ba056f24

                                                    SHA1

                                                    5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                    SHA256

                                                    98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                    SHA512

                                                    727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                    Filesize

                                                    389KB

                                                    MD5

                                                    5e3252e0248b484e76fcdbf8b42a645d

                                                    SHA1

                                                    11ae92fd16ac87f6ab755911e85e263253c16516

                                                    SHA256

                                                    01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                    SHA512

                                                    540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                    Filesize

                                                    48KB

                                                    MD5

                                                    71a2ebd4d79cb0d93cec4c22742190b1

                                                    SHA1

                                                    ac0cdaeed5dfee2808c184c61c3730f7c22d1cc1

                                                    SHA256

                                                    e2bcdf790fda12937267964fc6503ebecee55060ec7154e1fa9bd23400c4ef42

                                                    SHA512

                                                    49c2a966c34aa9f528ab579cabb9bb63efb17689ed8f441f7d27f4fe9ebccbf2b46686dc23a479d5d275cc1acd8942f1497b3431f1b1a20d8764be90271155df

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                    Filesize

                                                    196KB

                                                    MD5

                                                    de5f3b3e6de225cc4aa8f173b1d95053

                                                    SHA1

                                                    ddc9d9e759d660463d422235f5f532247d32fb2c

                                                    SHA256

                                                    a67025ca3e0bd3afb3f7686475fa7f578329861b622bff6d83203edd5170060d

                                                    SHA512

                                                    fbf377d859bc3a36311a535d848c370dc730a70db36c3df0f0248b55ec662c4b1557536129730f5751d2fc274f104526bda6dce927895d54110537125a0ecc14

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                    Filesize

                                                    56KB

                                                    MD5

                                                    0f33a7acb33960d1306ba418405d8264

                                                    SHA1

                                                    bc24c37727b00d514446c8b5fb6c04f36254a067

                                                    SHA256

                                                    a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                    SHA512

                                                    72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                    Filesize

                                                    9KB

                                                    MD5

                                                    9d1528a2ce17522f6de064ae2c2b608e

                                                    SHA1

                                                    2f1ce8b589e57ab300bb93dde176689689f75114

                                                    SHA256

                                                    11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                    SHA512

                                                    a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.1224.update
                                                    Filesize

                                                    9KB

                                                    MD5

                                                    14ffcf07375b3952bd3f2fe52bb63c14

                                                    SHA1

                                                    ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                    SHA256

                                                    6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                    SHA512

                                                    14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    653302dc37993b4e6f271530102deff6

                                                    SHA1

                                                    cd83ce2b11b6598765464f394071c555c1c336f1

                                                    SHA256

                                                    5faed8d37b0672035afcdc34ad951362382e204aa0617d723628a71c6a4fbb0a

                                                    SHA512

                                                    eb6793ef986e17a677174903c7bd7ee0e74f2b5164eff4af660c5a30e527ac96f4ca3021cbe6694dfc9fbe646fb732ebb6038aba7fa98de41ddda3ccdb320581

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                    Filesize

                                                    2B

                                                    MD5

                                                    81051bcc2cf1bedf378224b0a93e2877

                                                    SHA1

                                                    ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                    SHA256

                                                    7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                    SHA512

                                                    1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                    Filesize

                                                    54KB

                                                    MD5

                                                    77c613ffadf1f4b2f50d31eeec83af30

                                                    SHA1

                                                    76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                    SHA256

                                                    2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                    SHA512

                                                    29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                    Filesize

                                                    334KB

                                                    MD5

                                                    b3e14504a48bed32c53ec7aab2cb2c8f

                                                    SHA1

                                                    0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                    SHA256

                                                    adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                    SHA512

                                                    e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                    Filesize

                                                    72KB

                                                    MD5

                                                    749c51599fbf82422791e0df1c1e841c

                                                    SHA1

                                                    bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                    SHA256

                                                    c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                    SHA512

                                                    f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                    Filesize

                                                    50KB

                                                    MD5

                                                    c0f02eaa3eb28659d8f1bcba8de48479

                                                    SHA1

                                                    5be3c69e3f46daff4967484a09eb8c4a1f4a7f0f

                                                    SHA256

                                                    6befb51a6639cae7e25570f5259f7b1f2d9b9b6539177d64d2ed8be50dde6268

                                                    SHA512

                                                    47b536fa628608a58f6f382bbc99911eeff706becfaf4b1c5ff904ca768917f40c2e916ba5a31992df0335ba5a57755f047f70aafaac414fc655da0cd6f95e34

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                    Filesize

                                                    32KB

                                                    MD5

                                                    f531d3157e9ff57eea92db36c40e283e

                                                    SHA1

                                                    d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                    SHA256

                                                    30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                    SHA512

                                                    27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    Filesize

                                                    54KB

                                                    MD5

                                                    d11b2139d29e79d795054c3866898b7f

                                                    SHA1

                                                    020581c77ed4bc01c3f3912f304a46c12ca443e6

                                                    SHA256

                                                    11cdb5ec172389f93f80d8eff0b9e5d4a98cfeab6f2c0e0bc301a6895a747566

                                                    SHA512

                                                    de5def2efcba83a4b9301dd342391c306cf68d0bb64104839dfc329b343544fd40597a2b9867fd2a8739c63081d74157acfc9b59c0cb4878b2f5155f582a6f09

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                    Filesize

                                                    588KB

                                                    MD5

                                                    17d74c03b6bcbcd88b46fcc58fc79a0d

                                                    SHA1

                                                    bc0316e11c119806907c058d62513eb8ce32288c

                                                    SHA256

                                                    13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                    SHA512

                                                    f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                    Download Submit

                                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                    Filesize

                                                    221B

                                                    MD5

                                                    86076984d806889566bccdfa262e63ee

                                                    SHA1

                                                    a9a1ae41e7e93319d44d5b232745e3d4f7f66bb8

                                                    SHA256

                                                    8d596f94bfeb2f2b00204e83c0f73212c002e89b7faba66c4c76dbcdb8c29cda

                                                    SHA512

                                                    38991d0ca66eb921f5979eaa3f670e975b5f46e35207d465b8c18ca53079cfa89ab61cb9702b2b15fcda52f1594afc4fd11f8f72712457d6930516af5778eb84

                                                    Download Submit

                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                    Filesize

                                                    9KB

                                                    MD5

                                                    1ef7574bc4d8b6034935d99ad884f15b

                                                    SHA1

                                                    110709ab33f893737f4b0567f9495ac60c37667c

                                                    SHA256

                                                    0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                    SHA512

                                                    947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                    Download Submit

                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    f512536173e386121b3ebd22aac41a4e

                                                    SHA1

                                                    74ae133215345beaebb7a95f969f34a40dda922a

                                                    SHA256

                                                    a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                    SHA512

                                                    1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                    Download Submit

                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                    Filesize

                                                    76KB

                                                    MD5

                                                    b40fe65431b18a52e6452279b88954af

                                                    SHA1

                                                    c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                    SHA256

                                                    800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                    SHA512

                                                    e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                    Download Submit

                                                  • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                    Filesize

                                                    80KB

                                                    MD5

                                                    3904d0698962e09da946046020cbcb17

                                                    SHA1

                                                    edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                    SHA256

                                                    a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                    SHA512

                                                    c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                    Filesize

                                                    717B

                                                    MD5

                                                    ef0a07aec4367a64c16c581da2657aa9

                                                    SHA1

                                                    13011a5abcbadb3424fb6ecee560665556bb1d24

                                                    SHA256

                                                    f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                    SHA512

                                                    35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    362ce475f5d1e84641bad999c16727a0

                                                    SHA1

                                                    6b613c73acb58d259c6379bd820cca6f785cc812

                                                    SHA256

                                                    1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                    SHA512

                                                    7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                    Filesize

                                                    1.9MB

                                                    MD5

                                                    8de5a7a19d882820893d8b911c1710fb

                                                    SHA1

                                                    95cdf5855bc5e454c8944952697ab142f77124f7

                                                    SHA256

                                                    2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                    SHA512

                                                    3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    9a9b1fd85b5f1dcd568a521399a0d057

                                                    SHA1

                                                    34ed149b290a3a94260d889ba50cb286f1795fa6

                                                    SHA256

                                                    88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                    SHA512

                                                    7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                    Filesize

                                                    375KB

                                                    MD5

                                                    4a09a87d2004dac4b00687e9c9f15036

                                                    SHA1

                                                    c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                    SHA256

                                                    2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                    SHA512

                                                    f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                    Filesize

                                                    321KB

                                                    MD5

                                                    d3901e62166e9c42864fe3062cb4d8d5

                                                    SHA1

                                                    c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                    SHA256

                                                    dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                    SHA512

                                                    ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                    Filesize

                                                    814KB

                                                    MD5

                                                    9b1f97a41bfb95f148868b49460d9d04

                                                    SHA1

                                                    768031d5e877e347a249dfdeab7c725df941324b

                                                    SHA256

                                                    09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                    SHA512

                                                    9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    e74d2a16da1ddb7f9c54f72b8a25897c

                                                    SHA1

                                                    32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                    SHA256

                                                    a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                    SHA512

                                                    52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                    Filesize

                                                    11B

                                                    MD5

                                                    5eda46a55c61b07029e7202f8cf1781c

                                                    SHA1

                                                    862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                    SHA256

                                                    12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                    SHA512

                                                    4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                    Filesize

                                                    12B

                                                    MD5

                                                    5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                    SHA1

                                                    93012724e6cc0a298838aede678806e6c0c6517d

                                                    SHA256

                                                    a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                    SHA512

                                                    890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                    Filesize

                                                    48KB

                                                    MD5

                                                    b4a865268d5aca5f93bab91d7d83c800

                                                    SHA1

                                                    95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                    SHA256

                                                    5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                    SHA512

                                                    c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                    Filesize

                                                    48KB

                                                    MD5

                                                    41ff5c6c827c2ed8fa362bed858898df

                                                    SHA1

                                                    b40155d4ebbe87375942148c0ffa9de47f193f8d

                                                    SHA256

                                                    a15e43b2e6e601c71ba2ecaac5c19828ca7ce0f372fe1cb4b44a4b0ad563cf48

                                                    SHA512

                                                    6f065433a3247af1740b4f17bb36f24a78565efe48989c4439b058bbab2767a28c671763635bbe3fd599766afc566ff0aeeb98ff2a245e5953bd2a5e6a719238

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                    Filesize

                                                    48KB

                                                    MD5

                                                    e4c24929e62ffc9945f12145070c5d26

                                                    SHA1

                                                    acc09e6c851b5ff7963a6e1a711a64a9548f1618

                                                    SHA256

                                                    8219cb28f8fdebef83e09280a778410fdd51394bc37c11126ea23b46d49c4dd5

                                                    SHA512

                                                    9e35704883578491330f003df9cf04a63cf4b05af18403e22d6ed10a41a6726fc5e1e9bb917d3c176a6dca7d2841a0b2abafb1c0e31218bb83d1708a603c2189

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                    Filesize

                                                    2.8MB

                                                    MD5

                                                    cfbba86a80ce48cba7dc209480f390ad

                                                    SHA1

                                                    e37c4e5e78903290176646cfbf314772441950dc

                                                    SHA256

                                                    6d991a9a13491ba18d66fad03f2aaf29f336c7ee7c82c3a1351aeafa7d55aaab

                                                    SHA512

                                                    cae4657ac735a7be2d12ae8828c0cac95d2d028c469d3e06a5555f375b9aae49a38b29ca7206745e2d48e94f56fb5afadc1ad394d0b3d23ccb505da67005466f

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                    Filesize

                                                    2.9MB

                                                    MD5

                                                    7805ea1a8dd15cac328b826efe38c2a9

                                                    SHA1

                                                    66ff8eafb2424717c4394bae28a8683db1244527

                                                    SHA256

                                                    7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                    SHA512

                                                    17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    6c6f85e896655a6eb726482f04c49086

                                                    SHA1

                                                    2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                    SHA256

                                                    e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                    SHA512

                                                    b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                    Filesize

                                                    541B

                                                    MD5

                                                    d0efb0a6d260dbe5d8c91d94b77d7acd

                                                    SHA1

                                                    e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                    SHA256

                                                    7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                    SHA512

                                                    a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                    Filesize

                                                    12B

                                                    MD5

                                                    3d66ae5ed06891e8ce75a39a24070844

                                                    SHA1

                                                    368064119835d4376727a14706c41384446183e8

                                                    SHA256

                                                    73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                    SHA512

                                                    c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                    Download Submit

                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                    Filesize

                                                    646KB

                                                    MD5

                                                    7895698867d1ad33934a8553b4806dc5

                                                    SHA1

                                                    32704df55deaff9bf0b4ee0b887541856578938b

                                                    SHA256

                                                    ef5854b5e800a534a08c083d4a3956dfc0a474ff540cae9bf0a9077a213b2ff9

                                                    SHA512

                                                    20337093ddc5322c4b96c7bf26f1a0b966fafde70a96f7e9b5e9d36acac7d862bd2a50cae9a63731b23904a9256c94cd3bb4e19768130580511ec4c408536a58

                                                    Download Submit

                                                  • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\234051aed13106af1df1ac004caba958
                                                    Filesize

                                                    16KB

                                                    MD5

                                                    b2e89027a140a89b6e3eb4e504e93d96

                                                    SHA1

                                                    f3b1b34874b73ae3032decb97ef96a53a654228f

                                                    SHA256

                                                    5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                    SHA512

                                                    93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                    Download Submit

                                                  • C:\ProgramData\chocolatey\config\chocolatey.config
                                                    Filesize

                                                    809B

                                                    MD5

                                                    8b6737800745d3b99886d013b3392ac3

                                                    SHA1

                                                    bb94da3f294922d9e8d31879f2d145586a182e19

                                                    SHA256

                                                    86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                    SHA512

                                                    654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                    Download Submit

                                                  • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    d20afae4953b8467c409f426a7853b77

                                                    SHA1

                                                    9654f0ad7804f737b1e2e765e50ec8f7e95a2105

                                                    SHA256

                                                    dd38c735fdf0a25e9e010dc23f965a5d989d5fc6f61ef9f897d19b535d774d1b

                                                    SHA512

                                                    555c63851e9c37b7f78d160074f6345bf10714056d879db4a3e885fffd7b4501f28255080cbd6f4ebcf9d406ae133c9f191a01ba836cf927847eb18bfbd0788f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                    Filesize

                                                    471B

                                                    MD5

                                                    34aca87ddad4cc68d20f5f7d54bec321

                                                    SHA1

                                                    afe9e1fa37622d2c0aaec924b065fe1aee685ae4

                                                    SHA256

                                                    5272144179684c4dee6c4aa76f90d2fb440535fad78e725c2636e369d1653c18

                                                    SHA512

                                                    6a7a6737351943c3f5f1b3f4e9bc3c5b96f58e135b8bcc6ff74f2c11246b742a3d40af7f01a33f87cab773d1c9af26d54aa62884121346e66d4f32ab2e788b08

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                    Filesize

                                                    727B

                                                    MD5

                                                    e9e9c174d8e0b2bdef420778ae49b9a3

                                                    SHA1

                                                    0abe4bb99797e0924aa0d075438c833717ef7608

                                                    SHA256

                                                    e4e459b0143733d67817bd7ab31df8d79fe83ff3b645c30fef47a8e9b41a162b

                                                    SHA512

                                                    5062cfdb9c1a7a7d9029b56659a0749d97487ce17cb7e8d49c5f8fa8ca3e1d2ef3351ae7e54c703b84511926b9bc032f2988f6205629d638846aeb979a0eabee

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    Filesize

                                                    727B

                                                    MD5

                                                    50c2acca85675897b36b7b4be3146abf

                                                    SHA1

                                                    73f0c48a8fb60ec92eba17c7a901703234cd0f8f

                                                    SHA256

                                                    0463055a40e90c7b44ae7273a2480f8fc5ac657eb7cdfd2f1d7e44129ccd5e76

                                                    SHA512

                                                    1902e8b97988e3d68b02047d68686bf3c68b36e262014f0b40ef920d066b83f21fbbaca5ec3b3c37c961fc06ee39a2fafe42a896d54f1a4fc748a31d71ba3e61

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                    Filesize

                                                    400B

                                                    MD5

                                                    368393dc380c923f5e4700387ca1eaaf

                                                    SHA1

                                                    b97e61a68ab6f234fb8f9ec2733ed4d0b69adc1c

                                                    SHA256

                                                    4980d23a4390b220e238313fd43f23993c83317db94d88efbab78d23e637c703

                                                    SHA512

                                                    bd4a2663f917bb382caa0d8a58e211b5ea18fe67e51f35e82e9aef41e8c63cc025d3625fb1a173150ec9be2d10d54447339c89e998ac0ed76b1943f66b42975f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                    Filesize

                                                    404B

                                                    MD5

                                                    9e9f49e9411a6b7b6b12783426918abf

                                                    SHA1

                                                    60abf54df891fd554ebc6707479f77a21fbd1f7e

                                                    SHA256

                                                    f413bc20c712e96e613a7e5a35740303a180cea6c5ef547efa4e91dfb54e7bfd

                                                    SHA512

                                                    cd34698276905f0a12a727b312d62b53e08192da075f5caa37b7da39dacca6292e01a5f2975ab7cf575e5b6013db719643ddd2d76eaa12e77d4104728781806d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    Filesize

                                                    412B

                                                    MD5

                                                    14a12746bc7a4287e838946af244e5c9

                                                    SHA1

                                                    607645cd38dc513c0284e60260955dd64a0c1330

                                                    SHA256

                                                    6b0a5c3f56b91e2306b7ed16821e55ca525052bb653b521593f4b51b0561f1a0

                                                    SHA512

                                                    a57e352f5d94f546473460240503ff3fc82de1a51c08016678bbf2a7f0f8038e5e4460e2efc9bcee18c71007705904d0941edebadb1056b5fa28475db145859a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                    Filesize

                                                    651B

                                                    MD5

                                                    9bbfe11735bac43a2ed1be18d0655fe2

                                                    SHA1

                                                    61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                    SHA256

                                                    549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                    SHA512

                                                    a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                    Download Submit

                                                  • C:\Windows\Installer\MSI550F.tmp
                                                    Filesize

                                                    4.5MB

                                                    MD5

                                                    2207f96731ce2f9d9327c0baaf4959ef

                                                    SHA1

                                                    f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                    SHA256

                                                    e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                    SHA512

                                                    7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                    Download Submit

                                                  • C:\Windows\Installer\MSID050.tmp
                                                    Filesize

                                                    509KB

                                                    MD5

                                                    88d29734f37bdcffd202eafcdd082f9d

                                                    SHA1

                                                    823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                    SHA256

                                                    87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                    SHA512

                                                    1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                    Download Submit

                                                  • C:\Windows\Installer\MSID050.tmp-\AlphaControlAgentInstallation.dll
                                                    Filesize

                                                    25KB

                                                    MD5

                                                    aa1b9c5c685173fad2dabebeb3171f01

                                                    SHA1

                                                    ed756b1760e563ce888276ff248c734b7dd851fb

                                                    SHA256

                                                    e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                    SHA512

                                                    d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                    Download Submit

                                                  • C:\Windows\Installer\MSID050.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                    Filesize

                                                    179KB

                                                    MD5

                                                    1a5caea6734fdd07caa514c3f3fb75da

                                                    SHA1

                                                    f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                    SHA256

                                                    cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                    SHA512

                                                    a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                    Download Submit

                                                  • C:\Windows\Installer\MSID3DB.tmp-\CustomAction.config
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    bc17e956cde8dd5425f2b2a68ed919f8

                                                    SHA1

                                                    5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                    SHA256

                                                    e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                    SHA512

                                                    02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                    Download Submit

                                                  • C:\Windows\Installer\MSID3DB.tmp-\Newtonsoft.Json.dll
                                                    Filesize

                                                    695KB

                                                    MD5

                                                    715a1fbee4665e99e859eda667fe8034

                                                    SHA1

                                                    e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                    SHA256

                                                    c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                    SHA512

                                                    bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                    Download Submit

                                                  • C:\Windows\Installer\MSIDB31.tmp
                                                    Filesize

                                                    211KB

                                                    MD5

                                                    a3ae5d86ecf38db9427359ea37a5f646

                                                    SHA1

                                                    eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                    SHA256

                                                    c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                    SHA512

                                                    96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                    Download Submit

                                                  • C:\Windows\Installer\MSIF4FC.tmp-\System.Management.dll
                                                    Filesize

                                                    60KB

                                                    MD5

                                                    878e361c41c05c0519bfc72c7d6e141c

                                                    SHA1

                                                    432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                    SHA256

                                                    24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                    SHA512

                                                    59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                    Download Submit

                                                  • C:\Windows\Installer\e57cf85.msi
                                                    Filesize

                                                    2.9MB

                                                    MD5

                                                    72108ae3791d6199697c5447ff2ffc6b

                                                    SHA1

                                                    2ac85588e9b673881a827bebdfa1eb6e9bed15ff

                                                    SHA256

                                                    533becd0cc4cf29897da93ef4c5cedfedcfde7649e69d387e614bd30798db0fc

                                                    SHA512

                                                    45f411856a0c711071247d02d913b405f8b47900cd1e80ca568baf0f8a3f908a90f6d5c207642498af1eed25af8bfa92db865f9e1724e0aeeeab1c65f5cb9591

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{5ef60bb3-fe49-2347-b5eb-6f3217cb25ce}\lci_proxywddm.cat
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    8e16d54f986dbe98812fd5ec04d434e8

                                                    SHA1

                                                    8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                    SHA256

                                                    7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                    SHA512

                                                    e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{5ef60bb3-fe49-2347-b5eb-6f3217cb25ce}\lci_proxywddm.inf
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    0315a579f5afe989154cb7c6a6376b05

                                                    SHA1

                                                    e352ff670358cf71e0194918dfe47981e9ccbb88

                                                    SHA256

                                                    d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                    SHA512

                                                    c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{5ef60bb3-fe49-2347-b5eb-6f3217cb25ce}\x64\lci_proxyumd.dll
                                                    Filesize

                                                    179KB

                                                    MD5

                                                    4dc11547a5fc28ca8f6965fa21573481

                                                    SHA1

                                                    d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                    SHA256

                                                    e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                    SHA512

                                                    bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{5ef60bb3-fe49-2347-b5eb-6f3217cb25ce}\x64\lci_proxyumd32.dll
                                                    Filesize

                                                    135KB

                                                    MD5

                                                    67ae7b2c36c9c70086b9d41b4515b0a8

                                                    SHA1

                                                    ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                    SHA256

                                                    79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                    SHA512

                                                    4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{5ef60bb3-fe49-2347-b5eb-6f3217cb25ce}\x64\lci_proxywddm.sys
                                                    Filesize

                                                    119KB

                                                    MD5

                                                    b9b0e9b4d93b18b99ece31a819d71d00

                                                    SHA1

                                                    2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                    SHA256

                                                    0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                    SHA512

                                                    465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{cacf604a-8b3e-b84b-ad1c-214751e6f22c}\lci_iddcx.cat
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    62458e58313475c9a3642a392363e359

                                                    SHA1

                                                    e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                    SHA256

                                                    85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                    SHA512

                                                    49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{cacf604a-8b3e-b84b-ad1c-214751e6f22c}\lci_iddcx.inf
                                                    Filesize

                                                    4KB

                                                    MD5

                                                    1cec22ca85e1b5a8615774fca59a420b

                                                    SHA1

                                                    049a651751ef38321a1088af6a47c4380f9293fc

                                                    SHA256

                                                    60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                    SHA512

                                                    0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                    Download Submit

                                                  • C:\Windows\System32\DriverStore\Temp\{cacf604a-8b3e-b84b-ad1c-214751e6f22c}\x64\lci_iddcx.dll
                                                    Filesize

                                                    52KB

                                                    MD5

                                                    01e8bc64139d6b74467330b11331858d

                                                    SHA1

                                                    b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                    SHA256

                                                    148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                    SHA512

                                                    4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                    Download Submit

                                                  • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-10-29-54.dat
                                                    Filesize

                                                    602B

                                                    MD5

                                                    6eedc414fd13d385c655398dfe2fad3c

                                                    SHA1

                                                    455e4eb0559ba9d271c8505840e911bf86b20f13

                                                    SHA256

                                                    3ce708d470991047d8975e16d5c2b37dc5f6a78b968208773d3786fe831ebb1e

                                                    SHA512

                                                    c5eddefda87d630326f6d65fc58524b039e0bfffa84e13428de87bc3078bd46022f8b8d3e178dda59456888c219c9ade1400b470126009c38dec7ce7b587b8ff

                                                    Download Submit

                                                  • C:\Windows\Temp\InstallUtil.log
                                                    Filesize

                                                    4KB

                                                    MD5

                                                    ff87061fa1183c4ec1759b45dd2963c9

                                                    SHA1

                                                    eac0273c6c5ab4e9453935f1c542844dbc6d0e8e

                                                    SHA256

                                                    9a7e0a4ef4b83e742b4de23c74242f6560b0e71ffb626d7d99c6f1744074ca75

                                                    SHA512

                                                    301bf71b1f091329be8eb34f146356b4f38affbcd8b203bebe2aa18fa0b9f79b40bbc25c25e701d37248499efe93f69368de21d4a4046313c3587e809d868004

                                                    Download Submit

                                                  • C:\Windows\Temp\InstallUtil.log
                                                    Filesize

                                                    850B

                                                    MD5

                                                    f2b99155a551a29163c68321b2ac1589

                                                    SHA1

                                                    667ced28a60ff885e768ad1627d201c4e62bc4d5

                                                    SHA256

                                                    dc85ce8e3c1cf23e3fd7ba4f3d54aaf7a8e40a3a6faa7ab4fac00d7c232c68a4

                                                    SHA512

                                                    37c14f95e1206f0cb11d9a3a4cef291db8d757c1398bc9bfe4ea5628cb36d6a788620308043f714ef2e46a1634d65ae2da6334ea8158438267e7b78f32ee8a4b

                                                    Download Submit

                                                  • C:\Windows\Temp\PreVer.log
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    df3443baca98a29acfdbba2be349a604

                                                    SHA1

                                                    0ca78037d2b6cd3cdba46b6feb350c81bd77f4eb

                                                    SHA256

                                                    e54bf4110d315552d2212ecc1f866863da766b3230eb167514185541fa05fdd1

                                                    SHA512

                                                    1acca2a7c68442dc50a8fc0ef73a6569e1ff056bd79cdcfa2af0e84d6b696cdd7c428c1de78575841fffa2f01e01646ca4dda2bde35175428b6b9f7c79ebeaf2

                                                    Download Submit

                                                  • C:\Windows\Temp\unpack.log
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    2f362d6d9180ea04da631ec1fbf19023

                                                    SHA1

                                                    05ac819e6f74b06c3dfb4597d96f1dc628acd4b8

                                                    SHA256

                                                    423030f61c67394d0a44d310ca804e6ad302eb6bedc7e1ca1b68549ebd8f8628

                                                    SHA512

                                                    d521711fbe3c89336718d8334a231b6b8e087d79a0dc77398d5ca7c4697edded1374a52a9191b812380733f24642a4389b40fe02e2c63a08704546ff0f942385

                                                    Download Submit

                                                  • C:\Windows\Temp\unpack.log
                                                    Filesize

                                                    4KB

                                                    MD5

                                                    39107c8ac85689b681aa69c391600cc8

                                                    SHA1

                                                    6749dbccdc407f5ca56e6f488252f11e9fd33864

                                                    SHA256

                                                    3472827c32d07bd8d28c83e93a9c4965fd819719db6a1f590b0a0fe1863eb89d

                                                    SHA512

                                                    a3c0f3e831ec13fffc004c49f0fa6a9cb5251693870fb2338ea8081d5b637f6b936b017fd235f8c3ee1e6d9b705a9a5fc4974d673fe30818cbc88246caa716e7

                                                    Download Submit

                                                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                    Filesize

                                                    3.2MB

                                                    MD5

                                                    a7ce785b6cd1c9657040ca9b6cbeed10

                                                    SHA1

                                                    4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                    SHA256

                                                    7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                    SHA512

                                                    39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                    Download Submit

                                                  • C:\Windows\Temp\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\ISRT.dll
                                                    Filesize

                                                    427KB

                                                    MD5

                                                    85315ad538fa5af8162f1cd2fce1c99d

                                                    SHA1

                                                    31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                    SHA256

                                                    70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                    SHA512

                                                    877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                    Download Submit

                                                  • C:\Windows\Temp\{191DE29D-0AD5-4190-B28F-3D85EE40A17E}\_isres_0x0409.dll
                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    befe2ef369d12f83c72c5f2f7069dd87

                                                    SHA1

                                                    b89c7f6da1241ed98015dc347e70322832bcbe50

                                                    SHA256

                                                    9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                    SHA512

                                                    760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                    Download Submit

                                                  • C:\Windows\Temp\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\IsConfig.ini
                                                    Filesize

                                                    571B

                                                    MD5

                                                    38370175ce7d8dd5c3581030a9104259

                                                    SHA1

                                                    bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                    SHA256

                                                    ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                    SHA512

                                                    e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                    Download Submit

                                                  • C:\Windows\Temp\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\String1033.txt
                                                    Filesize

                                                    182KB

                                                    MD5

                                                    37a2c4ef0ff41955f1cb884b7790699f

                                                    SHA1

                                                    8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                    SHA256

                                                    6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                    SHA512

                                                    fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                    Download Submit

                                                  • C:\Windows\Temp\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\_is46B9.exe
                                                    Filesize

                                                    179KB

                                                    MD5

                                                    7a1c100df8065815dc34c05abc0c13de

                                                    SHA1

                                                    3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                    SHA256

                                                    e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                    SHA512

                                                    bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                    Download Submit

                                                  • C:\Windows\Temp\{A256EDFA-424E-4D41-B6DF-377FDBA1CC36}\setup.inx
                                                    Filesize

                                                    345KB

                                                    MD5

                                                    0376dd5b7e37985ea50e693dc212094c

                                                    SHA1

                                                    02859394164c33924907b85ab0aaddc628c31bf1

                                                    SHA256

                                                    c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                    SHA512

                                                    69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                    Download Submit

                                                  • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                    Filesize

                                                    404B

                                                    MD5

                                                    3d42896678652d69e1b0fe552c087769

                                                    SHA1

                                                    ac6bd2e1bb37ba51d0066309a7fd4cbcdcbcebcb

                                                    SHA256

                                                    2d45377387046fe75afb648ce48fc00b5e303af28be7b5afeff091e9285d78a2

                                                    SHA512

                                                    026ac841e56b98bba07e91b04b2ebc0a133dabd2f49bb7ac70896e70a2c7765d732f6bb568b171531db28170d81f65b6d5cc3753b327caabfa41c5c8414e632d

                                                    Download Submit

                                                  • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                    Filesize

                                                    412B

                                                    MD5

                                                    c6df21925d3e7d52c990af1131348ba5

                                                    SHA1

                                                    31335b3c18326cd9fa0e855fa8ff390c2ae572bd

                                                    SHA256

                                                    8e9adb9da59fbd0d9710d6c91d633c036c01e5db3e29e9b606298c487d66e8e4

                                                    SHA512

                                                    567284923f698bd43bc370ab4940f081e0bd5b5b1b9044588104fcf287ca4c746b99f0a520f8e073f3236c8f7160674c547f9798452fa4fcf677cceefbadc019

                                                    Download Submit

                                                  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                    Filesize

                                                    24.1MB

                                                    MD5

                                                    182c3d7ad18f5151e8e23a0da12abe9c

                                                    SHA1

                                                    94b1e3e8d243cd0ec537e364b57a543af6c674f4

                                                    SHA256

                                                    f2e6b2d94610538d40e08028d0b23a195325e0b27fbc820842c6b29ef3ed9185

                                                    SHA512

                                                    3009c24d8da3e2d83737fff70962b5add708e7dd278eda937f55f1a00985b407ec73ff1828038775066c091f3a09fb4d96ac32e2c14098141df9974dece64cfd

                                                    Download Submit

                                                  • \??\Volume{f9c79713-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1b100154-dc49-493c-9da7-780c7c53094f}_OnDiskSnapshotProp
                                                    Filesize

                                                    6KB

                                                    MD5

                                                    18cf93e4cbba6f9fab4229e74069abe6

                                                    SHA1

                                                    59dcfc2728f45bbb94b1fc0a039e4a717da874d6

                                                    SHA256

                                                    d36ce9da06db99b02dac967432aceee3e9fc0dc50d410d4a9d954f53286a50bc

                                                    SHA512

                                                    d0628ca8e08f410deab8405b0cfdb75e093f60e4f4536dd77ac01945bac1aed1bbb36f0835b8da82cb9b8ae2e318893460bb6416e19dd3a7ffcb37476a7aa6c2

                                                    Download Submit

                                                  • memory/856-301-0x0000022BC1540000-0x0000022BC15F2000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/856-302-0x0000022BA8BD0000-0x0000022BA8BEC000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/856-300-0x0000022BA8380000-0x0000022BA8396000-memory.dmp

                                                    Filesize

                                                    88KB

                                                    Download

                                                  • memory/1204-1625-0x0000020F8D870000-0x0000020F8D88A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                    Download

                                                  • memory/1204-1742-0x0000020FA61D0000-0x0000020FA6282000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/1204-1784-0x0000020FA6940000-0x0000020FA6E68000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                    Download

                                                  • memory/1204-1600-0x0000020F8D040000-0x0000020F8D04A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/1224-1766-0x0000026008480000-0x00000260084A0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1224-1753-0x0000026007B00000-0x0000026007B12000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/1224-1756-0x0000026020C50000-0x0000026020D02000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/1224-1789-0x0000026021E10000-0x000002602246C000-memory.dmp

                                                    Filesize

                                                    6.4MB

                                                    Download

                                                  • memory/1224-1754-0x0000026008330000-0x0000026008340000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/1440-243-0x000001DB78190000-0x000001DB781C8000-memory.dmp

                                                    Filesize

                                                    224KB

                                                    Download

                                                  • memory/1440-195-0x000001DB77C50000-0x000001DB77D02000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/1440-202-0x000001DB77BC0000-0x000001DB77BE2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/1744-1788-0x000002B69C9D0000-0x000002B69CAAC000-memory.dmp

                                                    Filesize

                                                    880KB

                                                    Download

                                                  • memory/1744-1755-0x000002B6834B0000-0x000002B6834C2000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/1744-1786-0x000002B69C830000-0x000002B69C8E2000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/1744-1758-0x000002B683D40000-0x000002B683D8A000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/1744-1764-0x000002B683CF0000-0x000002B683D0C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/2024-274-0x00000139CB290000-0x00000139CB2C0000-memory.dmp

                                                    Filesize

                                                    192KB

                                                    Download

                                                  • memory/2024-277-0x00000139CBC80000-0x00000139CBD30000-memory.dmp

                                                    Filesize

                                                    704KB

                                                    Download

                                                  • memory/2024-278-0x00000139CB680000-0x00000139CB69C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/2160-1760-0x0000025B6B8D0000-0x0000025B6B8DC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/2160-1791-0x0000025B6CC00000-0x0000025B6CCB0000-memory.dmp

                                                    Filesize

                                                    704KB

                                                    Download

                                                  • memory/2160-1762-0x0000025B6C970000-0x0000025B6C9BA000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/2160-1771-0x0000025B6BF00000-0x0000025B6BF1C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/2476-110-0x0000000004760000-0x00000000047C6000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/3204-352-0x000002AF26180000-0x000002AF26188000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/3204-355-0x000002AF3EA50000-0x000002AF3EA7A000-memory.dmp

                                                    Filesize

                                                    168KB

                                                    Download

                                                  • memory/3204-345-0x000002AF3E880000-0x000002AF3E8CC000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/3204-353-0x000002AF26190000-0x000002AF26198000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/3204-346-0x000002AF3E8D0000-0x000002AF3E918000-memory.dmp

                                                    Filesize

                                                    288KB

                                                    Download

                                                  • memory/3204-342-0x000002AF25690000-0x000002AF256F4000-memory.dmp

                                                    Filesize

                                                    400KB

                                                    Download

                                                  • memory/3204-347-0x000002AF25F40000-0x000002AF25F48000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/3204-354-0x000002AF3EA90000-0x000002AF3EAF8000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/3204-344-0x000002AF25F20000-0x000002AF25F3C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/3204-348-0x000002AF25F50000-0x000002AF25F5A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/3204-349-0x000002AF3EB00000-0x000002AF3EBDC000-memory.dmp

                                                    Filesize

                                                    880KB

                                                    Download

                                                  • memory/3204-350-0x000002AF3EBE0000-0x000002AF3EC92000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/3204-356-0x000002AF3ED20000-0x000002AF3ED5A000-memory.dmp

                                                    Filesize

                                                    232KB

                                                    Download

                                                  • memory/3204-357-0x000002AF3EA20000-0x000002AF3EA46000-memory.dmp

                                                    Filesize

                                                    152KB

                                                    Download

                                                  • memory/3204-351-0x000002AF26170000-0x000002AF26178000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/3204-343-0x000002AF25F70000-0x000002AF25FBA000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/3472-2900-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/3472-1195-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/3472-2901-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/3472-2535-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/3472-1196-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/3472-2536-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4308-160-0x0000025D1ECD0000-0x0000025D1ED68000-memory.dmp

                                                    Filesize

                                                    608KB

                                                    Download

                                                  • memory/4308-148-0x0000025D046D0000-0x0000025D046F8000-memory.dmp

                                                    Filesize

                                                    160KB

                                                    Download

                                                  • memory/4308-165-0x0000025D06440000-0x0000025D0647C000-memory.dmp

                                                    Filesize

                                                    240KB

                                                    Download

                                                  • memory/4308-164-0x0000025D04AC0000-0x0000025D04AD2000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/4364-1163-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4364-2023-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4364-1948-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4364-1949-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4364-1150-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4364-2024-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4516-1767-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4516-1132-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4516-1131-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4516-2532-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4516-2533-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4516-1768-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4516-2013-0x0000000072550000-0x000000007291D000-memory.dmp

                                                    Filesize

                                                    3.8MB

                                                    Download

                                                  • memory/4516-2012-0x0000000072920000-0x0000000072A3C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/4556-1769-0x000001B7D7FD0000-0x000001B7D8036000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/4556-1770-0x000001B7D7F20000-0x000001B7D7F34000-memory.dmp

                                                    Filesize

                                                    80KB

                                                    Download

                                                  • memory/4556-1765-0x000001B7F0830000-0x000001B7F08E2000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/4556-1757-0x000001B7D7EE0000-0x000001B7D7F00000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4556-1752-0x000001B7D76B0000-0x000001B7D76C0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/4608-79-0x0000000005510000-0x0000000005532000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/4608-80-0x00000000056D0000-0x0000000005A24000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/4608-76-0x00000000055D0000-0x0000000005682000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/4624-1619-0x0000023972010000-0x000002397204A000-memory.dmp

                                                    Filesize

                                                    232KB

                                                    Download

                                                  • memory/4624-1780-0x0000023973C30000-0x0000023973C78000-memory.dmp

                                                    Filesize

                                                    288KB

                                                    Download

                                                  • memory/4624-1772-0x00000239731C0000-0x0000023973272000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/4624-1777-0x0000023972900000-0x000002397291C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/4752-43-0x0000000003240000-0x000000000324C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/4752-39-0x0000000003200000-0x000000000322E000-memory.dmp

                                                    Filesize

                                                    184KB

                                                    Download

                                                  • memory/5572-481-0x00000000036A0000-0x0000000003867000-memory.dmp

                                                    Filesize

                                                    1.8MB

                                                    Download

                                                  • memory/5572-1045-0x00000000036C0000-0x0000000003887000-memory.dmp

                                                    Filesize

                                                    1.8MB

                                                    Download

                                                  • memory/5572-1081-0x00000000036D0000-0x0000000003897000-memory.dmp

                                                    Filesize

                                                    1.8MB

                                                    Download

                                                  • memory/5572-1042-0x0000000010000000-0x0000000010114000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/5572-903-0x00000000036B0000-0x0000000003877000-memory.dmp

                                                    Filesize

                                                    1.8MB

                                                    Download

                                                  • memory/5572-900-0x0000000010000000-0x0000000010114000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/5572-478-0x0000000010000000-0x0000000010114000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/5572-512-0x0000000010000000-0x0000000010114000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                    Download

                                                  • memory/5576-1749-0x000002208F3A0000-0x000002208F3B0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/5576-1790-0x00000220A8400000-0x00000220A8408000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/5576-1785-0x00000220A8650000-0x00000220A8702000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/5576-1774-0x00000220A8730000-0x00000220A880C000-memory.dmp

                                                    Filesize

                                                    880KB

                                                    Download

                                                  • memory/5576-1751-0x00000220A8430000-0x00000220A847A000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/5576-1761-0x000002208F840000-0x000002208F85C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/5936-1676-0x000001DBD65D0000-0x000001DBD6624000-memory.dmp

                                                    Filesize

                                                    336KB

                                                    Download

                                                  • memory/5936-1253-0x000001DBBD390000-0x000001DBBD3AC000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/5936-1347-0x000001DBBD470000-0x000001DBBD522000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/5936-1234-0x000001DBBCA30000-0x000001DBBCA42000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/6084-1794-0x000001A2303F0000-0x000001A2304CC000-memory.dmp

                                                    Filesize

                                                    880KB

                                                    Download

                                                  • memory/6084-1759-0x000001A216E20000-0x000001A216E54000-memory.dmp

                                                    Filesize

                                                    208KB

                                                    Download

                                                  • memory/6084-1775-0x000001A217320000-0x000001A217338000-memory.dmp

                                                    Filesize

                                                    96KB

                                                    Download

                                                  • memory/6084-1793-0x000001A230250000-0x000001A230302000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/6084-1773-0x000001A2172D0000-0x000001A2172EC000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/6084-1781-0x000001A2178A0000-0x000001A2178EA000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/6084-1776-0x000001A217300000-0x000001A21730A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/6084-1763-0x000001A217350000-0x000001A21739A000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/6112-1746-0x0000025735A60000-0x0000025735A78000-memory.dmp

                                                    Filesize

                                                    96KB

                                                    Download

                                                  • memory/6112-1748-0x000002574E8A0000-0x000002574E952000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/6112-1733-0x00000257356A0000-0x00000257356AC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/6112-1750-0x0000025735AA0000-0x0000025735AC0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download