Overview

overview

10

Static

static

10

BOMB-762.msi

windows7-x64

10

BOMB-762.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 01:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BOMB-762.msi

  • Size

    2.9MB

  • MD5

    293dbededf4dee5163f25b7902df9a01

  • SHA1

    6ac09402cc896b8e478e6af1436aa5fa6dba4ea0

  • SHA256

    48c6727171424afc2789ed1af0197a3e700ea5039c4b7a3683724c46739f61c2

  • SHA512

    8e2a62e80008c9c3f75ccdeacf091e7d4b6a1eaea4ad9380fc39aa75437ead00f940e2b869760dad011552189d7a086aad64e0746b833e4b2c2a171b7d47e4e8

  • SSDEEP

    49152:1+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:1+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\BOMB-762.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1092
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4760
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding FBF83DC05081FC91FE4C2D550E5DBACE
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4492
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI1B15.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240655406 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4832
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2017.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240656468 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2232
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI26AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240658109 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1804
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI353B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240661843 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2116
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F091E978941BA235F42122FABB118597 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4876
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4288
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3988
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000NSqg2IAD" /AgentId="d8d70b48-6633-4871-8f15-a15d5b324425"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:2640
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1F8314D9EDFC9A8F7E753822EB6121CC E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AE3FAB54-9C21-466F-AFBB-67B7156C18A2}
          3⤵
          • Executes dropped EXE
          PID:1900
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C18AF5A1-964D-4E6C-9681-0BAAC67231D0}
          3⤵
          • Executes dropped EXE
          PID:1488
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00D58E11-1A3E-40FF-B8EA-7A4D4EEB22B5}
          3⤵
          • Executes dropped EXE
          PID:3084
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{678329CD-6A29-4A88-B3EB-BEF56851E453}
          3⤵
          • Executes dropped EXE
          PID:412
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5FF476A2-6016-4F85-B83E-063550D4DE44}
          3⤵
          • Executes dropped EXE
          PID:4504
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{01559527-C89A-4746-B693-9DDFEBB683CE}
          3⤵
          • Executes dropped EXE
          PID:4460
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CFA7D734-4CCE-4D87-911F-2DB17FBF277F}
          3⤵
          • Executes dropped EXE
          PID:516
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3BEA8030-412E-486F-A0AD-095C2917FBF0}
          3⤵
          • Executes dropped EXE
          PID:3352
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4F2D4E14-3494-4C91-B920-84346E27BE3C}
          3⤵
          • Executes dropped EXE
          PID:2960
        • C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe
          C:\Windows\TEMP\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_is7C30.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{356D487C-3300-424B-86DF-5C1DF891B1C2}
          3⤵
          • Executes dropped EXE
          PID:4992
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:412
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3388
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2956
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4392
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4448
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1488
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3416
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2760
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5052
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2160
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1464
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1144
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3988
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3352
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4504
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1592
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:468
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4992
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1548
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA26A373-F7D4-4D45-9DAC-59C7B9BEB97B}
          3⤵
          • Executes dropped EXE
          PID:1656
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6C1E7A5B-55AC-4B65-B5AA-0144F7D82F06}
          3⤵
          • Executes dropped EXE
          PID:2344
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E1DFD151-A8CB-4019-A1EF-888E9B631815}
          3⤵
          • Executes dropped EXE
          PID:4876
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C62DDBDA-8B7F-4CD5-9E69-4D0E2BE590AD}
          3⤵
          • Executes dropped EXE
          PID:2960
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F8892E52-62F2-4D1C-A6F7-5BDB8425ABDD}
          3⤵
          • Executes dropped EXE
          PID:860
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ED6B8A4F-8C7E-478D-9091-64E371944A31}
          3⤵
          • Executes dropped EXE
          PID:3900
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9B7C013-445A-4ECA-A619-539C4A33DE43}
          3⤵
          • Executes dropped EXE
          PID:1708
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32B7B530-AD5B-4876-8BAF-7AA07352D322}
          3⤵
          • Executes dropped EXE
          PID:4500
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDF74E70-E56F-44C8-AFB5-A9ED006AC61A}
          3⤵
          • Executes dropped EXE
          PID:4840
        • C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
          C:\Windows\TEMP\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{662ACBA6-7C5F-47AF-B70E-41CDD2526D62}
          3⤵
          • Executes dropped EXE
          PID:2956
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9678F585-A61E-4BEE-AA03-55C956CC14B2}
          3⤵
          • Executes dropped EXE
          PID:2640
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E28FCDC4-52D0-409D-A495-B58847FC5BEA}
          3⤵
          • Executes dropped EXE
          PID:3640
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A02F5DE-0A39-464F-9537-8A71861607DB}
          3⤵
          • Executes dropped EXE
          PID:4852
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2E158BB9-4443-4DAE-8D3D-882AF212D37F}
          3⤵
          • Executes dropped EXE
          PID:4300
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{01E5F079-0CE2-4A42-9112-1654DDDADC71}
          3⤵
          • Executes dropped EXE
          PID:2172
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{580A61DA-9941-4AFD-A762-BA155FD950C8}
          3⤵
          • Executes dropped EXE
          PID:3684
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C95B004B-AB96-4209-B01D-CF7D69DBF039}
          3⤵
          • Executes dropped EXE
          PID:3472
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{482F1820-6BC7-442B-BE7A-5F9BC64286CF}
          3⤵
          • Executes dropped EXE
          PID:2240
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3974D5D5-4958-42D0-B767-727A6AD97A93}
          3⤵
          • Executes dropped EXE
          PID:4464
        • C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe
          C:\Windows\TEMP\{C22534E9-7056-46FF-8885-BA104B6DF30E}\_isA4A9.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D47629FF-8E5C-4C1F-BA78-0DAA7A91CD58}
          3⤵
          • Executes dropped EXE
          PID:2340
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2640
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1712
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:3596
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:4464
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:2660
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5108
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{232B2D80-96BA-4E9F-AF7E-4A9912BFBB4B}
              3⤵
              • Executes dropped EXE
              PID:436
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F422DD70-9A0A-4CBE-B5A7-7BE4DFDD16B1}
              3⤵
              • Executes dropped EXE
              PID:432
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{97DE835C-D36D-471C-AF3B-C9330712464E}
              3⤵
              • Executes dropped EXE
              PID:2012
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8D575B3E-32FA-4F5D-A4FF-D4E4670CAFF4}
              3⤵
              • Executes dropped EXE
              PID:1744
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D7C3212-553F-442C-8A29-F6000A4BC096}
              3⤵
              • Executes dropped EXE
              PID:860
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EBCA31A0-14D2-4717-9093-3A47C2BDFA12}
              3⤵
              • Executes dropped EXE
              PID:3168
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B1C50EC7-3BFD-429B-9084-CE977A28FC03}
              3⤵
              • Executes dropped EXE
              PID:2968
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F228E730-5F5D-44F0-905E-06D0F7700664}
              3⤵
              • Executes dropped EXE
              PID:1696
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{460EF883-980A-46C4-B6AE-C0C980C2FD41}
              3⤵
              • Executes dropped EXE
              PID:4496
            • C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe
              C:\Windows\TEMP\{E465E0C1-83B1-4B0A-9647-CFB1C20C1030}\_isBBCD.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6DB744B3-6BE6-4651-AC91-8FF822CCC063}
              3⤵
              • Executes dropped EXE
              PID:4500
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3588
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D293E37F-5AE5-40E6-B295-5F0296C88892}
              3⤵
              • Executes dropped EXE
              PID:4464
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F9D50174-D664-440F-918D-B73DAF45CF6C}
              3⤵
              • Executes dropped EXE
              PID:4424
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB1EE069-5B44-4C0E-BC0A-0FBD7A61516A}
              3⤵
              • Executes dropped EXE
              PID:2956
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A0A74C8-6035-4A97-B851-B75B2C542F76}
              3⤵
              • Executes dropped EXE
              PID:3312
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6703C97-0020-4EEB-AF56-423CB4968ABB}
              3⤵
              • Executes dropped EXE
              PID:2712
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FCE73E08-CEA1-4588-B2DB-BA3F4A5EEB5A}
              3⤵
              • Executes dropped EXE
              PID:1884
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CCAB1FB2-D817-4258-B634-D6799E84B74F}
              3⤵
              • Executes dropped EXE
              PID:3900
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C4C6AEC7-BC9F-4C2F-A54B-00EB8C32288D}
              3⤵
              • Executes dropped EXE
              PID:2960
            • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
              C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1C3BB7D8-A875-489A-8F67-4A04233FE2D4}
              3⤵
                PID:4688
              • C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe
                C:\Windows\TEMP\{56E3363E-3B63-4971-BDA4-D82898C8D3EF}\_isC312.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35659E76-B584-4C9B-814C-24929195691E}
                3⤵
                  PID:4764
                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2396
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 119F9B7B65A82AD2BBAC26912F37D4D6 E Global\MSI0000
                2⤵
                • System Location Discovery: System Language Discovery
                PID:5836
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIF088.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710203 463 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4884
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIF451.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710765 467 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:6100
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSIFA3E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240712296 472 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                  3⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4896
                • C:\Windows\SysWOW64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5352
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:5264
                • C:\Windows\SysWOW64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:5172
                • C:\Windows\syswow64\NET.exe
                  "NET" STOP AteraAgent
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5916
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 STOP AteraAgent
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:6132
                • C:\Windows\syswow64\TaskKill.exe
                  "TaskKill.exe" /f /im AteraAgent.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  PID:3748
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Windows\Installer\MSI28E8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240724187 510 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                  3⤵
                  • Blocklisted process makes network request
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5352
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                2⤵
                • Drops file in System32 directory
                PID:848
              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="114a7b02-01f7-461d-920b-a22e85758eec"
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5668
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:1872
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4884
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:400
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "911a4fcf-528b-4235-9cb4-af39c8d3ef10" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000NSqg2IAD
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                PID:2268
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "d5564b24-2676-45a1-836e-5b7f8c309faa" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000NSqg2IAD
                2⤵
                • Executes dropped EXE
                PID:4568
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "d36e1e7f-69d6-49a0-a3c2-70f9874bc3b9" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000NSqg2IAD
                2⤵
                • Executes dropped EXE
                PID:3988
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "bfe550ff-06bb-4a28-89ff-d176318ddbb2" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000NSqg2IAD
                2⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:208
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4764
                  • C:\Windows\system32\cscript.exe
                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                    4⤵
                    • Modifies data under HKEY_USERS
                    PID:3352
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "fba85c01-965e-4832-bc8f-cef686d55c09" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000NSqg2IAD
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4284
                • C:\Windows\TEMP\SplashtopStreamer.exe
                  "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:3148
                  • C:\Windows\Temp\unpack\PreVerCheck.exe
                    "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2080
                    • C:\Windows\SysWOW64\msiexec.exe
                      msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3892
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "5348d6e0-351d-4409-a8ff-d678ef0878ef" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000NSqg2IAD
                2⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3404
            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
              1⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:852
              • C:\Windows\System32\sc.exe
                "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                2⤵
                • Launches sc.exe
                PID:3488
              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "a0c1c055-7190-4dc2-810e-733ae8cd65a0" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000NSqg2IAD
                2⤵
                • Modifies data under HKEY_USERS
                PID:4892
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                  3⤵
                    PID:1924
                    • C:\Windows\system32\cscript.exe
                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                      4⤵
                      • Modifies data under HKEY_USERS
                      PID:516
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "34c448e6-d442-4053-b2ef-64b25170095d" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000NSqg2IAD
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1804
                  • C:\Windows\SYSTEM32\msiexec.exe
                    "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:1372
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "a9778802-31db-40f3-ac1f-fe8f4c9c13ec" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000NSqg2IAD
                  2⤵
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4576
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "25af8337-6a61-4762-b40b-c22ffdb9bb7c" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000NSqg2IAD
                  2⤵
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5204
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "42b3141f-dfbf-454e-93b6-ff79199f5fb7" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000NSqg2IAD
                  2⤵
                  • Drops file in System32 directory
                  PID:5704
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "23d3affd-0860-4ba1-8dcd-5f52830f8e98" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NSqg2IAD
                  2⤵
                  • Drops file in System32 directory
                  PID:5960
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "16e888be-8727-4637-bcb7-1647f1bb3794" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000NSqg2IAD
                  2⤵
                  • Drops file in System32 directory
                  PID:928
                • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                  "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "43a5ec5b-32f2-4997-be7a-395a00feb533" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000NSqg2IAD
                  2⤵
                    PID:5576
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "e20d4e91-9be3-4ab0-a687-c23512676bbe" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000NSqg2IAD
                    2⤵
                    • Drops file in System32 directory
                    PID:5412
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                      3⤵
                      • System Time Discovery
                      PID:4336
                      • C:\Program Files\dotnet\dotnet.exe
                        dotnet --list-runtimes
                        4⤵
                        • System Time Discovery
                        PID:5352
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "faa50a5d-e298-4a3e-b40c-03e64487c485" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000NSqg2IAD
                    2⤵
                    • Drops file in System32 directory
                    PID:5840
                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "71e057fa-bb5b-404c-961e-93b11cbe521d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000NSqg2IAD
                    2⤵
                      PID:6108
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "eb913b87-7b96-4638-8103-3425016f0eb4" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000NSqg2IAD
                      2⤵
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Modifies data under HKEY_USERS
                      PID:3084
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "1f6d4e9f-38b7-43c2-bd35-37ceb9120b1d" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000NSqg2IAD
                      2⤵
                      • Writes to the Master Boot Record (MBR)
                      PID:1200
                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "3cd53402-f135-4e96-be21-b3baf42fdab8" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000NSqg2IAD
                      2⤵
                        PID:5156
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=89a22c225604d904e054c6e63ad9c707&rmm_session_pwd_ttl=86400"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4740
                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                      1⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4128
                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4500
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                          -h
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:5720
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5948
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                            4⤵
                              PID:1208
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:5004
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5532
                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                              SRUtility.exe -r
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:656
                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:5192
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                              4⤵
                                PID:3504
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ver
                                  5⤵
                                    PID:796
                                  • C:\Windows\system32\sc.exe
                                    sc query ddmgr
                                    5⤵
                                    • Launches sc.exe
                                    PID:5916
                                  • C:\Windows\system32\sc.exe
                                    sc query lci_proxykmd
                                    5⤵
                                    • Launches sc.exe
                                    PID:5824
                                  • C:\Windows\system32\rundll32.exe
                                    rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                    5⤵
                                    • Drops file in System32 directory
                                    • Drops file in Windows directory
                                    • Checks SCSI registry key(s)
                                    • Modifies data under HKEY_USERS
                                    PID:5984
                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                            1⤵
                            • Drops file in Program Files directory
                            • Modifies data under HKEY_USERS
                            PID:5768
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                              2⤵
                              • Launches sc.exe
                              PID:4080
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "d38c620c-249e-4afc-b2ec-afe32b30083f" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000NSqg2IAD
                              2⤵
                                PID:4872
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  3⤵
                                    PID:6116
                                    • C:\Windows\system32\cscript.exe
                                      cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                      4⤵
                                      • Modifies data under HKEY_USERS
                                      PID:5320
                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "e4995853-d8f4-463d-800e-37ce50bc3f30" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NSqg2IAD
                                  2⤵
                                    PID:2688
                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "6ec7b9a6-cefc-4822-94c5-9086635b8e62" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000NSqg2IAD
                                    2⤵
                                      PID:3828
                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "2be63a57-2f5d-4c93-8572-f31e507f673c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000NSqg2IAD
                                      2⤵
                                        PID:1260
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "fd180f63-3e82-4d22-9612-ff92a9dbfc04" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000NSqg2IAD
                                        2⤵
                                        • Drops file in Program Files directory
                                        PID:1464
                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "674c673d-3791-43fd-887b-bcd12cbc452f" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000NSqg2IAD
                                        2⤵
                                          PID:5272
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "69e159eb-10b9-4c2e-aa3c-c40e8138223e" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000NSqg2IAD
                                          2⤵
                                          • Writes to the Master Boot Record (MBR)
                                          PID:2088
                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "c34b4a7a-2ed4-4be0-b8e3-5e49bf31263c" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000NSqg2IAD
                                          2⤵
                                            PID:5836
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                              3⤵
                                              • System Time Discovery
                                              PID:6976
                                              • C:\Program Files\dotnet\dotnet.exe
                                                dotnet --list-runtimes
                                                4⤵
                                                • System Time Discovery
                                                PID:5860
                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "fa9895a9-befb-456f-b37f-4d628db16bae" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000NSqg2IAD
                                            2⤵
                                              PID:5468
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "779072e9-a59e-4636-9a94-69c3a08128ee" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000NSqg2IAD
                                              2⤵
                                                PID:5256
                                                • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                  "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=89a22c225604d904e054c6e63ad9c707&rmm_session_pwd_ttl=86400"
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6524
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "88051d74-d1ee-4d99-9f6e-95ba60bf4a11" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000NSqg2IAD
                                                2⤵
                                                  PID:5880
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "a9c9af80-8158-450c-a899-9adb73576502" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000NSqg2IAD
                                                  2⤵
                                                  • Modifies registry class
                                                  PID:6412
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "317d383c-52e7-4960-9931-c9f9502db581" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000NSqg2IAD
                                                  2⤵
                                                    PID:6548
                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" d8d70b48-6633-4871-8f15-a15d5b324425 "6022befd-3e2d-4b5e-912e-16500ba49b08" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000NSqg2IAD
                                                    2⤵
                                                      PID:6160
                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "d8d70b48-6633-4871-8f15-a15d5b324425" "6022befd-3e2d-4b5e-912e-16500ba49b08" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000NSqg2IAD"
                                                        3⤵
                                                          PID:5024
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                      1⤵
                                                      • Drops file in Windows directory
                                                      • Checks SCSI registry key(s)
                                                      PID:5580
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "000000000000010C" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:4584
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000160" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                        2⤵
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        • Modifies data under HKEY_USERS
                                                        PID:5212
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000154"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Drops file in System32 directory
                                                        • Checks SCSI registry key(s)
                                                        PID:4356
                                                      • C:\Windows\system32\DrvInst.exe
                                                        DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                        2⤵
                                                        • Drops file in Drivers directory
                                                        • Drops file in Windows directory
                                                        • Checks SCSI registry key(s)
                                                        PID:5644

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Event Triggered Execution

                                                    2
                                                    T1546

                                                    Component Object Model Hijacking

                                                    1
                                                    T1546.015

                                                    Installer Packages

                                                    1
                                                    T1546.016

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Privilege Escalation

                                                    Event Triggered Execution

                                                    2
                                                    T1546

                                                    Component Object Model Hijacking

                                                    1
                                                    T1546.015

                                                    Installer Packages

                                                    1
                                                    T1546.016

                                                    Defense Evasion

                                                    Modify Registry

                                                    1
                                                    T1112

                                                    Pre-OS Boot

                                                    1
                                                    T1542

                                                    Bootkit

                                                    1
                                                    T1542.003

                                                    Subvert Trust Controls

                                                    1
                                                    T1553

                                                    Install Root Certificate

                                                    1
                                                    T1553.004

                                                    System Binary Proxy Execution

                                                    1
                                                    T1218

                                                    Msiexec

                                                    1
                                                    T1218.007

                                                    Credential Access

                                                    Discovery

                                                    Peripheral Device Discovery

                                                    2
                                                    T1120

                                                    Query Registry

                                                    4
                                                    T1012

                                                    System Information Discovery

                                                    3
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    System Time Discovery

                                                    1
                                                    T1124

                                                    Lateral Movement

                                                    Collection

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Config.Msi\e581a6a.rbs
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      a1fe32b6633826f178f5a3dca30ec6a9

                                                      SHA1

                                                      7c599750a3c25dba0332db87830a45be95d967c5

                                                      SHA256

                                                      43c70313199c91a8bc17d2db51208f21f3ae398aefb28f293e9863fe59e3f14f

                                                      SHA512

                                                      a068e88947b8460f4a3762d6af769c61029abf199840c1807b750f21ee8722b92787c089e88a06b6011a849b2a43fce28eacda1063fbcd714fc4e714c974608c

                                                      Download Submit

                                                    • C:\Config.Msi\e581a6f.rbs
                                                      Filesize

                                                      74KB

                                                      MD5

                                                      1ed5ab2e2f17c26eee5b380c126d57d3

                                                      SHA1

                                                      046eb54971478c38ebe7118f4f1fd34284ddce68

                                                      SHA256

                                                      66433400877237cf00e1cbf7eb452cb2bea2b54161734457e600263639ee1ef5

                                                      SHA512

                                                      e3ece5cb4c1c485e38407f086fa7285f22654f1060c1d28944c8f11b91247323542b5b5058ba50b930e1321a99ac8b3cc53296964596589d110799999092b004

                                                      Download Submit

                                                    • C:\Config.Msi\e581a71.rbs
                                                      Filesize

                                                      464B

                                                      MD5

                                                      96f0642b34c35534743142e99ecae5bd

                                                      SHA1

                                                      5bd1344c842697bde8ae6480b9d8ace1b0d7257d

                                                      SHA256

                                                      88cccb4c5f63c7363a5fadae8461733b18393e8b82edfa1d3bf13828fbef4a9e

                                                      SHA512

                                                      51142095eb7fa5dca8467204a0b00b6f9130db9527004218f3e43e4e91d0348e7c74b62236f58993f0e6efffb1eb3322bbd156b6d38c972fa38bf21da1a9d772

                                                      Download Submit

                                                    • C:\Config.Msi\e581a77.rbs
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      9a44e51704e01f74bf3da5a4d6c1fd14

                                                      SHA1

                                                      89cca0e9b035dbeeb1c01f3d87587f38d7b60f48

                                                      SHA256

                                                      c7ef1195f2865c1859827b4bee931401ed861d32d66eb8441c5b818ab0826c25

                                                      SHA512

                                                      3212e4593cd32d5a83d567f732c8db60c3e85fd76eb2c6ce6b88a0cd44f47873a575550d61bb30feff6f765fc48c2677107b0812701173c56e62937a2a21f466

                                                      Download Submit

                                                    • C:\Config.Msi\e581a7f.rbs
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      dfc07e8ba3cf76fbd9547d0c60aee463

                                                      SHA1

                                                      69402c13739ca15dab62355abb32a6799ea628bc

                                                      SHA256

                                                      9bace4360cebc865b640184e7b28ee049df64cb5cf1b676f374d2b2ed76ab338

                                                      SHA512

                                                      373a12e78086ba6f37322e8585b5ba8c7606848ce006288199bb67b8bb32fab0cd00833c4a3640c7a207feb7ef97fb4f210f3c2cee1461b512a70e2a21e61b7d

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3840b31c383fdf49bfd6740d945c9032

                                                      SHA1

                                                      a6f50164a69718bcef4664d7c47534f0d721866a

                                                      SHA256

                                                      1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                                                      SHA512

                                                      f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                      Filesize

                                                      142KB

                                                      MD5

                                                      477293f80461713d51a98a24023d45e8

                                                      SHA1

                                                      e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                      SHA256

                                                      a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                      SHA512

                                                      23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      b3bb71f9bb4de4236c26578a8fae2dcd

                                                      SHA1

                                                      1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                      SHA256

                                                      e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                      SHA512

                                                      fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                      Filesize

                                                      210KB

                                                      MD5

                                                      c106df1b5b43af3b937ace19d92b42f3

                                                      SHA1

                                                      7670fc4b6369e3fb705200050618acaa5213637f

                                                      SHA256

                                                      2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                      SHA512

                                                      616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                      Filesize

                                                      693KB

                                                      MD5

                                                      2c4d25b7fbd1adfd4471052fa482af72

                                                      SHA1

                                                      fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                      SHA256

                                                      2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                      SHA512

                                                      f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                      Filesize

                                                      157KB

                                                      MD5

                                                      242d415e238789fbc57c5ac7e8ca5d02

                                                      SHA1

                                                      09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                      SHA256

                                                      7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                      SHA512

                                                      ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                      Filesize

                                                      51KB

                                                      MD5

                                                      3180c705182447f4bcc7ce8e2820b25d

                                                      SHA1

                                                      ad6486557819a33d3f29b18d92b43b11707aae6e

                                                      SHA256

                                                      5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                      SHA512

                                                      228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                      Filesize

                                                      12B

                                                      MD5

                                                      eb053699fc80499a7185f6d5f7d55bfe

                                                      SHA1

                                                      9700472d22b1995c320507917fa35088ae4e5f05

                                                      SHA256

                                                      bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                      SHA512

                                                      d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                      Filesize

                                                      173KB

                                                      MD5

                                                      fd9df72620bca7c4d48bc105c89dffd2

                                                      SHA1

                                                      2e537e504704670b52ce775943f14bfbaf175c1b

                                                      SHA256

                                                      847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                      SHA512

                                                      47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                      Filesize

                                                      546B

                                                      MD5

                                                      158fb7d9323c6ce69d4fce11486a40a1

                                                      SHA1

                                                      29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                      SHA256

                                                      5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                      SHA512

                                                      7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                      Filesize

                                                      27KB

                                                      MD5

                                                      797c9554ec56fd72ebb3f6f6bef67fb5

                                                      SHA1

                                                      40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                      SHA256

                                                      7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                      SHA512

                                                      4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                      Filesize

                                                      214KB

                                                      MD5

                                                      01807774f043028ec29982a62fa75941

                                                      SHA1

                                                      afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                      SHA256

                                                      9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                      SHA512

                                                      33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                      Filesize

                                                      37KB

                                                      MD5

                                                      efb4712c8713cb05eb7fe7d87a83a55a

                                                      SHA1

                                                      c94d106bba77aecf88540807da89349b50ea5ae7

                                                      SHA256

                                                      30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                      SHA512

                                                      3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                      Filesize

                                                      3.4MB

                                                      MD5

                                                      e010d1f614b1a830482d3df4ba056f24

                                                      SHA1

                                                      5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                      SHA256

                                                      98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                      SHA512

                                                      727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                      Filesize

                                                      389KB

                                                      MD5

                                                      5e3252e0248b484e76fcdbf8b42a645d

                                                      SHA1

                                                      11ae92fd16ac87f6ab755911e85e263253c16516

                                                      SHA256

                                                      01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                      SHA512

                                                      540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      6b6cd35333deadeb6858afcc61880521

                                                      SHA1

                                                      97cac808cb9b7bbd6b65b1f2c478ee43afd88577

                                                      SHA256

                                                      6c5fd53910d887daab5da01218ea1c60d9c3afca1b7653b9da62a102b22edae0

                                                      SHA512

                                                      92ada30d3e24b921ae5cee35fd0111d5d2ae5f9a455b00f05d63c91486496f678172944bf7bde72083d06ac457d28c754f64afe9e32907c05ddb4a77c4910dba

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                      Filesize

                                                      196KB

                                                      MD5

                                                      680bac4393da4dafe0100d9483d3b6e4

                                                      SHA1

                                                      ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                      SHA256

                                                      c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                      SHA512

                                                      5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                      Filesize

                                                      56KB

                                                      MD5

                                                      0f33a7acb33960d1306ba418405d8264

                                                      SHA1

                                                      bc24c37727b00d514446c8b5fb6c04f36254a067

                                                      SHA256

                                                      a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                      SHA512

                                                      72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      9d1528a2ce17522f6de064ae2c2b608e

                                                      SHA1

                                                      2f1ce8b589e57ab300bb93dde176689689f75114

                                                      SHA256

                                                      11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                      SHA512

                                                      a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.3084.update
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      14ffcf07375b3952bd3f2fe52bb63c14

                                                      SHA1

                                                      ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                      SHA256

                                                      6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                      SHA512

                                                      14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                      Filesize

                                                      8KB

                                                      MD5

                                                      85131c961ac35e0493de3cb2a27668d5

                                                      SHA1

                                                      1acf272a4f21dfd7b07e8e49bcd0cb7d2e74dbbc

                                                      SHA256

                                                      b750904be2fad02ebfb041a5199cd9aedf2ca7b342eb0504be04b03abebdb0ea

                                                      SHA512

                                                      7874bdf708a2a5c7a16219031f78e80d70d5c126b4e2c5d69ddccbaec657853dd64d6665230f0cc26f137235c18bb447653e5d8b078c3ef1aa049917eedd8648

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cuninst.exe.ignore
                                                      Filesize

                                                      2B

                                                      MD5

                                                      81051bcc2cf1bedf378224b0a93e2877

                                                      SHA1

                                                      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                      SHA256

                                                      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                      SHA512

                                                      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                      Filesize

                                                      54KB

                                                      MD5

                                                      77c613ffadf1f4b2f50d31eeec83af30

                                                      SHA1

                                                      76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                      SHA256

                                                      2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                      SHA512

                                                      29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                      Filesize

                                                      334KB

                                                      MD5

                                                      b3e14504a48bed32c53ec7aab2cb2c8f

                                                      SHA1

                                                      0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                      SHA256

                                                      adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                      SHA512

                                                      e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                      Filesize

                                                      72KB

                                                      MD5

                                                      749c51599fbf82422791e0df1c1e841c

                                                      SHA1

                                                      bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                      SHA256

                                                      c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                      SHA512

                                                      f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                      Filesize

                                                      50KB

                                                      MD5

                                                      254dcbee3213189461b66e962ce8cc05

                                                      SHA1

                                                      cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                      SHA256

                                                      e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                      SHA512

                                                      7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                      Filesize

                                                      32KB

                                                      MD5

                                                      f531d3157e9ff57eea92db36c40e283e

                                                      SHA1

                                                      d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                      SHA256

                                                      30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                      SHA512

                                                      27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                      Filesize

                                                      56KB

                                                      MD5

                                                      e9794f785780945d2dde78520b9bb59f

                                                      SHA1

                                                      293cae66cedbc7385cd49819587d3d5a61629422

                                                      SHA256

                                                      0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                      SHA512

                                                      1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                      Filesize

                                                      588KB

                                                      MD5

                                                      17d74c03b6bcbcd88b46fcc58fc79a0d

                                                      SHA1

                                                      bc0316e11c119806907c058d62513eb8ce32288c

                                                      SHA256

                                                      13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                      SHA512

                                                      f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                      Download Submit

                                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                      Filesize

                                                      221B

                                                      MD5

                                                      a367bd959b19bbecb3f28724e2c68bb0

                                                      SHA1

                                                      b3e66809c5c6772abf4bb03f6e0d391b51f4c454

                                                      SHA256

                                                      c973dd20a328c292aa09e5d86436d89cfe6b34d4250e8c70dba3c4c5012e4319

                                                      SHA512

                                                      cb431cb3ae0582ef637b604d07fa05e624f86776fb42109e489e785022932cc555e8003158241c56b262494f02fb3756d0a685b1a9b4deccf3722f2263e88953

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                      Filesize

                                                      9KB

                                                      MD5

                                                      1ef7574bc4d8b6034935d99ad884f15b

                                                      SHA1

                                                      110709ab33f893737f4b0567f9495ac60c37667c

                                                      SHA256

                                                      0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                      SHA512

                                                      947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      f512536173e386121b3ebd22aac41a4e

                                                      SHA1

                                                      74ae133215345beaebb7a95f969f34a40dda922a

                                                      SHA256

                                                      a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                      SHA512

                                                      1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                      Filesize

                                                      76KB

                                                      MD5

                                                      b40fe65431b18a52e6452279b88954af

                                                      SHA1

                                                      c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                      SHA256

                                                      800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                      SHA512

                                                      e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                      Filesize

                                                      80KB

                                                      MD5

                                                      3904d0698962e09da946046020cbcb17

                                                      SHA1

                                                      edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                      SHA256

                                                      a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                      SHA512

                                                      c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                      Download Submit

                                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\db\SRAgent.sqlite3
                                                      Filesize

                                                      92KB

                                                      MD5

                                                      c5dea1e7df4febaf988bd67ce648bc5e

                                                      SHA1

                                                      35435bae8204d03a94b5676b1949d4e532b04d29

                                                      SHA256

                                                      409f3718ee57a218a401afd1cee0261f7a56d5a2cb49e9f71bc5e88a396aa8a0

                                                      SHA512

                                                      aa15bc11ea5214fad60f41d9239f0217f3346711995cc413692d25ae92f3edecadc35597dc8d731633c0eae94d630205cd1c7d195286da5880b70655d6515829

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      433B

                                                      MD5

                                                      cf5f69533151675ab4f248fbc8cdedeb

                                                      SHA1

                                                      eb736e17118ac79e341b49eb29ea04433e65e66f

                                                      SHA256

                                                      e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                      SHA512

                                                      e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                      Filesize

                                                      717B

                                                      MD5

                                                      ef0a07aec4367a64c16c581da2657aa9

                                                      SHA1

                                                      13011a5abcbadb3424fb6ecee560665556bb1d24

                                                      SHA256

                                                      f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                      SHA512

                                                      35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                      Filesize

                                                      7KB

                                                      MD5

                                                      362ce475f5d1e84641bad999c16727a0

                                                      SHA1

                                                      6b613c73acb58d259c6379bd820cca6f785cc812

                                                      SHA256

                                                      1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                      SHA512

                                                      7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                      Filesize

                                                      1.9MB

                                                      MD5

                                                      8de5a7a19d882820893d8b911c1710fb

                                                      SHA1

                                                      95cdf5855bc5e454c8944952697ab142f77124f7

                                                      SHA256

                                                      2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                      SHA512

                                                      3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      9a9b1fd85b5f1dcd568a521399a0d057

                                                      SHA1

                                                      34ed149b290a3a94260d889ba50cb286f1795fa6

                                                      SHA256

                                                      88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                      SHA512

                                                      7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                      Filesize

                                                      375KB

                                                      MD5

                                                      4a09a87d2004dac4b00687e9c9f15036

                                                      SHA1

                                                      c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                      SHA256

                                                      2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                      SHA512

                                                      f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                      Filesize

                                                      321KB

                                                      MD5

                                                      d3901e62166e9c42864fe3062cb4d8d5

                                                      SHA1

                                                      c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                      SHA256

                                                      dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                      SHA512

                                                      ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                      Filesize

                                                      814KB

                                                      MD5

                                                      9b1f97a41bfb95f148868b49460d9d04

                                                      SHA1

                                                      768031d5e877e347a249dfdeab7c725df941324b

                                                      SHA256

                                                      09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                      SHA512

                                                      9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                      Filesize

                                                      1.2MB

                                                      MD5

                                                      e74d2a16da1ddb7f9c54f72b8a25897c

                                                      SHA1

                                                      32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                      SHA256

                                                      a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                      SHA512

                                                      52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                      Filesize

                                                      11B

                                                      MD5

                                                      5eda46a55c61b07029e7202f8cf1781c

                                                      SHA1

                                                      862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                      SHA256

                                                      12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                      SHA512

                                                      4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                      Filesize

                                                      12B

                                                      MD5

                                                      5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                      SHA1

                                                      93012724e6cc0a298838aede678806e6c0c6517d

                                                      SHA256

                                                      a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                      SHA512

                                                      890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      b4a865268d5aca5f93bab91d7d83c800

                                                      SHA1

                                                      95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                      SHA256

                                                      5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                      SHA512

                                                      c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      14daace3fa71b6edb126588e1c8b8c5e

                                                      SHA1

                                                      e775d0a7b9cdf86ca4f0b593b999c617fb055c96

                                                      SHA256

                                                      9df5257ec8136a2e6ed461bb4aa10f5027a9916dcc5508666c06af163740e97a

                                                      SHA512

                                                      d371fc675410cda1b39edd8835147aad699257661c1d08b31abb713bed68144c18159dc3f8170990d003e99e02ecaf4c9c7a2e99e569a3029794a6a84310d7d2

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                      Filesize

                                                      48KB

                                                      MD5

                                                      33864401653095409afa2dbc450fcd17

                                                      SHA1

                                                      8b084deb3bb351a48caf653daa6765a1d762fd6c

                                                      SHA256

                                                      d37a817665a241f2058f18988d305e672ad44a3fef6a751b31b65c373f6300ef

                                                      SHA512

                                                      c6125c97ee0c6220c866f36b29e21b1a33076f1bc694f97e7516f3a0681d103d59c18e0e898bdac44e5d3d0dead86fdabe2d32bf2ddcb8327c5c767025716ad8

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                      Filesize

                                                      2.8MB

                                                      MD5

                                                      a7bf0da8e308248aefd69586e1f8a312

                                                      SHA1

                                                      f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                                                      SHA256

                                                      b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                                                      SHA512

                                                      e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      7805ea1a8dd15cac328b826efe38c2a9

                                                      SHA1

                                                      66ff8eafb2424717c4394bae28a8683db1244527

                                                      SHA256

                                                      7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                      SHA512

                                                      17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                      Filesize

                                                      1.1MB

                                                      MD5

                                                      6c6f85e896655a6eb726482f04c49086

                                                      SHA1

                                                      2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                      SHA256

                                                      e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                      SHA512

                                                      b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe.config
                                                      Filesize

                                                      541B

                                                      MD5

                                                      d0efb0a6d260dbe5d8c91d94b77d7acd

                                                      SHA1

                                                      e33a8c642d2a4b3af77e0c79671eab5200a45613

                                                      SHA256

                                                      7d38534766a52326a04972a47caca9c05e95169725d59ab4a995f8a498678102

                                                      SHA512

                                                      a3f1cff570201b8944780cf475b58969332c6af9bea0a6231e59443b05fc96df06a005ff05f78954dbe2fec42da207f6d26025aa558d0a30a36f0df23a44a35c

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.ini
                                                      Filesize

                                                      12B

                                                      MD5

                                                      3d66ae5ed06891e8ce75a39a24070844

                                                      SHA1

                                                      368064119835d4376727a14706c41384446183e8

                                                      SHA256

                                                      73dba8242fdb4de1393b367a239f730aca6713e6658be69f1d8992ad26479176

                                                      SHA512

                                                      c0b61f92bb61a7bf90225d1ba5a1bea0fc077c2481a2149663b546296421855ab3147c3a1f5372ebc920731624bc8578595c18ca9d138691c720fdcb86d03f8a

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                      Filesize

                                                      646KB

                                                      MD5

                                                      0e6af651f8be91dc9dde2faab59c9a77

                                                      SHA1

                                                      f199693bb55864f8497227c1c14244ff3e6e423e

                                                      SHA256

                                                      895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                                                      SHA512

                                                      fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                      Filesize

                                                      3.1MB

                                                      MD5

                                                      85e1898362165fc1315d18abb73c1b37

                                                      SHA1

                                                      289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                      SHA256

                                                      d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                      SHA512

                                                      49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                      Download Submit

                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                      Filesize

                                                      570KB

                                                      MD5

                                                      b50834694383960830cf48d9836e1108

                                                      SHA1

                                                      adc80813181b98a8296befa2960a55f939f3bfee

                                                      SHA256

                                                      370a259808052366888284b0cc4c91ff8f23e8008003959b8d0efb1adbf00cd6

                                                      SHA512

                                                      f87be933e87275b000be031aa5df7536dfd5fe9b99a607ce0904f206e074d3a0687a00654b9b78edaa2fccf3d30526e0ee5bd7dcba4a5daafd6fc60eeaaa15c5

                                                      Download Submit

                                                    • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\7bad9189346dfa438c0d5cc960ccc55e
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      b2e89027a140a89b6e3eb4e504e93d96

                                                      SHA1

                                                      f3b1b34874b73ae3032decb97ef96a53a654228f

                                                      SHA256

                                                      5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                      SHA512

                                                      93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                      Download Submit

                                                    • C:\ProgramData\chocolatey\config\chocolatey.config
                                                      Filesize

                                                      809B

                                                      MD5

                                                      8b6737800745d3b99886d013b3392ac3

                                                      SHA1

                                                      bb94da3f294922d9e8d31879f2d145586a182e19

                                                      SHA256

                                                      86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                      SHA512

                                                      654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                      Download Submit

                                                    • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                      Filesize

                                                      12KB

                                                      MD5

                                                      ed50cac7c22188c3e6911fbce2150ed0

                                                      SHA1

                                                      9af3c6d5679635763f9ada32949fba9e0f6ec887

                                                      SHA256

                                                      401e9e1be098f4529bc7413bddcb12ded91c43e93b35f693437bd79e4a13d79b

                                                      SHA512

                                                      847483c5b980e7114b4d841ed01c59df2d69b26779a83c3747aaaf298703c38d5a5e8f63d35d5803b09af67ad8084bd3176bf219dba01ecc99c9bf2c861926b4

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                      Filesize

                                                      471B

                                                      MD5

                                                      eef4d122f8bf1654f2fa39587b4bc772

                                                      SHA1

                                                      44a154a863d3284a00dd52881534b35d0eedd6d0

                                                      SHA256

                                                      90dfae0c893bcfeca726e1c5ee01121213f1bf56f365ebcd24f8a2173b6b06d6

                                                      SHA512

                                                      27402871d4e035000ac1b9259d9631cc30815fe1982f6b2d2c1d6db082e2496f8d55547f65bb2dbfd77b3521fd66fc438bed7ddc5efe90e9914cdee5e2eeb4d5

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      727B

                                                      MD5

                                                      6fd1b49ff0970cf707ca57e7b8f8bc90

                                                      SHA1

                                                      4fae66f564a7a74889ca5af56a3112875706c498

                                                      SHA256

                                                      55aa4f0c699e80ef09c0ac6c65d54c1da3f8e202067af5939cb5e9ee7a136d55

                                                      SHA512

                                                      58ba0ded323766625b1f8214f1fcfeec5bce5573a0d037da022d26dc303b1a4985e9eafcd52f50220ee2b9415cc88923003b4e7bf81be9e3b059a54fd853e57f

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      727B

                                                      MD5

                                                      c5325af001c52aca934eadbea6e052bf

                                                      SHA1

                                                      6874523550ed5a89d37835fc468701b7f5375d40

                                                      SHA256

                                                      9040f3f40aa15886f4ef60141b67e96542ac690a8fd9c9b4d52bdb0cf1b4c773

                                                      SHA512

                                                      ef90d907375d2dedaa619bff669eb4dc16862a7fb16b4e73cc92b98792e19e6389c500aacb58dfdf4d7f71cf07367d00422f754766c433035e6becc475ed89db

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                      Filesize

                                                      400B

                                                      MD5

                                                      43281894f0f33f313a6db3d533b91e88

                                                      SHA1

                                                      b45dab979b7471cb84c67bab45661ad9f4dde760

                                                      SHA256

                                                      78f17081f9509be3717d66f3a504195872bca645e925154f7342d64899873214

                                                      SHA512

                                                      c0b307c960081c4b5793b4dbb92ee490bda44a879dfd0595c60c600f2862986d8db95c4abf2218114116632230f74a1743fea099fafe1863f636b613e36a8541

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      404B

                                                      MD5

                                                      afbee7133c41efaa8af62cb2a77f25df

                                                      SHA1

                                                      a4f839db8d1897c3ba4d881e32166298f6b1d95c

                                                      SHA256

                                                      84e577b3dd6398ef8e6b9481c5270fd9133e5568348d04ff6551e4f2752f1a3f

                                                      SHA512

                                                      12bed0aa8321081317b7b5bc6b7c874b336db37a79f2a2b8a951785b62d14578a300d03f77b791a8af8234244c4946f10c1fc3b2560ecbe3b37f4ad04a1f1e51

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      412B

                                                      MD5

                                                      9053e05e13ff1778075de6549df2b781

                                                      SHA1

                                                      6eeedafdee877bdfc69dcb555b207e84446f322f

                                                      SHA256

                                                      6e2a00e4930349a4d44c68600db838f34f3534631a6430964b3302d7804158f7

                                                      SHA512

                                                      57811e7f0e247c85c40ab5b9df4ca14dc7dc8097f252b52e97c37b910c785ce68509f88fcbcf8d58f809c9ff625ae87d6b0d7ed91a39078690ee985954535c2b

                                                      Download Submit

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                      Filesize

                                                      651B

                                                      MD5

                                                      9bbfe11735bac43a2ed1be18d0655fe2

                                                      SHA1

                                                      61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                      SHA256

                                                      549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                      SHA512

                                                      a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI1B15.tmp
                                                      Filesize

                                                      509KB

                                                      MD5

                                                      88d29734f37bdcffd202eafcdd082f9d

                                                      SHA1

                                                      823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                      SHA256

                                                      87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                      SHA512

                                                      1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI1B15.tmp-\AlphaControlAgentInstallation.dll
                                                      Filesize

                                                      25KB

                                                      MD5

                                                      aa1b9c5c685173fad2dabebeb3171f01

                                                      SHA1

                                                      ed756b1760e563ce888276ff248c734b7dd851fb

                                                      SHA256

                                                      e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                      SHA512

                                                      d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI1B15.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      1a5caea6734fdd07caa514c3f3fb75da

                                                      SHA1

                                                      f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                      SHA256

                                                      cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                      SHA512

                                                      a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI2017.tmp-\CustomAction.config
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      bc17e956cde8dd5425f2b2a68ed919f8

                                                      SHA1

                                                      5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                      SHA256

                                                      e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                      SHA512

                                                      02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI2017.tmp-\Newtonsoft.Json.dll
                                                      Filesize

                                                      695KB

                                                      MD5

                                                      715a1fbee4665e99e859eda667fe8034

                                                      SHA1

                                                      e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                      SHA256

                                                      c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                      SHA512

                                                      bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                      Download Submit

                                                    • C:\Windows\Installer\MSI2913.tmp
                                                      Filesize

                                                      211KB

                                                      MD5

                                                      a3ae5d86ecf38db9427359ea37a5f646

                                                      SHA1

                                                      eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                      SHA256

                                                      c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                      SHA512

                                                      96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIA39C.tmp
                                                      Filesize

                                                      4.5MB

                                                      MD5

                                                      2207f96731ce2f9d9327c0baaf4959ef

                                                      SHA1

                                                      f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                      SHA256

                                                      e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                      SHA512

                                                      7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                      Download Submit

                                                    • C:\Windows\Installer\MSIF088.tmp-\System.Management.dll
                                                      Filesize

                                                      60KB

                                                      MD5

                                                      878e361c41c05c0519bfc72c7d6e141c

                                                      SHA1

                                                      432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                      SHA256

                                                      24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                      SHA512

                                                      59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                      Download Submit

                                                    • C:\Windows\Installer\e581a69.msi
                                                      Filesize

                                                      2.9MB

                                                      MD5

                                                      293dbededf4dee5163f25b7902df9a01

                                                      SHA1

                                                      6ac09402cc896b8e478e6af1436aa5fa6dba4ea0

                                                      SHA256

                                                      48c6727171424afc2789ed1af0197a3e700ea5039c4b7a3683724c46739f61c2

                                                      SHA512

                                                      8e2a62e80008c9c3f75ccdeacf091e7d4b6a1eaea4ad9380fc39aa75437ead00f940e2b869760dad011552189d7a086aad64e0746b833e4b2c2a171b7d47e4e8

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{0ecdec9a-da98-b443-80af-a5251c0e5889}\lci_proxywddm.cat
                                                      Filesize

                                                      12KB

                                                      MD5

                                                      8e16d54f986dbe98812fd5ec04d434e8

                                                      SHA1

                                                      8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                      SHA256

                                                      7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                      SHA512

                                                      e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{0ecdec9a-da98-b443-80af-a5251c0e5889}\lci_proxywddm.inf
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      0315a579f5afe989154cb7c6a6376b05

                                                      SHA1

                                                      e352ff670358cf71e0194918dfe47981e9ccbb88

                                                      SHA256

                                                      d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                      SHA512

                                                      c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{0ecdec9a-da98-b443-80af-a5251c0e5889}\x64\lci_proxyumd.dll
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      4dc11547a5fc28ca8f6965fa21573481

                                                      SHA1

                                                      d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                      SHA256

                                                      e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                      SHA512

                                                      bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{0ecdec9a-da98-b443-80af-a5251c0e5889}\x64\lci_proxyumd32.dll
                                                      Filesize

                                                      135KB

                                                      MD5

                                                      67ae7b2c36c9c70086b9d41b4515b0a8

                                                      SHA1

                                                      ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                      SHA256

                                                      79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                      SHA512

                                                      4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{0ecdec9a-da98-b443-80af-a5251c0e5889}\x64\lci_proxywddm.sys
                                                      Filesize

                                                      119KB

                                                      MD5

                                                      b9b0e9b4d93b18b99ece31a819d71d00

                                                      SHA1

                                                      2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                      SHA256

                                                      0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                      SHA512

                                                      465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{49854ae7-e6dd-8140-b1da-ed8883869fc6}\lci_iddcx.cat
                                                      Filesize

                                                      10KB

                                                      MD5

                                                      62458e58313475c9a3642a392363e359

                                                      SHA1

                                                      e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                      SHA256

                                                      85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                      SHA512

                                                      49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{49854ae7-e6dd-8140-b1da-ed8883869fc6}\lci_iddcx.inf
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      1cec22ca85e1b5a8615774fca59a420b

                                                      SHA1

                                                      049a651751ef38321a1088af6a47c4380f9293fc

                                                      SHA256

                                                      60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                      SHA512

                                                      0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                      Download Submit

                                                    • C:\Windows\System32\DriverStore\Temp\{49854ae7-e6dd-8140-b1da-ed8883869fc6}\x64\lci_iddcx.dll
                                                      Filesize

                                                      52KB

                                                      MD5

                                                      01e8bc64139d6b74467330b11331858d

                                                      SHA1

                                                      b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                      SHA256

                                                      148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                      SHA512

                                                      4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                      Download Submit

                                                    • C:\Windows\System32\InstallUtil.InstallLog
                                                      Filesize

                                                      1KB

                                                      MD5

                                                      bbe625903f24392c2a25bedce9fabd66

                                                      SHA1

                                                      5980c02f4570b749bcc0bed56ee9ff0dde1b1ec2

                                                      SHA256

                                                      fac60b5633a0094427f5c5916611912330def57e1418040216be71ee928d69bc

                                                      SHA512

                                                      480f79d8dfe1555431e2579b8b8fdbdbe5e0f064c316dc5caba50976436850ba6d2b413477096e97f0c5c76a21a6e38eefbf46b6e8e2f08ffe875fa3279062c6

                                                      Download Submit

                                                    • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-01-43-50.dat
                                                      Filesize

                                                      602B

                                                      MD5

                                                      829346db55cece755be55fb1ba7e2831

                                                      SHA1

                                                      5967b148a7ae715eec7346d3fef292a6824535e3

                                                      SHA256

                                                      9bace221d0abb67386abd709601ccdd516549e9101fb67aa7e824fb3ce803b74

                                                      SHA512

                                                      4c0d982acf35ff349415b7586f551f7afa8a6839b5ff7566e5f9de77c34963fb86dd4db06dd37d78ea9a8185f1dea78d76a4b72d388de5f5346d52758e295131

                                                      Download Submit

                                                    • C:\Windows\Temp\InstallUtil.log
                                                      Filesize

                                                      4KB

                                                      MD5

                                                      aec1f9fba8233e9889278a70c33d1d81

                                                      SHA1

                                                      ab0aea6ab84398a6d42bd6b5748b57d258a40bd4

                                                      SHA256

                                                      7d3d36372a9a46ab9b2d4fab2e21c64d8cf6d152fbd35e3d339faf8862e0cfbb

                                                      SHA512

                                                      c439ad596e922c9668b85f3f638572563a78b9d171f7be77b8aba4e874e4700a2c57700cf84ed7fcea7479fcfa73908523d399fbe76e95df656f0ef62a135356

                                                      Download Submit

                                                    • C:\Windows\Temp\PreVer.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      e2efa2c6264cd23c08f0560dc79f141d

                                                      SHA1

                                                      a2997e53175a0e785bf1ccc0776028dead38a1ba

                                                      SHA256

                                                      55d9294ae19ca71eb3e6c8d19f806a412c05fb50a16a00e7fe9ae5a57978a538

                                                      SHA512

                                                      f2a4622c9dfff572c2998d79c3b4983f64036b37e7d671179b3782bc757a0a4ec46da4b1145c81e9b6fbade204a67e77febddfb2b814ed9ea5d86e8a97193d8c

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack.log
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      eb70703253784ebdeb5dff13816bcac2

                                                      SHA1

                                                      a5e9696c71b73e6fe7ad35eece4baf0ab4e3bf72

                                                      SHA256

                                                      fd422308f29099d2cc32a04fc5d3733a2c0504639be401058d62d471010510af

                                                      SHA512

                                                      2eefc594b05c042bb88cb2c9949d0f2a176775e1ed2f44d05536f971fc16110c1331a7332ba499d3960a5de5ffff67dfe43371933863d95e4b19290063b815a2

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack.log
                                                      Filesize

                                                      3KB

                                                      MD5

                                                      975ed21c62df1bdc37fee9dc567d5d69

                                                      SHA1

                                                      638b01fa82a1d3a86190eb7f7b31cdd34462a70f

                                                      SHA256

                                                      474c0c19e7d31d663fba1180832a043ce8440205b6c8d0dcbfdc22c1551ad35c

                                                      SHA512

                                                      62fd2646022afe20f7ca0f80ff440328aba667fa1e0fa08b6b283841b3e1d3bd86c59bc22ef2e40a9af5c6278f947475e61d2e8474b7226dfec9b8e327da49c3

                                                      Download Submit

                                                    • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                      Filesize

                                                      3.2MB

                                                      MD5

                                                      a7ce785b6cd1c9657040ca9b6cbeed10

                                                      SHA1

                                                      4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                      SHA256

                                                      7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                      SHA512

                                                      39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                      Download Submit

                                                    • C:\Windows\Temp\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\IsConfig.ini
                                                      Filesize

                                                      571B

                                                      MD5

                                                      38370175ce7d8dd5c3581030a9104259

                                                      SHA1

                                                      bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                      SHA256

                                                      ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                      SHA512

                                                      e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                      Download Submit

                                                    • C:\Windows\Temp\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\String1033.txt
                                                      Filesize

                                                      182KB

                                                      MD5

                                                      37a2c4ef0ff41955f1cb884b7790699f

                                                      SHA1

                                                      8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                      SHA256

                                                      6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                      SHA512

                                                      fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                      Download Submit

                                                    • C:\Windows\Temp\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\_is947C.exe
                                                      Filesize

                                                      179KB

                                                      MD5

                                                      7a1c100df8065815dc34c05abc0c13de

                                                      SHA1

                                                      3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                      SHA256

                                                      e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                      SHA512

                                                      bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                      Download Submit

                                                    • C:\Windows\Temp\{25EC7280-57B3-4F56-8776-B72BD1EBAB53}\setup.inx
                                                      Filesize

                                                      345KB

                                                      MD5

                                                      0376dd5b7e37985ea50e693dc212094c

                                                      SHA1

                                                      02859394164c33924907b85ab0aaddc628c31bf1

                                                      SHA256

                                                      c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                      SHA512

                                                      69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                      Download Submit

                                                    • C:\Windows\Temp\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\ISRT.dll
                                                      Filesize

                                                      427KB

                                                      MD5

                                                      85315ad538fa5af8162f1cd2fce1c99d

                                                      SHA1

                                                      31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                      SHA256

                                                      70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                      SHA512

                                                      877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                      Download Submit

                                                    • C:\Windows\Temp\{2B744FA6-62B4-46A4-B3F2-CEEE711BB212}\_isres_0x0409.dll
                                                      Filesize

                                                      1.8MB

                                                      MD5

                                                      befe2ef369d12f83c72c5f2f7069dd87

                                                      SHA1

                                                      b89c7f6da1241ed98015dc347e70322832bcbe50

                                                      SHA256

                                                      9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                      SHA512

                                                      760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                      Download Submit

                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                      Filesize

                                                      404B

                                                      MD5

                                                      6beb81a39ef0fb0eaf41255a5939e153

                                                      SHA1

                                                      f6594af5b1568cd0f2dfaeaf33ff06428b9f3467

                                                      SHA256

                                                      a707786ff2a9aa5ac164dbe99fbe55a3757e38e598041babacb5dda026c438aa

                                                      SHA512

                                                      f0820b0deb3fd38c2db2706650c59275296b847c7089874835e518c3abe7cb4d291babf905239ae8776eec941854a107b0bca1f75b88ec64a5233d34978e5826

                                                      Download Submit

                                                    • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                      Filesize

                                                      412B

                                                      MD5

                                                      afb88e9e2398e8d87d9df2bff8542b77

                                                      SHA1

                                                      0dff899ef7576efbb5cabf6a14048f3408594375

                                                      SHA256

                                                      176545b1db606ba653b827fffcb1ba30bdeb85fc594334efe65529eba357e6ef

                                                      SHA512

                                                      9db4d93466f9515debc4cb6fe03788c034ca2641e1591cebd7c196ab6116cfee484eb823e4ad7e08936e1e14ae2f5020ce4fba3ca828c67e62a7a566413cdded

                                                      Download Submit

                                                    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                      Filesize

                                                      24.1MB

                                                      MD5

                                                      f26bfb6e807421725d58d4d41c99d559

                                                      SHA1

                                                      546909d16a549d6ca9ae2f22ad60d3ca4b20dcd8

                                                      SHA256

                                                      3de5494387c2ec0739446eb508b23604764f352197bd12aff91a5969b4cadd0d

                                                      SHA512

                                                      acbd544f10282715e10d520e03848c5629ba39288c815f9cc93a01da8d7dcef87eae38f2797cec3251921255e379f274b09d4eddb92cd1f74b61af5510cdfdd2

                                                      Download Submit

                                                    • \??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c78a5744-b415-4066-8826-1f9e4bbda7d8}_OnDiskSnapshotProp
                                                      Filesize

                                                      6KB

                                                      MD5

                                                      46d746d9665c89f275a9eb7fff36d26a

                                                      SHA1

                                                      314a2c56eee7c9c9678f460db8c78f3c30969fbd

                                                      SHA256

                                                      9ecbf9ed9045906ed7674c48c55f6bbb30b31a891c9b7039baea5479a3da9095

                                                      SHA512

                                                      16fcca3cf0544a69a5145f1856156241bff88d35fb3ced471a3e30a1df457ffb91b782d46a3e46688dede1eb0051cb244399985ef83ff8ab6fde32020b62d41f

                                                      Download Submit

                                                    • memory/928-1768-0x0000022E67DA0000-0x0000022E67DBC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/928-1745-0x0000022E4ED60000-0x0000022E4ED6C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/928-1753-0x0000022E67DD0000-0x0000022E67E1A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/1804-1172-0x000001ED3B520000-0x000001ED3B5D2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/1804-1422-0x000001ED54850000-0x000001ED548A4000-memory.dmp

                                                      Filesize

                                                      336KB

                                                      Download

                                                    • memory/1804-110-0x00000000052E0000-0x0000000005346000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/1804-1167-0x000001ED3AAB0000-0x000001ED3AAC2000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/1804-1171-0x000001ED3B410000-0x000001ED3B42C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/2232-80-0x0000000004B10000-0x0000000004E64000-memory.dmp

                                                      Filesize

                                                      3.3MB

                                                      Download

                                                    • memory/2232-79-0x00000000049D0000-0x00000000049F2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/2232-76-0x0000000004A50000-0x0000000004B02000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/2640-160-0x0000019BD0810000-0x0000019BD08A8000-memory.dmp

                                                      Filesize

                                                      608KB

                                                      Download

                                                    • memory/2640-165-0x0000019BD07B0000-0x0000019BD07EC000-memory.dmp

                                                      Filesize

                                                      240KB

                                                      Download

                                                    • memory/2640-148-0x0000019BB6220000-0x0000019BB6248000-memory.dmp

                                                      Filesize

                                                      160KB

                                                      Download

                                                    • memory/2640-164-0x0000019BB7E00000-0x0000019BB7E12000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/2716-1092-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/2716-523-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/2716-911-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/2716-492-0x00000000035A0000-0x0000000003767000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/2716-1053-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/2716-914-0x00000000035E0000-0x00000000037A7000-memory.dmp

                                                      Filesize

                                                      1.8MB

                                                      Download

                                                    • memory/2716-489-0x0000000010000000-0x0000000010114000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/3084-1774-0x0000023F583A0000-0x0000023F58452000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/3084-1770-0x0000023F3FA70000-0x0000023F3FA80000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/3084-1777-0x0000023F3FAC0000-0x0000023F3FAE0000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/3084-1769-0x0000023F3F230000-0x0000023F3F242000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/3404-361-0x000002152C8A0000-0x000002152C952000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/3404-353-0x0000021513380000-0x00000215133E4000-memory.dmp

                                                      Filesize

                                                      400KB

                                                      Download

                                                    • memory/3404-358-0x00000215137D0000-0x00000215137D8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/3404-359-0x00000215137F0000-0x00000215137FA000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/3404-360-0x000002152C7C0000-0x000002152C89C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/3404-362-0x000002152C6E0000-0x000002152C6E8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/3404-356-0x000002152C500000-0x000002152C54C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                      Download

                                                    • memory/3404-357-0x000002152C590000-0x000002152C5D8000-memory.dmp

                                                      Filesize

                                                      288KB

                                                      Download

                                                    • memory/3404-363-0x000002152C6F0000-0x000002152C6F8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/3404-368-0x000002152C710000-0x000002152C736000-memory.dmp

                                                      Filesize

                                                      152KB

                                                      Download

                                                    • memory/3404-367-0x000002152D600000-0x000002152D63A000-memory.dmp

                                                      Filesize

                                                      232KB

                                                      Download

                                                    • memory/3404-355-0x00000215137B0000-0x00000215137CC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/3404-365-0x000002152C960000-0x000002152C9C8000-memory.dmp

                                                      Filesize

                                                      416KB

                                                      Download

                                                    • memory/3404-366-0x000002152C740000-0x000002152C76A000-memory.dmp

                                                      Filesize

                                                      168KB

                                                      Download

                                                    • memory/3404-354-0x000002152C460000-0x000002152C4AA000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/3404-364-0x000002152C700000-0x000002152C708000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/4284-311-0x0000025E9A400000-0x0000025E9A416000-memory.dmp

                                                      Filesize

                                                      88KB

                                                      Download

                                                    • memory/4284-312-0x0000025EB3560000-0x0000025EB3612000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/4284-313-0x0000025E9AC80000-0x0000025E9AC9C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/4500-2541-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/4500-2542-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/4500-1175-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/4500-1176-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/4568-288-0x000001DF1F280000-0x000001DF1F330000-memory.dmp

                                                      Filesize

                                                      704KB

                                                      Download

                                                    • memory/4568-289-0x000001DF069F0000-0x000001DF06A0C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/4568-286-0x000001DF06170000-0x000001DF061A0000-memory.dmp

                                                      Filesize

                                                      192KB

                                                      Download

                                                    • memory/4576-1377-0x000001E79F2A0000-0x000001E79F2E8000-memory.dmp

                                                      Filesize

                                                      288KB

                                                      Download

                                                    • memory/4576-1336-0x000001E786140000-0x000001E78617A000-memory.dmp

                                                      Filesize

                                                      232KB

                                                      Download

                                                    • memory/4576-1754-0x000001E7A0100000-0x000001E7A0128000-memory.dmp

                                                      Filesize

                                                      160KB

                                                      Download

                                                    • memory/4576-1750-0x000001E79F2F0000-0x000001E79F300000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/4576-1344-0x000001E79F230000-0x000001E79F24C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/4576-1343-0x000001E79F350000-0x000001E79F402000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/4832-43-0x0000000005160000-0x000000000516C000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/4832-39-0x0000000005120000-0x000000000514E000-memory.dmp

                                                      Filesize

                                                      184KB

                                                      Download

                                                    • memory/4884-241-0x000001AD6CC80000-0x000001AD6CCB8000-memory.dmp

                                                      Filesize

                                                      224KB

                                                      Download

                                                    • memory/4884-196-0x000001AD6C670000-0x000001AD6C692000-memory.dmp

                                                      Filesize

                                                      136KB

                                                      Download

                                                    • memory/4884-192-0x000001AD6C780000-0x000001AD6C832000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5204-1341-0x00000211F7CC0000-0x00000211F7D72000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5204-1342-0x00000211DF480000-0x00000211DF4A0000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/5204-1339-0x00000211DEAD0000-0x00000211DEADC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                      Download

                                                    • memory/5204-1340-0x00000211DF460000-0x00000211DF478000-memory.dmp

                                                      Filesize

                                                      96KB

                                                      Download

                                                    • memory/5412-1783-0x0000019256830000-0x00000192568E2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5412-1763-0x000001923DD80000-0x000001923DD9C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5412-1761-0x000001923DDC0000-0x000001923DE0A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/5412-1760-0x000001923D530000-0x000001923D542000-memory.dmp

                                                      Filesize

                                                      72KB

                                                      Download

                                                    • memory/5576-1757-0x000001CACF900000-0x000001CACF920000-memory.dmp

                                                      Filesize

                                                      128KB

                                                      Download

                                                    • memory/5576-1748-0x000001CACF450000-0x000001CACF460000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5576-1762-0x000001CAE8590000-0x000001CAE8642000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5576-1775-0x000001CAE84D0000-0x000001CAE84E4000-memory.dmp

                                                      Filesize

                                                      80KB

                                                      Download

                                                    • memory/5576-1771-0x000001CAE90D0000-0x000001CAE9136000-memory.dmp

                                                      Filesize

                                                      408KB

                                                      Download

                                                    • memory/5704-1531-0x00000202BDD10000-0x00000202BDD5A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/5704-1717-0x00000202BD840000-0x00000202BD84A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/5704-1782-0x00000202D68C0000-0x00000202D6922000-memory.dmp

                                                      Filesize

                                                      392KB

                                                      Download

                                                    • memory/5704-1744-0x00000202D65F0000-0x00000202D663A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/5704-1502-0x00000202BD440000-0x00000202BD474000-memory.dmp

                                                      Filesize

                                                      208KB

                                                      Download

                                                    • memory/5704-1779-0x00000202D69A0000-0x00000202D6A7C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/5704-1778-0x00000202D6800000-0x00000202D68B2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5704-1785-0x00000202D6760000-0x00000202D677C000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5704-1714-0x00000202BDCE0000-0x00000202BDCF8000-memory.dmp

                                                      Filesize

                                                      96KB

                                                      Download

                                                    • memory/5704-1664-0x00000202BDCC0000-0x00000202BDCDC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5720-1654-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5720-2075-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5720-2897-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5720-2752-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5720-2076-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5720-2896-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5720-1653-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5720-2751-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5840-1767-0x000002A37A3E0000-0x000002A37A3FC000-memory.dmp

                                                      Filesize

                                                      112KB

                                                      Download

                                                    • memory/5840-1776-0x000002A37A6B0000-0x000002A37A78C000-memory.dmp

                                                      Filesize

                                                      880KB

                                                      Download

                                                    • memory/5840-1784-0x000002A37A410000-0x000002A37A418000-memory.dmp

                                                      Filesize

                                                      32KB

                                                      Download

                                                    • memory/5840-1759-0x000002A37A430000-0x000002A37A47A000-memory.dmp

                                                      Filesize

                                                      296KB

                                                      Download

                                                    • memory/5840-1749-0x000002A3613A0000-0x000002A3613B0000-memory.dmp

                                                      Filesize

                                                      64KB

                                                      Download

                                                    • memory/5840-1780-0x000002A37A790000-0x000002A37A842000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5948-2636-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5948-1652-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download

                                                    • memory/5948-1650-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5948-2635-0x0000000072D40000-0x0000000072E5C000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                      Download

                                                    • memory/5960-1663-0x0000021A2CDD0000-0x0000021A2CDEA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                      Download

                                                    • memory/5960-1747-0x0000021A45C10000-0x0000021A45CC2000-memory.dmp

                                                      Filesize

                                                      712KB

                                                      Download

                                                    • memory/5960-1781-0x0000021A46290000-0x0000021A467B8000-memory.dmp

                                                      Filesize

                                                      5.2MB

                                                      Download

                                                    • memory/5960-1649-0x0000021A2CA00000-0x0000021A2CA0A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                      Download

                                                    • memory/6524-3322-0x00000000727A0000-0x0000000072B6D000-memory.dmp

                                                      Filesize

                                                      3.8MB

                                                      Download