Overview

overview

10

Static

static

10

19112024_0...DF.msi

windows7-x64

10

19112024_0...DF.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    298s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 09:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19112024_0932_AlvarapendenciasPDF.msi

  • Size

    2.9MB

  • MD5

    7dce94e4f95426c4c228e5353dc65c70

  • SHA1

    f1016eca6ceea32d1ab3d8321d858a98389a5e8d

  • SHA256

    c657d96ae4fab5d3c69a0646f11f2b75ad88b8b3e842059508a7ffee4e39b7c0

  • SHA512

    3ee1f62abfaff194933549308e8885b7ad0e39e2e61384b2c9e6ea716eb5179ccf49103003588ebf98d2362bc5d06cf7c966ba61d592e832edeb3c17da4d7fd5

  • SSDEEP

    49152:A+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:A+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationratupx

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Drops file in Drivers directory 6 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\19112024_0932_AlvarapendenciasPDF.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3004
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4380
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 1EE57A33BD1CA5800251629D3E9E0766
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI1C6C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240655828 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4272
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI21BD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240656843 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2272
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2B72.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240659406 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
          3⤵
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5096
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI3E72.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240664187 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
          3⤵
          • Blocklisted process makes network request
          • Drops file in Windows directory
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4020
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 89FC2EBAB4088E6F4632E9D237743CF9 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Windows\SysWOW64\NET.exe
          "NET" STOP AteraAgent
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP AteraAgent
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4392
        • C:\Windows\SysWOW64\TaskKill.exe
          "TaskKill.exe" /f /im AteraAgent.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:628
      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="001Q300000NPO1xIAH" /AgentId="8762644e-dd86-4739-94ea-867e5b1721a2"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:4272
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 885F8552048B1E1DD22FDDD1D17EAD41 E Global\MSI0000
        2⤵
        • Blocklisted process makes network request
        • Drops file in System32 directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3D35331E-2DFF-4888-A3E8-940B359238D3}
          3⤵
          • Executes dropped EXE
          PID:3592
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9AEB6E78-C278-4293-9671-3177970A3CEB}
          3⤵
          • Executes dropped EXE
          PID:2868
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B4455F60-94AB-4488-8A8E-0E0CDFED6E37}
          3⤵
          • Executes dropped EXE
          PID:1812
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D2F485D4-1B10-4445-9150-B581C3DFE941}
          3⤵
          • Executes dropped EXE
          PID:208
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9BDCF32D-A03A-4067-8FD3-060B9209593E}
          3⤵
          • Executes dropped EXE
          PID:1476
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1D556E5F-EACA-4F50-8A52-5B44676DEEF6}
          3⤵
          • Executes dropped EXE
          PID:2524
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F2BC274D-2D08-4F7D-8490-F9A33DD09AED}
          3⤵
          • Executes dropped EXE
          PID:2380
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DAE96313-921A-4E40-8DF9-F6001C637E79}
          3⤵
          • Executes dropped EXE
          PID:2144
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{583365B5-6182-4DA6-8A05-59044D9B6888}
          3⤵
          • Executes dropped EXE
          PID:2440
        • C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe
          C:\Windows\TEMP\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isB011.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA6ACF53-05D7-4EB3-8DAC-871E37AB52DE}
          3⤵
          • Executes dropped EXE
          PID:744
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4224
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRServer.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1604
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3176
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRApp.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3624
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAppPB.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1476
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2768
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeature.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2340
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:60
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRFeatMini.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2440
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5092
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRManager.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3132
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2720
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAgent.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:440
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2656
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRAudioChat.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4700
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2032
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill.exe /F /IM SRVirtualDisplay.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2680
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B693B09B-0111-41C7-8699-F35B493AD914}
          3⤵
          • Executes dropped EXE
          PID:1736
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2F4610B8-1DA5-4737-9719-E4FC66AF1DEE}
          3⤵
          • Executes dropped EXE
          PID:4172
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CECA5C11-BC6C-45BF-8A80-D75E3BD95021}
          3⤵
          • Executes dropped EXE
          PID:812
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BFA8DD78-1712-4E8D-A8CB-2CD93E5674C0}
          3⤵
          • Executes dropped EXE
          PID:208
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3AA24701-4C0A-4F64-AA76-A53EAA0E470A}
          3⤵
          • Executes dropped EXE
          PID:3908
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FADA7DD1-0BD0-4E14-A973-E13D478863DB}
          3⤵
          • Executes dropped EXE
          PID:2700
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B77E3FA3-74B5-4083-A8A4-B8C76B85996C}
          3⤵
          • Executes dropped EXE
          PID:3284
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F17FF282-050F-4E9F-8EA8-4A201130DBAE}
          3⤵
          • Executes dropped EXE
          PID:3592
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{10FB8BD6-65DF-4126-B090-BE9E10012886}
          3⤵
          • Executes dropped EXE
          PID:4732
        • C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
          C:\Windows\TEMP\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9CF56F1-7C41-4459-878D-AC5DDA3979D7}
          3⤵
          • Executes dropped EXE
          PID:2524
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BA466EE5-17F6-4471-BE3E-F31906E104D8}
          3⤵
          • Executes dropped EXE
          PID:2128
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1522C782-1365-4A7C-B694-6B4E4614BDB8}
          3⤵
          • Executes dropped EXE
          PID:4856
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8018353A-034A-4C39-A361-8C7556773660}
          3⤵
          • Executes dropped EXE
          PID:2204
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2D001667-C2AB-463F-BE8C-6D408342B131}
          3⤵
          • Executes dropped EXE
          PID:2368
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FBF8D7E-CBE4-495E-84AA-1944389EEE9D}
          3⤵
          • Executes dropped EXE
          PID:4300
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{21F58C52-9615-48BE-81C7-9B715F76A054}
          3⤵
          • Executes dropped EXE
          PID:628
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA448665-E1D4-4017-ABF8-31C40414DA9C}
          3⤵
          • Executes dropped EXE
          PID:3908
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{575EA0D3-4F23-4331-8334-00F759AB4CB8}
          3⤵
          • Executes dropped EXE
          PID:976
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E6BD1C58-7F54-411E-B862-91678B079113}
          3⤵
          • Executes dropped EXE
          PID:4320
        • C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe
          C:\Windows\TEMP\{D5145A09-4A46-436F-A893-7D90185B4F33}\_isE2FA.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E9EA9636-7412-4813-9D2F-7D0294629382}
          3⤵
          • Executes dropped EXE
          PID:4156
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4336
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1892
        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4856
          • C:\Windows\system32\cmd.exe
            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
            4⤵
              PID:3448
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" im "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
              4⤵
                PID:2440
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRSelfSignCertUtil.exe" -g
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3588
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1584CEB6-D6EC-4B42-B049-E532D9E2EAD1}
              3⤵
              • Executes dropped EXE
              PID:4720
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6429D848-A6F3-4C52-9D2B-800938BC6614}
              3⤵
              • Executes dropped EXE
              PID:4184
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C8AA80A7-B371-48B3-A5A2-DB074A89AA57}
              3⤵
              • Executes dropped EXE
              PID:3276
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D3EC0558-9D3C-4B95-8AE9-392661FFEE31}
              3⤵
              • Executes dropped EXE
              PID:3468
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{721B84BC-0EAC-4375-BCDB-135493E5B54D}
              3⤵
              • Executes dropped EXE
              PID:64
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{83B9032E-9F3C-4BA1-B4A9-F0523674EAE1}
              3⤵
              • Executes dropped EXE
              PID:1384
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{75012275-7190-49FE-B513-BA86F0A67A82}
              3⤵
              • Executes dropped EXE
              PID:1944
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D86BE18-8B7E-45E8-B93D-54FC51B4EDFB}
              3⤵
              • Executes dropped EXE
              PID:2700
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EABFD82A-7E6F-40E5-B609-ADE4147559B7}
              3⤵
              • Executes dropped EXE
              PID:2956
            • C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe
              C:\Windows\TEMP\{1578C9E7-B87D-49B0-9DB8-2DB0676360AC}\_isF9E0.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E05084E5-DA01-4332-A8F6-1562FA48C9C5}
              3⤵
              • Executes dropped EXE
              PID:4216
            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
              "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -i
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4768
            • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
              C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71EF660D-7539-405C-B661-1D3C79AC7A11}
              3⤵
              • Executes dropped EXE
              PID:64
            • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
              C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC022B1A-3A38-46EA-9E9F-6B7CD6D7193B}
              3⤵
                PID:5508
              • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{00D31521-2D67-4D5D-B4E9-8B9E399CE803}
                3⤵
                  PID:5964
                • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                  C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA9EA18C-F180-4B55-812A-BF3851D6EBF5}
                  3⤵
                    PID:5336
                  • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                    C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8CAFF347-921C-42AB-A5DD-11EBBC574DAA}
                    3⤵
                      PID:5612
                    • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                      C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E7A9A984-A534-42E3-9B20-B1D37D88E87A}
                      3⤵
                        PID:5208
                      • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                        C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5E8C0259-274B-41F6-8852-5579F188F130}
                        3⤵
                          PID:5360
                        • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                          C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82A1D1AC-C6C8-4073-B78F-A7F62B535259}
                          3⤵
                            PID:6076
                          • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                            C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6AFB9037-2C33-4870-957F-5C5A722398A9}
                            3⤵
                              PID:6136
                            • C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe
                              C:\Windows\TEMP\{3910EE2B-08C9-40BA-8450-8741EA8A401A}\_is26C.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8E5F7E8-D14A-4848-BD33-E3432C608DB9}
                              3⤵
                                PID:3268
                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe" -r
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:1516
                            • C:\Windows\syswow64\MsiExec.exe
                              C:\Windows\syswow64\MsiExec.exe -Embedding CF0C6F1FD2D4A77A95F258669CFA3EE4 E Global\MSI0000
                              2⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:2848
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Windows\Installer\MSI2DCF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725515 464 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
                                3⤵
                                • Drops file in System32 directory
                                • Drops file in Windows directory
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:3044
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Windows\Installer\MSI2F28.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725796 468 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
                                3⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:5432
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Windows\Installer\MSI390C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728437 473 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
                                3⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1516
                              • C:\Windows\SysWOW64\NET.exe
                                "NET" STOP AteraAgent
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5432
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 STOP AteraAgent
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2052
                              • C:\Windows\SysWOW64\TaskKill.exe
                                "TaskKill.exe" /f /im AteraAgent.exe
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                PID:4984
                              • C:\Windows\syswow64\NET.exe
                                "NET" STOP AteraAgent
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:6020
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 STOP AteraAgent
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4164
                              • C:\Windows\syswow64\TaskKill.exe
                                "TaskKill.exe" /f /im AteraAgent.exe
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                PID:5928
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Windows\Installer\MSI667E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739953 511 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
                                3⤵
                                • Blocklisted process makes network request
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:5560
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
                              2⤵
                              • Drops file in System32 directory
                              PID:1664
                            • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="d2deb8b8-e7c6-44fd-be6f-d5d07362f290"
                              2⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              PID:5340
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                            • Checks SCSI registry key(s)
                            • Suspicious use of AdjustPrivilegeToken
                            PID:112
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                            1⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4904
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                              2⤵
                              • Launches sc.exe
                              PID:3372
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "f7924984-b51b-4ec6-befa-34cc277fa77c" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000NPO1xIAH
                              2⤵
                              • Executes dropped EXE
                              PID:4224
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "5e6a0e5a-6b2d-430a-a04f-d3ea4e07e3e8" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 001Q300000NPO1xIAH
                              2⤵
                              • Drops file in Program Files directory
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1508
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4576
                                • C:\Windows\system32\cscript.exe
                                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  4⤵
                                  • Modifies data under HKEY_USERS
                                  PID:4400
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "72c80cb2-f07e-419a-bcd4-6de37f3fe501" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 001Q300000NPO1xIAH
                              2⤵
                              • Executes dropped EXE
                              PID:628
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "99f033e3-2dac-4169-aae9-ea5ad945b0a5" agent-api.atera.com/Production 443 or8ixLi90Mf "install eyJSbW1Db2RlIjoiaFpDREZQaEs3NW1KIn0=" 001Q300000NPO1xIAH
                              2⤵
                              • Drops file in System32 directory
                              • Drops file in Program Files directory
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:4268
                              • C:\Windows\TEMP\SplashtopStreamer.exe
                                "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:32
                                • C:\Windows\Temp\unpack\PreVerCheck.exe
                                  "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                  4⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4728
                                  • C:\Windows\SysWOW64\msiexec.exe
                                    msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1144
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "b63f6383-a050-4f6a-947a-777f7785d49d" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 001Q300000NPO1xIAH
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:3040
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                            1⤵
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:1716
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                              2⤵
                              • Launches sc.exe
                              PID:1516
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "98393200-5d3c-49d8-a96a-c33e63103633" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 001Q300000NPO1xIAH
                              2⤵
                              • Executes dropped EXE
                              PID:2408
                            • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                              "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "54dcf7ed-b43b-4fd9-b5da-08652cf1490e" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000NPO1xIAH
                              2⤵
                              • Executes dropped EXE
                              PID:1448
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                3⤵
                                  PID:2144
                                  • C:\Windows\system32\cscript.exe
                                    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                    4⤵
                                    • Modifies data under HKEY_USERS
                                    PID:392
                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "ff2122eb-2783-404f-a878-4d40912a2582" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000NPO1xIAH
                                2⤵
                                • Drops file in System32 directory
                                • Drops file in Program Files directory
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2108
                                • C:\Windows\SYSTEM32\msiexec.exe
                                  "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                                  3⤵
                                    PID:5548
                                  • C:\Windows\SYSTEM32\msiexec.exe
                                    "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                                    3⤵
                                      PID:5532
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "0d6710c3-aacb-4d27-a6e0-7c08bf051a6b" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000NPO1xIAH
                                    2⤵
                                    • Drops file in System32 directory
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:628
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "98debe79-2994-4024-ad35-5cad18d28cb1" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000NPO1xIAH
                                    2⤵
                                    • Drops file in Program Files directory
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3276
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "af4894a9-46e0-4ee3-b328-11c9e90019b7" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000NPO1xIAH
                                    2⤵
                                    • Drops file in System32 directory
                                    • Executes dropped EXE
                                    PID:5840
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "ca755c2d-a7c2-4618-952e-ef1aec9aa82d" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000NPO1xIAH
                                    2⤵
                                    • Drops file in System32 directory
                                    • Executes dropped EXE
                                    PID:2596
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "d7d9a270-387b-431e-b408-23ad13f004bd" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000NPO1xIAH
                                    2⤵
                                    • Drops file in System32 directory
                                    • Executes dropped EXE
                                    PID:5080
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "dcae1ab0-5cf0-428e-8669-d9f2f116a4ec" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000NPO1xIAH
                                    2⤵
                                    • Writes to the Master Boot Record (MBR)
                                    • Loads dropped DLL
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3928
                                  • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                    "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "c435cd74-9159-4324-a404-30595e66d63a" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000NPO1xIAH
                                    2⤵
                                      PID:5220
                                    • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                      "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "b350a9a0-14d6-477d-ae44-d175d4914d4a" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NPO1xIAH
                                      2⤵
                                        PID:5656
                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "8c1d2f46-0e01-4352-8a79-79006dd652c4" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000NPO1xIAH
                                        2⤵
                                        • Drops file in System32 directory
                                        PID:5448
                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "2b2093c3-ef7c-42f3-87f6-dec2f19fc890" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000NPO1xIAH
                                        2⤵
                                        • Drops file in System32 directory
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5576
                                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "ddd5972d-7257-47a1-8485-1f2ac9a3f3b5" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000NPO1xIAH
                                        2⤵
                                        • Drops file in System32 directory
                                        PID:5404
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                          3⤵
                                          • System Time Discovery
                                          PID:3004
                                          • C:\Program Files\dotnet\dotnet.exe
                                            dotnet --list-runtimes
                                            4⤵
                                            • System Time Discovery
                                            PID:5524
                                    • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
                                      "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
                                      1⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1168
                                      • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe
                                        "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRManager.exe"
                                        2⤵
                                        • Drops file in System32 directory
                                        • Drops file in Program Files directory
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        • Modifies data under HKEY_USERS
                                        PID:5764
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
                                          -h
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2972
                                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe
                                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe"
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:6072
                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe
                                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\BdEpSDK.exe" -v
                                            4⤵
                                              PID:5404
                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe
                                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAppPB.exe"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:868
                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
                                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3480
                                            • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                              SRUtility.exe -r
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3292
                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe
                                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRVirtualDisplay.exe"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2140
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\install_driver64.bat" nosetkey
                                              4⤵
                                                PID:4328
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ver
                                                  5⤵
                                                    PID:6000
                                                  • C:\Windows\system32\sc.exe
                                                    sc query ddmgr
                                                    5⤵
                                                    • Launches sc.exe
                                                    PID:1216
                                                  • C:\Windows\system32\sc.exe
                                                    sc query lci_proxykmd
                                                    5⤵
                                                    • Launches sc.exe
                                                    PID:5140
                                                  • C:\Windows\system32\rundll32.exe
                                                    rundll32 x64\my_setup.dll do_install_lci_proxywddm
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    • Checks SCSI registry key(s)
                                                    • Modifies data under HKEY_USERS
                                                    PID:3932
                                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                                            "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                                            1⤵
                                            • Drops file in Program Files directory
                                            • Modifies data under HKEY_USERS
                                            PID:5460
                                            • C:\Windows\System32\sc.exe
                                              "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                                              2⤵
                                              • Launches sc.exe
                                              PID:5152
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "cd0c5bf8-ebe4-46cf-8775-6a6460c3cce8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NPO1xIAH
                                              2⤵
                                              • Modifies data under HKEY_USERS
                                              PID:6068
                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "c115a6c8-f3cf-4aee-bce9-ee03418827c8" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000NPO1xIAH
                                              2⤵
                                                PID:1848
                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "4a2d965c-a23c-40b1-9eba-22f0d2bd33c3" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 001Q300000NPO1xIAH
                                                2⤵
                                                  PID:4284
                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "260180f6-4c28-48b8-9aea-bfe32a422007" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 001Q300000NPO1xIAH
                                                  2⤵
                                                    PID:2412
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                      3⤵
                                                        PID:5748
                                                        • C:\Windows\system32\cscript.exe
                                                          cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                                          4⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:5332
                                                    • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                      "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "64eb7dc0-ea1c-49fa-b5af-a1f8e67ddde0" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 001Q300000NPO1xIAH
                                                      2⤵
                                                        PID:2324
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "3f20dc2d-7811-4e41-afe9-6dd994416084" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000NPO1xIAH
                                                        2⤵
                                                        • Drops file in Program Files directory
                                                        PID:6092
                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "a5df7923-7260-4641-bc6e-cc68902954a0" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 001Q300000NPO1xIAH
                                                        2⤵
                                                          PID:2236
                                                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe
                                                            "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRUtility.exe" -a "st-streamer://com.splashtop.streamer/?rmm_code=hZCDFPhK75mJ&rmm_session_pwd=fe087fc2ae2bec358b812afaed4fa2e1&rmm_session_pwd_ttl=86400"
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2932
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              4⤵
                                                                PID:4284
                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "1020bab7-e391-4803-91d6-2da09f80e154" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 001Q300000NPO1xIAH
                                                            2⤵
                                                              PID:5304
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "6d890c2b-08f3-426b-aad2-7e1b6ea28804" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000NPO1xIAH
                                                              2⤵
                                                              • Writes to the Master Boot Record (MBR)
                                                              PID:628
                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "8f319c3f-6ffe-4cf5-9048-3405924a5b39" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 001Q300000NPO1xIAH
                                                              2⤵
                                                                PID:4952
                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "2ada6cde-9ed6-4865-bb22-3895c3d84247" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 001Q300000NPO1xIAH
                                                                2⤵
                                                                  PID:832
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                                                    3⤵
                                                                    • System Time Discovery
                                                                    PID:6044
                                                                    • C:\Program Files\dotnet\dotnet.exe
                                                                      dotnet --list-runtimes
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:2856
                                                                • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                  "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "1c752ee8-a15d-46a8-b5f9-9648b0b7b906" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 001Q300000NPO1xIAH
                                                                  2⤵
                                                                    PID:1940
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "406674fb-2329-451e-b76a-c9e1f9cffa95" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 001Q300000NPO1xIAH
                                                                    2⤵
                                                                    • Modifies data under HKEY_USERS
                                                                    • Modifies registry class
                                                                    PID:4756
                                                                  • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                    "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "30e22a6c-b05a-45eb-a012-088c9ccbec34" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 001Q300000NPO1xIAH
                                                                    2⤵
                                                                      PID:3948
                                                                      • C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe
                                                                        "C:\Windows\TEMP\AteraUpgradeAgentPackage\AgentPackageUpgradeAgent.exe" "8762644e-dd86-4739-94ea-867e5b1721a2" "30e22a6c-b05a-45eb-a012-088c9ccbec34" "agent-api.atera.com/Production" "443" "or8ixLi90Mf" "checkforupdates" "001Q300000NPO1xIAH"
                                                                        3⤵
                                                                          PID:4544
                                                                      • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                        "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "cd0c5bf8-ebe4-46cf-8775-6a6460c3cce8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NPO1xIAH
                                                                        2⤵
                                                                          PID:3224
                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "cd0c5bf8-ebe4-46cf-8775-6a6460c3cce8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NPO1xIAH
                                                                          2⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:5176
                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "6d890c2b-08f3-426b-aad2-7e1b6ea28804" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 001Q300000NPO1xIAH
                                                                          2⤵
                                                                          • Writes to the Master Boot Record (MBR)
                                                                          PID:3908
                                                                        • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                          "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "cd0c5bf8-ebe4-46cf-8775-6a6460c3cce8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NPO1xIAH
                                                                          2⤵
                                                                            PID:2456
                                                                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "c115a6c8-f3cf-4aee-bce9-ee03418827c8" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 001Q300000NPO1xIAH
                                                                            2⤵
                                                                              PID:2532
                                                                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "cd0c5bf8-ebe4-46cf-8775-6a6460c3cce8" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 001Q300000NPO1xIAH
                                                                              2⤵
                                                                                PID:1032
                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                                "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" 8762644e-dd86-4739-94ea-867e5b1721a2 "3f20dc2d-7811-4e41-afe9-6dd994416084" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 001Q300000NPO1xIAH
                                                                                2⤵
                                                                                  PID:3752
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                1⤵
                                                                                • Checks SCSI registry key(s)
                                                                                PID:4984
                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                  DrvInst.exe "4" "1" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10\lci_iddcx.inf" "9" "4804066df" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\LciDisplay\win10"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:6124
                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                  DrvInst.exe "4" "1" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10\lci_proxywddm.inf" "9" "4a8a251e7" "0000000000000164" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\splashtop\splashtop remote\server\driver\lcidisplay\win10"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Drops file in Windows directory
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Modifies data under HKEY_USERS
                                                                                  PID:2808
                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c276d4b8d1e66062:lci_proxywddm.Install:1.0.2018.1204:root\lci_proxywddm," "4a8a251e7" "0000000000000154"
                                                                                  2⤵
                                                                                  • Drops file in Drivers directory
                                                                                  • Drops file in System32 directory
                                                                                  • Checks SCSI registry key(s)
                                                                                  PID:5732
                                                                                • C:\Windows\system32\DrvInst.exe
                                                                                  DrvInst.exe "1" "0" "LCI\IDDCX\1&79f5d87&0&WHO_CARE" "" "" "48ef22a9f" "0000000000000000"
                                                                                  2⤵
                                                                                  • Drops file in Drivers directory
                                                                                  • Drops file in Windows directory
                                                                                  • Checks SCSI registry key(s)
                                                                                  PID:1868

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Reconnaissance

                                                                              Resource Development

                                                                              Initial Access

                                                                              Execution

                                                                              Persistence

                                                                              Event Triggered Execution

                                                                              2
                                                                              T1546

                                                                              Component Object Model Hijacking

                                                                              1
                                                                              T1546.015

                                                                              Installer Packages

                                                                              1
                                                                              T1546.016

                                                                              Pre-OS Boot

                                                                              1
                                                                              T1542

                                                                              Bootkit

                                                                              1
                                                                              T1542.003

                                                                              Privilege Escalation

                                                                              Event Triggered Execution

                                                                              2
                                                                              T1546

                                                                              Component Object Model Hijacking

                                                                              1
                                                                              T1546.015

                                                                              Installer Packages

                                                                              1
                                                                              T1546.016

                                                                              Defense Evasion

                                                                              Modify Registry

                                                                              1
                                                                              T1112

                                                                              Pre-OS Boot

                                                                              1
                                                                              T1542

                                                                              Bootkit

                                                                              1
                                                                              T1542.003

                                                                              Subvert Trust Controls

                                                                              1
                                                                              T1553

                                                                              Install Root Certificate

                                                                              1
                                                                              T1553.004

                                                                              System Binary Proxy Execution

                                                                              1
                                                                              T1218

                                                                              Msiexec

                                                                              1
                                                                              T1218.007

                                                                              Credential Access

                                                                              Discovery

                                                                              Peripheral Device Discovery

                                                                              2
                                                                              T1120

                                                                              Query Registry

                                                                              4
                                                                              T1012

                                                                              System Information Discovery

                                                                              3
                                                                              T1082

                                                                              System Location Discovery

                                                                              1
                                                                              T1614

                                                                              System Language Discovery

                                                                              1
                                                                              T1614.001

                                                                              System Time Discovery

                                                                              1
                                                                              T1124

                                                                              Lateral Movement

                                                                              Collection

                                                                              Command and Control

                                                                              Exfiltration

                                                                              Impact

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Config.Msi\e581b64.rbs
                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                bc5206f07a4ae3ae62a4ef88590b296d

                                                                                SHA1

                                                                                7943ef88fdc263af51efa97a7efa1be5feef51bc

                                                                                SHA256

                                                                                d5fcea93b358c604730ed60d99ab05012966bd17dda9eb336c441b09b7317e91

                                                                                SHA512

                                                                                0870daeb63aac11241ad1e1121ea0856be56af03dc2e3cb4c06e8e03f4056094b6a67527294daf19e2de0679c29bab52ab0e878e4e5980147996bd2c2c6f6fdf

                                                                                Download Submit

                                                                              • C:\Config.Msi\e581b69.rbs
                                                                                Filesize

                                                                                74KB

                                                                                MD5

                                                                                83257954a218af4553a0ad6c636f41af

                                                                                SHA1

                                                                                f588c59d54cb00a9d78d58c5b8b0c8ae826a5836

                                                                                SHA256

                                                                                4870ce7eadfeb80b48e408928c0ffc886f5eb0dc91069bdb0ded0aaf82fff9c3

                                                                                SHA512

                                                                                db93c437d7e94114ead3def819aa5f72ffc6d27ae71dbdae78f7d8f83f8718bea3d8c9e7081a5810e0e52d774e4d80dd4a62b09565cb72910fa5e0e9a97da7eb

                                                                                Download Submit

                                                                              • C:\Config.Msi\e581b6b.rbs
                                                                                Filesize

                                                                                464B

                                                                                MD5

                                                                                bb6283c2bec6d374a63de2095106714f

                                                                                SHA1

                                                                                adc13fb9b834620e6f5418ada32d61eab3a16801

                                                                                SHA256

                                                                                f3b30b4fe759c3e67ebbc5cf22edbc63063dc26544b11f18af5f6aeaf67c7ed8

                                                                                SHA512

                                                                                92df2b8cc93d16c9db7509dacf9641da3f861308602bf7834288c0bd37df8fefbc1e5e908d643e46c72619f988ad0d90c069c8972048a5bdf62217ce226d5228

                                                                                Download Submit

                                                                              • C:\Config.Msi\e581b71.rbs
                                                                                Filesize

                                                                                9KB

                                                                                MD5

                                                                                75fe4f9851e3f2495ed6d1929a1f7cc9

                                                                                SHA1

                                                                                bb4901dd302ebebf3c360e58cd6bc64234dc71b1

                                                                                SHA256

                                                                                e2da0cdd8427fb0bd29a28c8eee42a63a3900f504d1e8ce328f15f0b7b1c070c

                                                                                SHA512

                                                                                b997ea75f875b2c061b9162d0519eaeb11620c654f046a5cc5d2a933e21dccc60c295e86b0305945053412e3838212a79ef7d2d20870f4c8afea4a6cbfbac7d4

                                                                                Download Submit

                                                                              • C:\Config.Msi\e581b79.rbs
                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                04841180d49c05440657fbfda983617e

                                                                                SHA1

                                                                                8ccbe94504a332245981889f52341baeb2360ad6

                                                                                SHA256

                                                                                592f92d09c75878c19b165681e7f0f528068ef8b9a6beb6452e1e178e7aff5a2

                                                                                SHA512

                                                                                eb99552ebeeca1cbb3da2b0e17894f1320ed66b3c5abe1aac9a9e364c6d36d96864b8cc109eddc7888c1f7bc404f05398a675951e94af839150ce88bcc31d07e

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                337079222a6f6c6edf58f3f981ff20ae

                                                                                SHA1

                                                                                1f705fc0faa84c69e1fe936b34783b301323e255

                                                                                SHA256

                                                                                ae56a6c4f6622b5485c46d9fde5d3db468c1bfb573b34c9f199007b5eedcbda5

                                                                                SHA512

                                                                                ae9cd225f7327da6eeea63c661b9e159d6608dff4897fb6b9651a1756d69282e8051b058a2473d9153fc87c0b54aa59b9a1a865871df693adcb267f8b0157b61

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                                                                                Filesize

                                                                                142KB

                                                                                MD5

                                                                                477293f80461713d51a98a24023d45e8

                                                                                SHA1

                                                                                e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                                                                                SHA256

                                                                                a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                                                                                SHA512

                                                                                23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                b3bb71f9bb4de4236c26578a8fae2dcd

                                                                                SHA1

                                                                                1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                                                                                SHA256

                                                                                e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                                                                                SHA512

                                                                                fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                                                                                Filesize

                                                                                210KB

                                                                                MD5

                                                                                c106df1b5b43af3b937ace19d92b42f3

                                                                                SHA1

                                                                                7670fc4b6369e3fb705200050618acaa5213637f

                                                                                SHA256

                                                                                2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                                                                                SHA512

                                                                                616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                                                                                Filesize

                                                                                693KB

                                                                                MD5

                                                                                2c4d25b7fbd1adfd4471052fa482af72

                                                                                SHA1

                                                                                fd6cd773d241b581e3c856f9e6cd06cb31a01407

                                                                                SHA256

                                                                                2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                                                                                SHA512

                                                                                f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                                                                                Filesize

                                                                                157KB

                                                                                MD5

                                                                                242d415e238789fbc57c5ac7e8ca5d02

                                                                                SHA1

                                                                                09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                                                                                SHA256

                                                                                7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                                                                                SHA512

                                                                                ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                                                                                Filesize

                                                                                51KB

                                                                                MD5

                                                                                3180c705182447f4bcc7ce8e2820b25d

                                                                                SHA1

                                                                                ad6486557819a33d3f29b18d92b43b11707aae6e

                                                                                SHA256

                                                                                5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                                                                                SHA512

                                                                                228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                                                                                Filesize

                                                                                12B

                                                                                MD5

                                                                                eb053699fc80499a7185f6d5f7d55bfe

                                                                                SHA1

                                                                                9700472d22b1995c320507917fa35088ae4e5f05

                                                                                SHA256

                                                                                bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                                                                                SHA512

                                                                                d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                                                                                Filesize

                                                                                173KB

                                                                                MD5

                                                                                fd9df72620bca7c4d48bc105c89dffd2

                                                                                SHA1

                                                                                2e537e504704670b52ce775943f14bfbaf175c1b

                                                                                SHA256

                                                                                847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                                                                                SHA512

                                                                                47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                                                                                Filesize

                                                                                546B

                                                                                MD5

                                                                                158fb7d9323c6ce69d4fce11486a40a1

                                                                                SHA1

                                                                                29ab26f5728f6ba6f0e5636bf47149bd9851f532

                                                                                SHA256

                                                                                5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                                                                                SHA512

                                                                                7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\Newtonsoft.Json.dll
                                                                                Filesize

                                                                                688KB

                                                                                MD5

                                                                                3ef8d12aa1d48dec3ac19a0ceabd4fd8

                                                                                SHA1

                                                                                c81b7229a9bd55185a0edccb7e6df3b8e25791cf

                                                                                SHA256

                                                                                18c1ddbdbf47370cc85fa2cf7ba043711ab3eadbd8da367638686dfd6b735c85

                                                                                SHA512

                                                                                0ff2e8dbfef7164b22f9ae9865e83154096971c3f0b236d988ab947e803c1ed03d86529ab80d2be9ff33af305d34c9b30082f8c26e575f0979ca9287b415f9f9

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                                                                                Filesize

                                                                                27KB

                                                                                MD5

                                                                                797c9554ec56fd72ebb3f6f6bef67fb5

                                                                                SHA1

                                                                                40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                                                                                SHA256

                                                                                7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                                                                                SHA512

                                                                                4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                                                                                Filesize

                                                                                214KB

                                                                                MD5

                                                                                01807774f043028ec29982a62fa75941

                                                                                SHA1

                                                                                afc25cf6a7a90f908c0a77f2519744f75b3140d4

                                                                                SHA256

                                                                                9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                                                                                SHA512

                                                                                33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                                                                                Filesize

                                                                                37KB

                                                                                MD5

                                                                                efb4712c8713cb05eb7fe7d87a83a55a

                                                                                SHA1

                                                                                c94d106bba77aecf88540807da89349b50ea5ae7

                                                                                SHA256

                                                                                30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                                                                                SHA512

                                                                                3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                                                                                Filesize

                                                                                3.4MB

                                                                                MD5

                                                                                e010d1f614b1a830482d3df4ba056f24

                                                                                SHA1

                                                                                5873e22b8c51a808c06a3bbf425fcf02b2a80328

                                                                                SHA256

                                                                                98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                                                                                SHA512

                                                                                727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                                                                                Filesize

                                                                                389KB

                                                                                MD5

                                                                                5e3252e0248b484e76fcdbf8b42a645d

                                                                                SHA1

                                                                                11ae92fd16ac87f6ab755911e85e263253c16516

                                                                                SHA256

                                                                                01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                                                                                SHA512

                                                                                540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                b3ec75fd8df72bd7df8f7e59669c0021

                                                                                SHA1

                                                                                9c1b8dcbeaaa0bf63d0ce9a06b34aa1db2ce7a0b

                                                                                SHA256

                                                                                c97490f9551e4fecb57956769ef3a52501de909bdb4aee0ffd8dd6922a1e0cad

                                                                                SHA512

                                                                                75f39055298fff94948802d7e7dde81cb485a6184b034720de63dfd3f5b260a418b472a02891f8bca486af4ada759b3b830a13d455051d8feec5027ae03cb0a5

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                                                                                Filesize

                                                                                196KB

                                                                                MD5

                                                                                680bac4393da4dafe0100d9483d3b6e4

                                                                                SHA1

                                                                                ed211ef61232c5aacee7ca168659f02f9d4f4e53

                                                                                SHA256

                                                                                c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                                                                                SHA512

                                                                                5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                                                                                Filesize

                                                                                56KB

                                                                                MD5

                                                                                0f33a7acb33960d1306ba418405d8264

                                                                                SHA1

                                                                                bc24c37727b00d514446c8b5fb6c04f36254a067

                                                                                SHA256

                                                                                a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                                                                                SHA512

                                                                                72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                                                                                Filesize

                                                                                9KB

                                                                                MD5

                                                                                9d1528a2ce17522f6de064ae2c2b608e

                                                                                SHA1

                                                                                2f1ce8b589e57ab300bb93dde176689689f75114

                                                                                SHA256

                                                                                11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                                                                                SHA512

                                                                                a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.3276.update
                                                                                Filesize

                                                                                9KB

                                                                                MD5

                                                                                14ffcf07375b3952bd3f2fe52bb63c14

                                                                                SHA1

                                                                                ab2eadde4c614eb8f1f2cae09d989c5746796166

                                                                                SHA256

                                                                                6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                                                                                SHA512

                                                                                14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                895b0b05b537d6b3dba97effb8b8113f

                                                                                SHA1

                                                                                84499dfb6d2ae150c2e71d1c284850f7922a1250

                                                                                SHA256

                                                                                2609043d965f0cb472b26b2fbc5c0a58c7a76586259151b406861cd1c1c8d9b4

                                                                                SHA512

                                                                                c065ccd204fe62cbd22e6b0e2d1bc4699aa5dd64ba6d234a41f3e3f3d6cdfffa782c61f953dc1cc6efc20b3187e6aebe28e4d68b3d51d5fd973898cd7bb0d4e1

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                                                                                Filesize

                                                                                2B

                                                                                MD5

                                                                                81051bcc2cf1bedf378224b0a93e2877

                                                                                SHA1

                                                                                ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                                                                                SHA256

                                                                                7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                                                                                SHA512

                                                                                1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                                                                                Filesize

                                                                                54KB

                                                                                MD5

                                                                                77c613ffadf1f4b2f50d31eeec83af30

                                                                                SHA1

                                                                                76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                                                                                SHA256

                                                                                2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                                                                                SHA512

                                                                                29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                749c51599fbf82422791e0df1c1e841c

                                                                                SHA1

                                                                                bba9a471e9300bcd4ebe3359d3f73b53067b781d

                                                                                SHA256

                                                                                c176f54367f9de7272b24fd4173271fd00e26c2dbdbf944b42d7673a295a65e6

                                                                                SHA512

                                                                                f0a5059b326446a7bd8f4c5b1ba5858d1affdc48603f6ce36355daeaab4ed3d1e853359a2440c69c5dee3d47e84f7bf38d7adf8707c277cd056f6ebca5942cc5

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                                                                                Filesize

                                                                                50KB

                                                                                MD5

                                                                                254dcbee3213189461b66e962ce8cc05

                                                                                SHA1

                                                                                cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                                                                                SHA256

                                                                                e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                                                                                SHA512

                                                                                7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                                                                                Filesize

                                                                                32KB

                                                                                MD5

                                                                                f531d3157e9ff57eea92db36c40e283e

                                                                                SHA1

                                                                                d0e49925476af438875fa9b1ccfb9077fa371ecc

                                                                                SHA256

                                                                                30aa4b3e85e20ada6fe045c7e93fee0d4642dcabd358a9987d7289c2c5582251

                                                                                SHA512

                                                                                27d247ab93ef313ce06ff5c1deca4b0819b688839c46808a6be709c205c81b93562181926a36a45a7da9570baea3b3152b6673a3bcce0b9326c7d3599a3d63c8

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                                                                                Filesize

                                                                                56KB

                                                                                MD5

                                                                                e9794f785780945d2dde78520b9bb59f

                                                                                SHA1

                                                                                293cae66cedbc7385cd49819587d3d5a61629422

                                                                                SHA256

                                                                                0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                                                                                SHA512

                                                                                1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                                                                                Filesize

                                                                                588KB

                                                                                MD5

                                                                                17d74c03b6bcbcd88b46fcc58fc79a0d

                                                                                SHA1

                                                                                bc0316e11c119806907c058d62513eb8ce32288c

                                                                                SHA256

                                                                                13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                                                                                SHA512

                                                                                f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                                                                                Filesize

                                                                                223B

                                                                                MD5

                                                                                bed0268db23c5f35713a537eb93b1cd5

                                                                                SHA1

                                                                                ede4773469027d959b6bc26278977422fe46ed2e

                                                                                SHA256

                                                                                4b1ec2ce25541e7cd4604d9b42b6bbe2f821f62ef3b7e8a4c9217287e13e8a51

                                                                                SHA512

                                                                                34184834942e8e90586f09adae0a960a08b352eb93dd8c914129e51e7ae03886c9830f90bd27a07585e6dbd9104af2e3bb068a06174c54a74402ba1208a5af39

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                                                                                Filesize

                                                                                9KB

                                                                                MD5

                                                                                1ef7574bc4d8b6034935d99ad884f15b

                                                                                SHA1

                                                                                110709ab33f893737f4b0567f9495ac60c37667c

                                                                                SHA256

                                                                                0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                                                                                SHA512

                                                                                947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                f512536173e386121b3ebd22aac41a4e

                                                                                SHA1

                                                                                74ae133215345beaebb7a95f969f34a40dda922a

                                                                                SHA256

                                                                                a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                                                                                SHA512

                                                                                1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                                                                                Filesize

                                                                                76KB

                                                                                MD5

                                                                                b40fe65431b18a52e6452279b88954af

                                                                                SHA1

                                                                                c25de80f00014e129ff290bf84ddf25a23fdfc30

                                                                                SHA256

                                                                                800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                                                                                SHA512

                                                                                e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                                                                                Filesize

                                                                                80KB

                                                                                MD5

                                                                                3904d0698962e09da946046020cbcb17

                                                                                SHA1

                                                                                edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                                                                                SHA256

                                                                                a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                                                                                SHA512

                                                                                c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                                Filesize

                                                                                433B

                                                                                MD5

                                                                                cf5f69533151675ab4f248fbc8cdedeb

                                                                                SHA1

                                                                                eb736e17118ac79e341b49eb29ea04433e65e66f

                                                                                SHA256

                                                                                e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                                                                                SHA512

                                                                                e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                                                                                Filesize

                                                                                717B

                                                                                MD5

                                                                                ef0a07aec4367a64c16c581da2657aa9

                                                                                SHA1

                                                                                13011a5abcbadb3424fb6ecee560665556bb1d24

                                                                                SHA256

                                                                                f8c02541eba2fde1b29b3ce428cbb0f1913110d4bba9b52f7252f728e9fce987

                                                                                SHA512

                                                                                35cfaedb4e5f754dde69f4cef508bbd6127408c405baa5ee2e20104f9aaa1ff2a228f0bfa42d51dcd1006e026ce238bd7042906e449ca78ef91e4d00b08c5c46

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                362ce475f5d1e84641bad999c16727a0

                                                                                SHA1

                                                                                6b613c73acb58d259c6379bd820cca6f785cc812

                                                                                SHA256

                                                                                1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                                                                                SHA512

                                                                                7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                                                                                Filesize

                                                                                1.9MB

                                                                                MD5

                                                                                8de5a7a19d882820893d8b911c1710fb

                                                                                SHA1

                                                                                95cdf5855bc5e454c8944952697ab142f77124f7

                                                                                SHA256

                                                                                2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                                                                                SHA512

                                                                                3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.ini
                                                                                Filesize

                                                                                13B

                                                                                MD5

                                                                                82f71b382e51cae212e670779dbdf14e

                                                                                SHA1

                                                                                c764f353e7b76236468649989c39eaef3b97e701

                                                                                SHA256

                                                                                b57642302dea3460bd78b6d9c62593939852c8526ba1779067d411e4dda3de17

                                                                                SHA512

                                                                                c5687a7dbbd4c714181f1ecfe1810a48109a4d9d4e3e90e88da67fa3cb2736d5b3aa260b6680fa6a07faa66ccb59db05f9e8e345fd0dc50abb63cb83daaf0bff

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                                                                                Filesize

                                                                                1.1MB

                                                                                MD5

                                                                                9a9b1fd85b5f1dcd568a521399a0d057

                                                                                SHA1

                                                                                34ed149b290a3a94260d889ba50cb286f1795fa6

                                                                                SHA256

                                                                                88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                                                                                SHA512

                                                                                7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                                                                                Filesize

                                                                                375KB

                                                                                MD5

                                                                                4a09a87d2004dac4b00687e9c9f15036

                                                                                SHA1

                                                                                c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                                                                                SHA256

                                                                                2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                                                                                SHA512

                                                                                f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                                                                                Filesize

                                                                                321KB

                                                                                MD5

                                                                                d3901e62166e9c42864fe3062cb4d8d5

                                                                                SHA1

                                                                                c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                                                                                SHA256

                                                                                dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                                                                                SHA512

                                                                                ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                                                                                Filesize

                                                                                814KB

                                                                                MD5

                                                                                9b1f97a41bfb95f148868b49460d9d04

                                                                                SHA1

                                                                                768031d5e877e347a249dfdeab7c725df941324b

                                                                                SHA256

                                                                                09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                                                                                SHA512

                                                                                9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                e74d2a16da1ddb7f9c54f72b8a25897c

                                                                                SHA1

                                                                                32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                                                                                SHA256

                                                                                a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                                                                                SHA512

                                                                                52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                                                                                Filesize

                                                                                11B

                                                                                MD5

                                                                                5eda46a55c61b07029e7202f8cf1781c

                                                                                SHA1

                                                                                862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                                                                                SHA256

                                                                                12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                                                                                SHA512

                                                                                4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                                                                                Filesize

                                                                                12B

                                                                                MD5

                                                                                5796d1f96bb31a9d07f4db8ae9f0ddb3

                                                                                SHA1

                                                                                93012724e6cc0a298838aede678806e6c0c6517d

                                                                                SHA256

                                                                                a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                                                                                SHA512

                                                                                890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                b4a865268d5aca5f93bab91d7d83c800

                                                                                SHA1

                                                                                95ac9334096f5a38ca1c92df31b1e73ae4586930

                                                                                SHA256

                                                                                5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                                                                                SHA512

                                                                                c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                90afca182773c647adaa8dda43e14c38

                                                                                SHA1

                                                                                1183171a383e468b187898efff5378a79e8179cb

                                                                                SHA256

                                                                                1b441bb68e359522ae803ff8d730e33644504753fb28ae989dfac797688a03ca

                                                                                SHA512

                                                                                56716cb13761a778f8ce7c7dc1dbed9bf0eda4f2eddde64c0e43d2c5c863d24bfd356c9e8769cd1b6796b65aa7869fd1dd12eeb1963cfc4e2cbf726cefe7af5e

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                669cee143dab986df886dc1960efd847

                                                                                SHA1

                                                                                dffcc0e56a061ce7630c5b22c76e7a3dbe160efb

                                                                                SHA256

                                                                                fbccd9d169a4be9ee1484a0c0be08c3a681abc43ce609bdd3a35ea6b4c4dc54d

                                                                                SHA512

                                                                                bb1e24ec1e37233a7b78f0b853ee480329ee270713ba6e124b72603c02952ec17d684a87a0b50cd4f73d8300611b4780c4e1e741bafc2a92132c2976051826a7

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                622b71991df1443be839bab14b85265a

                                                                                SHA1

                                                                                9e74e9fe6b259c46877c018378f7543bc831a704

                                                                                SHA256

                                                                                19fd8ad43ef276e6970c4d15d7099a308c7155cbc4d224b7b2c1d302c06a3d07

                                                                                SHA512

                                                                                cfc279d88d58ec27bb1258b16387a76237d8d2f9df89115dd8a33f75bb74ed58fbbc6e3177133a4bb52b0857cb1255c56c1850d72387db7b0db2165352af6185

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                2b74cdf3297099f558c415e080147b90

                                                                                SHA1

                                                                                1bbe8ed91fc54fa9ff64bcf2ceccc8f677387178

                                                                                SHA256

                                                                                e3980e5d831620fd5e773064b22faf12c6683cb43b709190862f4ab11dddcba0

                                                                                SHA512

                                                                                a19c3078b2e7da4a3fd5d3c08c3e85b28e60556d984fc8aeee492288afab651c43275a4bab20cde1d6840d7794bf0e9ad829bd2f682b13148a8bde7955549daf

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                                                                                Filesize

                                                                                2.8MB

                                                                                MD5

                                                                                a7bf0da8e308248aefd69586e1f8a312

                                                                                SHA1

                                                                                f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                                                                                SHA256

                                                                                b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                                                                                SHA512

                                                                                e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                                                                                Filesize

                                                                                2.9MB

                                                                                MD5

                                                                                7805ea1a8dd15cac328b826efe38c2a9

                                                                                SHA1

                                                                                66ff8eafb2424717c4394bae28a8683db1244527

                                                                                SHA256

                                                                                7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                                                                                SHA512

                                                                                17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                                                                                Filesize

                                                                                1.1MB

                                                                                MD5

                                                                                6c6f85e896655a6eb726482f04c49086

                                                                                SHA1

                                                                                2e0c55cd4894117428b34d21a1d53738fce4b02c

                                                                                SHA256

                                                                                e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                                                                                SHA512

                                                                                b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                                                                                Filesize

                                                                                334KB

                                                                                MD5

                                                                                b3e14504a48bed32c53ec7aab2cb2c8f

                                                                                SHA1

                                                                                0bc0d486a5ed1c4cdf2390229883ed3473926882

                                                                                SHA256

                                                                                adea6001759b5604f60bbaec8ce536a1e189adebc7394f9cff3921cae40c8c9b

                                                                                SHA512

                                                                                e5a5c09355eb9cb45dc872b59edbd54f62f15445ca6caaa3187e31e7928ef4453ae8405d9eee5d2aec4fa34965d3006dcf61c060b8691519a2312382612c683f

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                                                                                Filesize

                                                                                646KB

                                                                                MD5

                                                                                0e6af651f8be91dc9dde2faab59c9a77

                                                                                SHA1

                                                                                f199693bb55864f8497227c1c14244ff3e6e423e

                                                                                SHA256

                                                                                895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                                                                                SHA512

                                                                                fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing.zip
                                                                                Filesize

                                                                                3.1MB

                                                                                MD5

                                                                                85e1898362165fc1315d18abb73c1b37

                                                                                SHA1

                                                                                289a48ba5ee27c0134f75e243c55a90d32c11a05

                                                                                SHA256

                                                                                d0594b261e16394244c64289dac00367fdc853a1a8e542e0e814a57494c5228a

                                                                                SHA512

                                                                                49fdbef67c2a85b5d319c26e6e55456c94d294b836c946b9966c8746fb33de4ede62b93ba91ad657df4db24fdb3ee1de7395652ae1086c876b7d0b85000d594a

                                                                                Download Submit

                                                                              • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent.zip
                                                                                Filesize

                                                                                570KB

                                                                                MD5

                                                                                b50834694383960830cf48d9836e1108

                                                                                SHA1

                                                                                adc80813181b98a8296befa2960a55f939f3bfee

                                                                                SHA256

                                                                                370a259808052366888284b0cc4c91ff8f23e8008003959b8d0efb1adbf00cd6

                                                                                SHA512

                                                                                f87be933e87275b000be031aa5df7536dfd5fe9b99a607ce0904f206e074d3a0687a00654b9b78edaa2fccf3d30526e0ee5bd7dcba4a5daafd6fc60eeaaa15c5

                                                                                Download Submit

                                                                              • C:\ProgramData\Splashtop\Splashtop Remote Server\Credential\749cd0308f4ed78b7714b8bf620cdc76
                                                                                Filesize

                                                                                16KB

                                                                                MD5

                                                                                b2e89027a140a89b6e3eb4e504e93d96

                                                                                SHA1

                                                                                f3b1b34874b73ae3032decb97ef96a53a654228f

                                                                                SHA256

                                                                                5f97b3a9d3702d41e15c0c472c43bea25f825401adbc6e0e1425717e75174982

                                                                                SHA512

                                                                                93fc993af1c83f78fd991cc3d145a81ee6229a89f2c70e038c723032bf5ad12d9962309005d94cdbe0ef1ab11dc5205f57bcf1bc638ee0099fedf88977b99a19

                                                                                Download Submit

                                                                              • C:\ProgramData\chocolatey\config\chocolatey.config
                                                                                Filesize

                                                                                809B

                                                                                MD5

                                                                                8b6737800745d3b99886d013b3392ac3

                                                                                SHA1

                                                                                bb94da3f294922d9e8d31879f2d145586a182e19

                                                                                SHA256

                                                                                86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                                                                                SHA512

                                                                                654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                                                                                Download Submit

                                                                              • C:\ProgramData\chocolatey\logs\chocolatey.log
                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                f72185a78ad198796666db6e630f6c3c

                                                                                SHA1

                                                                                672f43d2d562b8c00f8c59ae9a6fb26dbab9d4c1

                                                                                SHA256

                                                                                071819624395590377adeaeaf0cd25b70fca71a434837eadccfbb1a91bb8ec01

                                                                                SHA512

                                                                                e7c63c41a64c3d9b01a90076bda8e6aec10f2e8b867fc4ea95501d5a046991e8612dd0cd36eae61b51b6feabbdfb191acc63fa29d5c9d06d32d97502d1f638b8

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                Filesize

                                                                                471B

                                                                                MD5

                                                                                4302ac33571a665623f83caa83e9d7b7

                                                                                SHA1

                                                                                38e4b1f7626af38f558f00b7585a8821a3ef371e

                                                                                SHA256

                                                                                85d864fdf43320e3535ad37f3d946a3bd648df66622cbbcb079b976abfa7ff41

                                                                                SHA512

                                                                                cc7530d96b6cf2d390a660fccd64170b6a32fb4ed777f3369ef92180abcaabfd94f74ba0ba8730084510fdeb42ded2a9b799d14c787424d3d11d2f2043642c41

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                                Filesize

                                                                                727B

                                                                                MD5

                                                                                6fd1b49ff0970cf707ca57e7b8f8bc90

                                                                                SHA1

                                                                                4fae66f564a7a74889ca5af56a3112875706c498

                                                                                SHA256

                                                                                55aa4f0c699e80ef09c0ac6c65d54c1da3f8e202067af5939cb5e9ee7a136d55

                                                                                SHA512

                                                                                58ba0ded323766625b1f8214f1fcfeec5bce5573a0d037da022d26dc303b1a4985e9eafcd52f50220ee2b9415cc88923003b4e7bf81be9e3b059a54fd853e57f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                Filesize

                                                                                727B

                                                                                MD5

                                                                                c5325af001c52aca934eadbea6e052bf

                                                                                SHA1

                                                                                6874523550ed5a89d37835fc468701b7f5375d40

                                                                                SHA256

                                                                                9040f3f40aa15886f4ef60141b67e96542ac690a8fd9c9b4d52bdb0cf1b4c773

                                                                                SHA512

                                                                                ef90d907375d2dedaa619bff669eb4dc16862a7fb16b4e73cc92b98792e19e6389c500aacb58dfdf4d7f71cf07367d00422f754766c433035e6becc475ed89db

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                Filesize

                                                                                400B

                                                                                MD5

                                                                                3414a09041f4f6d037154a170a708e08

                                                                                SHA1

                                                                                5bd6abcb4aabca481f0df4c9f629f7139d6d5683

                                                                                SHA256

                                                                                90c3f8c4cc89cea5df2ea5a5d43046aa27f788018dcacc927c632eefd5d0e1d5

                                                                                SHA512

                                                                                54519c6c50bd9bdddeeee6b63224c31ba94ea4344d30b28917a2609cafad9a345f9671ef815d033b35226c32d700a4377942f1e36c7663fef253a297e6a60483

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                                Filesize

                                                                                404B

                                                                                MD5

                                                                                798468bf1dfe0b76e8cf4f0737d9d933

                                                                                SHA1

                                                                                773927cd70f984ec77d5ab08de90003788da606f

                                                                                SHA256

                                                                                ed5b858607908df29a5fa6e2b775d4ddc36569c87732ec1712ebdbdb5dfdfd52

                                                                                SHA512

                                                                                7b32ba5c858e7b5ef827d90d65659154afdcb7a4b59c9a39388be14fd4eac61dee1ac4f45060560a4070d79f14dd54b99e2cb0f36989d46dbd0576924ca3e496

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                Filesize

                                                                                412B

                                                                                MD5

                                                                                2c3c96f27b91508807dbfefdc8bb4a1d

                                                                                SHA1

                                                                                6830f13a367e274d10be2f19d84ddfcff1763ea9

                                                                                SHA256

                                                                                68d006efee39580740d2b431b18342309c66f6f175316453329670a28d8d712c

                                                                                SHA512

                                                                                161ea44a5f2ebfa548af51f47f8f9235c6cc1fabddd339ae664e5faa539b8ae03c8cd54295a849174ac5b2f1c317b21b4b8ade3a9e1f032de4d6174ef11b0372

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                                                                                Filesize

                                                                                651B

                                                                                MD5

                                                                                9bbfe11735bac43a2ed1be18d0655fe2

                                                                                SHA1

                                                                                61141928bb248fd6e9cd5084a9db05a9b980fb3a

                                                                                SHA256

                                                                                549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                                                                                SHA512

                                                                                a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI1C6C.tmp
                                                                                Filesize

                                                                                509KB

                                                                                MD5

                                                                                88d29734f37bdcffd202eafcdd082f9d

                                                                                SHA1

                                                                                823b40d05a1cab06b857ed87451bf683fdd56a5e

                                                                                SHA256

                                                                                87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                                                                                SHA512

                                                                                1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI1C6C.tmp-\AlphaControlAgentInstallation.dll
                                                                                Filesize

                                                                                25KB

                                                                                MD5

                                                                                aa1b9c5c685173fad2dabebeb3171f01

                                                                                SHA1

                                                                                ed756b1760e563ce888276ff248c734b7dd851fb

                                                                                SHA256

                                                                                e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                                                                                SHA512

                                                                                d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI1C6C.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                                                                                Filesize

                                                                                179KB

                                                                                MD5

                                                                                1a5caea6734fdd07caa514c3f3fb75da

                                                                                SHA1

                                                                                f070ac0d91bd337d7952abd1ddf19a737b94510c

                                                                                SHA256

                                                                                cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                                                                                SHA512

                                                                                a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI21BD.tmp-\CustomAction.config
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                bc17e956cde8dd5425f2b2a68ed919f8

                                                                                SHA1

                                                                                5e3736331e9e2f6bf851e3355f31006ccd8caa99

                                                                                SHA256

                                                                                e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                                                                                SHA512

                                                                                02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI21BD.tmp-\Newtonsoft.Json.dll
                                                                                Filesize

                                                                                695KB

                                                                                MD5

                                                                                715a1fbee4665e99e859eda667fe8034

                                                                                SHA1

                                                                                e13c6e4210043c4976dcdc447ea2b32854f70cc6

                                                                                SHA256

                                                                                c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                                                                                SHA512

                                                                                bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI2DCF.tmp-\System.Management.dll
                                                                                Filesize

                                                                                60KB

                                                                                MD5

                                                                                878e361c41c05c0519bfc72c7d6e141c

                                                                                SHA1

                                                                                432ef61862d3c7a95ab42df36a7caf27d08dc98f

                                                                                SHA256

                                                                                24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                                                                                SHA512

                                                                                59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSI2EDF.tmp
                                                                                Filesize

                                                                                211KB

                                                                                MD5

                                                                                a3ae5d86ecf38db9427359ea37a5f646

                                                                                SHA1

                                                                                eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                                SHA256

                                                                                c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                                SHA512

                                                                                96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                                Download Submit

                                                                              • C:\Windows\Installer\MSIE1ED.tmp
                                                                                Filesize

                                                                                4.5MB

                                                                                MD5

                                                                                2207f96731ce2f9d9327c0baaf4959ef

                                                                                SHA1

                                                                                f56ea992c59ad669ec8ee5d6a827adc472159cc0

                                                                                SHA256

                                                                                e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                                                                                SHA512

                                                                                7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                                                                                Download Submit

                                                                              • C:\Windows\Installer\e581b63.msi
                                                                                Filesize

                                                                                2.9MB

                                                                                MD5

                                                                                7dce94e4f95426c4c228e5353dc65c70

                                                                                SHA1

                                                                                f1016eca6ceea32d1ab3d8321d858a98389a5e8d

                                                                                SHA256

                                                                                c657d96ae4fab5d3c69a0646f11f2b75ad88b8b3e842059508a7ffee4e39b7c0

                                                                                SHA512

                                                                                3ee1f62abfaff194933549308e8885b7ad0e39e2e61384b2c9e6ea716eb5179ccf49103003588ebf98d2362bc5d06cf7c966ba61d592e832edeb3c17da4d7fd5

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ca2ce3fc-b232-9245-b96f-8595689d5b94}\lci_proxywddm.cat
                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                8e16d54f986dbe98812fd5ec04d434e8

                                                                                SHA1

                                                                                8bf49fa8e12f801559cc2869365f0b184d7f93fe

                                                                                SHA256

                                                                                7c772fb24326e90d6e9c60a08495f32f7d5def1c52037d78cbd0436ad70549cd

                                                                                SHA512

                                                                                e1da797044663ad6362641189fa78116cc4b8e611f9d33c89d6c562f981d5913920acb12a4f7ef6c1871490563470e583910045378bda5c7a13db25f987e9029

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ca2ce3fc-b232-9245-b96f-8595689d5b94}\lci_proxywddm.inf
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                0315a579f5afe989154cb7c6a6376b05

                                                                                SHA1

                                                                                e352ff670358cf71e0194918dfe47981e9ccbb88

                                                                                SHA256

                                                                                d10fa136d6ae9a15216202e4dd9f787b3a148213569e438da3bf82b618d8001d

                                                                                SHA512

                                                                                c7ce8278bc5ee8f8b4738ef8bb2c0a96398b40dc65eea1c28688e772ae0f873624311146f4f4ec8971c91df57983d2d8cdbec1fe98eaa7f9d15a2c159d80e0af

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ca2ce3fc-b232-9245-b96f-8595689d5b94}\x64\lci_proxyumd.dll
                                                                                Filesize

                                                                                179KB

                                                                                MD5

                                                                                4dc11547a5fc28ca8f6965fa21573481

                                                                                SHA1

                                                                                d531b0d8d2f8d49d81a4c17fbaf3bc294845362c

                                                                                SHA256

                                                                                e9db5cd21c8d709a47fc0cfb2c6ca3bb76a3ed8218bed5dc37948b3f9c7bd99d

                                                                                SHA512

                                                                                bd0f0a3bbc598480a9b678aa1b35728b2380bf57b195b0249936d0eaaa014f219031a563f486871099bf1c78ccc758f6b25b97cfc5296a73fc60b6caff9877f6

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ca2ce3fc-b232-9245-b96f-8595689d5b94}\x64\lci_proxyumd32.dll
                                                                                Filesize

                                                                                135KB

                                                                                MD5

                                                                                67ae7b2c36c9c70086b9d41b4515b0a8

                                                                                SHA1

                                                                                ba735d6a338c8fdfa61c98f328b97bf3e8e48b8b

                                                                                SHA256

                                                                                79876f242b79269fe0fe3516f2bdb0a1922c86d820ce1dd98500b385511dac69

                                                                                SHA512

                                                                                4d8320440f3472ee0e9bd489da749a738370970de07b0920b535642723c92de848f4b3d7f898689c817145ce7b08f65128abe91d816827aeb7e5e193d7027078

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ca2ce3fc-b232-9245-b96f-8595689d5b94}\x64\lci_proxywddm.sys
                                                                                Filesize

                                                                                119KB

                                                                                MD5

                                                                                b9b0e9b4d93b18b99ece31a819d71d00

                                                                                SHA1

                                                                                2be1ad570f3ccb2e6f2e2b16d1e0002ca4ec8d9e

                                                                                SHA256

                                                                                0f1c64c0fa08fe45beac15dc675d3b956525b8f198e92e0ccac21d2a70ce42cf

                                                                                SHA512

                                                                                465e389806f3b87a544ab8b0b7b49864feeba2eeef4fb51628d40175573ed1ba00b26d6a2abebc74c31369194206ed31d32c68471dddcf817fdd2d26e3da7a53

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ff0c8d6c-c400-6644-8942-35cc3035a3bd}\lci_iddcx.cat
                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                62458e58313475c9a3642a392363e359

                                                                                SHA1

                                                                                e63a3866f20e8c057933ba75d940e5fd2bf62bc6

                                                                                SHA256

                                                                                85620d87874f27d1aaf1743c0ca47e210c51d9afd0c9381fc0cd8acca3854562

                                                                                SHA512

                                                                                49fb8ca58aecf97a6ab6b97de7d367accb7c5be76fbcd324af4ce75efe96642e8c488f273c0363250f7a5bcea7f7055242d28fd4b1f130b68a1a5d9a078e7fad

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ff0c8d6c-c400-6644-8942-35cc3035a3bd}\lci_iddcx.inf
                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                1cec22ca85e1b5a8615774fca59a420b

                                                                                SHA1

                                                                                049a651751ef38321a1088af6a47c4380f9293fc

                                                                                SHA256

                                                                                60a018f46d17b7640fc34587667cd852a16fa8e82f957a69522637f22e5fe5cf

                                                                                SHA512

                                                                                0f24fe3914aef080a0d109df6cfac548a880947fb85e7490f0d8fa174a606730b29dc8d2ae10525dba4d1ca05ac9b190e4704629b86ac96867188df4ca3168bb

                                                                                Download Submit

                                                                              • C:\Windows\System32\DriverStore\Temp\{ff0c8d6c-c400-6644-8942-35cc3035a3bd}\x64\lci_iddcx.dll
                                                                                Filesize

                                                                                52KB

                                                                                MD5

                                                                                01e8bc64139d6b74467330b11331858d

                                                                                SHA1

                                                                                b6421a1d92a791b4d4548ab84f7140f4fc4eb829

                                                                                SHA256

                                                                                148359a84c637d05c20a58f5038d8b2c5390f99a5a229be8eccbb5f85e969438

                                                                                SHA512

                                                                                4099e8038d65d95d3f00fd32eba012f55ae16d0da3828e5d689ef32e20352fdfcc278cd6f78536dc7f28fb97d07185e654fe6eee610822ea8d9e9d5af696dff5

                                                                                Download Submit

                                                                              • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-09-33-19.dat
                                                                                Filesize

                                                                                602B

                                                                                MD5

                                                                                9c344b505068368a558f6c71d8b17327

                                                                                SHA1

                                                                                d35a51d4c2739f6c4a3a031ac2cbcd4c7d024f8b

                                                                                SHA256

                                                                                2c37d93560d954ed3eb9f45af4b6a8b5b9f8e3bd1d096a719d75df56b704538d

                                                                                SHA512

                                                                                9225e1683d6ac20dd3d5eb5e10f28e95198d63cecc89124cbbf1a6f58787e537cf6379689778dc4da00f68afecaac64d7b78ed3cab03e566937095e68ad29400

                                                                                Download Submit

                                                                              • C:\Windows\Temp\InstallUtil.log
                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                05a38d85e80b5df295ca2ffab3962016

                                                                                SHA1

                                                                                92ab1555771c39fbbfd5f018d695da93c97ce57d

                                                                                SHA256

                                                                                5210219645850c590bd7e0e172adccc32c9b9e9971b1320602a26c0a3242468d

                                                                                SHA512

                                                                                355c9f97a4a90e649a11bad3b625e04ad12a34b453ea8bcf2bb6d06cce4f68cb8a3a430ae8d99c4f77441d275fba07806f6f1e7b6e52939220bad65c34f61707

                                                                                Download Submit

                                                                              • C:\Windows\Temp\InstallUtil.log
                                                                                Filesize

                                                                                976B

                                                                                MD5

                                                                                e722d5cc258ebd22ad62f9de452f03d4

                                                                                SHA1

                                                                                f058537daf640e61314fb1320027a7f4eca767f9

                                                                                SHA256

                                                                                9ba84db27c09617c03e11bc138419cbf0ef69a2f0cf1766e3ebf1956b5bfe3f9

                                                                                SHA512

                                                                                f0c3cdbc7f8e2b11466cbc7133223c4a0a9b9ccdba7869e0b22a2f0d52f56f3ce3f7d400498cacf600bcd222f4116e5de19e6daf9526f1053f2188b10a39cdc7

                                                                                Download Submit

                                                                              • C:\Windows\Temp\InstallUtil.log
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                51ff7f3f8811559297080204de4762df

                                                                                SHA1

                                                                                ce0d969e34c65363cebc5b7e8fbc5b65053dcd4b

                                                                                SHA256

                                                                                696f5ba82ea6e4b172c3ad881b771e2d9ff1f77cdd9f407ee99323e2d6db40cd

                                                                                SHA512

                                                                                e18b17e2c06f0b714fb61f453e0f3f84e2a12c688b364f2b963000e854f245e4a0b0042050e12a7d9bb3e1cc2e5d6e6998a809c5a3cdf4edf2cbfaeeb3ced1ee

                                                                                Download Submit

                                                                              • C:\Windows\Temp\PreVer.log
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                9b5a2d2c85aaf3889c79250a3e28a336

                                                                                SHA1

                                                                                00e8d46b5ea21230d5974a078c09ef8a378fd2cd

                                                                                SHA256

                                                                                57e61ed373f825664c63d4a63ac83da23d959465b301b144164cc2e778f98e31

                                                                                SHA512

                                                                                a2e864eb381670508ddfb765c6cef938953b50dc5e9032468f8bb00e5a2628120d472690771c864d76bd35af5223f7751e85695ce93e108fc80158b052614f4f

                                                                                Download Submit

                                                                              • C:\Windows\Temp\unpack.log
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                01c082808fe913f5f321043cd9770602

                                                                                SHA1

                                                                                4cde20e7d6b7082e4e79f4fe23d067e45d30ab8f

                                                                                SHA256

                                                                                192e1a5f07991a570e9662feab609b42532b889e49b27e6d17d4854a2e18f647

                                                                                SHA512

                                                                                9b4398e5ec3331f82e0647a347139c1becc17a5e526fd2d4d8cfdf7d09e1b9fe23de7b7bd4ca93e504b1fa9c97c9931081857db14ae1c0e0cc74fc5752ce7d19

                                                                                Download Submit

                                                                              • C:\Windows\Temp\unpack.log
                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                c08265e41179cdc7f3d5d7d82f577917

                                                                                SHA1

                                                                                a1998ef0b673a2660b2918e3815f490407bb465e

                                                                                SHA256

                                                                                bbd5f69271cdf4f8a9809932aec4f271dd5972b2bf195e5a75008a48ea5a8548

                                                                                SHA512

                                                                                a98c07f4fcf7654117cf70b344f54e798315b21297f5d340f30cd1fd46b430d93ab1c6c622ba60d5b3f39637f1b9ba29102c71e096524157c83eb5e084dbf26b

                                                                                Download Submit

                                                                              • C:\Windows\Temp\unpack\PreVerCheck.exe
                                                                                Filesize

                                                                                3.2MB

                                                                                MD5

                                                                                a7ce785b6cd1c9657040ca9b6cbeed10

                                                                                SHA1

                                                                                4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                                                                                SHA256

                                                                                7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                                                                                SHA512

                                                                                39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                                                                                Download Submit

                                                                              • C:\Windows\Temp\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\IsConfig.ini
                                                                                Filesize

                                                                                571B

                                                                                MD5

                                                                                38370175ce7d8dd5c3581030a9104259

                                                                                SHA1

                                                                                bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                                                                                SHA256

                                                                                ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                                                                                SHA512

                                                                                e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                                                                                Download Submit

                                                                              • C:\Windows\Temp\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\String1033.txt
                                                                                Filesize

                                                                                182KB

                                                                                MD5

                                                                                37a2c4ef0ff41955f1cb884b7790699f

                                                                                SHA1

                                                                                8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                                                                                SHA256

                                                                                6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                                                                                SHA512

                                                                                fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                                                                                Download Submit

                                                                              • C:\Windows\Temp\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\_isC0AC.exe
                                                                                Filesize

                                                                                179KB

                                                                                MD5

                                                                                7a1c100df8065815dc34c05abc0c13de

                                                                                SHA1

                                                                                3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                                                                                SHA256

                                                                                e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                                                                                SHA512

                                                                                bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                                                                                Download Submit

                                                                              • C:\Windows\Temp\{0DE379F6-5A3C-4224-9961-D7963DD88CB3}\setup.inx
                                                                                Filesize

                                                                                345KB

                                                                                MD5

                                                                                0376dd5b7e37985ea50e693dc212094c

                                                                                SHA1

                                                                                02859394164c33924907b85ab0aaddc628c31bf1

                                                                                SHA256

                                                                                c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                                                                                SHA512

                                                                                69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                                                                                Download Submit

                                                                              • C:\Windows\Temp\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\ISRT.dll
                                                                                Filesize

                                                                                427KB

                                                                                MD5

                                                                                85315ad538fa5af8162f1cd2fce1c99d

                                                                                SHA1

                                                                                31c177c28a05fa3de5e1f934b96b9d01a8969bba

                                                                                SHA256

                                                                                70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                                                                                SHA512

                                                                                877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                                                                                Download Submit

                                                                              • C:\Windows\Temp\{D4FDF46D-D798-4C02-B3CD-009D09E8BBDB}\_isres_0x0409.dll
                                                                                Filesize

                                                                                1.8MB

                                                                                MD5

                                                                                befe2ef369d12f83c72c5f2f7069dd87

                                                                                SHA1

                                                                                b89c7f6da1241ed98015dc347e70322832bcbe50

                                                                                SHA256

                                                                                9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                                                                                SHA512

                                                                                760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                                                                                Download Submit

                                                                              • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                                                                                Filesize

                                                                                404B

                                                                                MD5

                                                                                9fb84a59d334638a55b0ee6ce627de55

                                                                                SHA1

                                                                                5cacfc55eb0470af0d24ee983fe46c4682e84b28

                                                                                SHA256

                                                                                d6211bb43eb18a997803aed72958c8b48b72573eadbe2d5e77ba05e6fd0b31e2

                                                                                SHA512

                                                                                b26456ec7946f5042a33bdc4897449b5e28b47ef33135452fa122cf8e6ef2b8082c670c8e9fac5866bc675594c5fc697cb3ede4d60743de604170f21a7c33eed

                                                                                Download Submit

                                                                              • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                Filesize

                                                                                412B

                                                                                MD5

                                                                                66dcb444dfb04d53becda5d006bb4627

                                                                                SHA1

                                                                                fdd6265b5ecdab37f75d62667025e333761aca09

                                                                                SHA256

                                                                                1cf7e03e39c861b0e0c3120071cd2f3244acfbd324e7e9ce65b27e8d7dd7d82e

                                                                                SHA512

                                                                                bca84795e6cacb3bd4e0aa40c3e8cb1ecbb4f60e86ab6e2eff08f65b1d46b5f73b20a181a8d34d7913785fc5723fa28931bea914dee4d9357b7c016cac3d79ce

                                                                                Download Submit

                                                                              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                Filesize

                                                                                24.1MB

                                                                                MD5

                                                                                9a821c2db7aeb74798f70bfc662b328d

                                                                                SHA1

                                                                                296bf251fe1506f6afa238abcdacf2d7929d731d

                                                                                SHA256

                                                                                12d178f85577fb97cf5caa6584f06391f63e42f3840035a149d660ccfc70c280

                                                                                SHA512

                                                                                5ee86dc9e8434bd0a2136e001931eb46410774d60a46687e0aeb9ab9cf49ed5102cee9e867c8666ca329d57fbe828406f35796bf13d6d80db720b3c437cd4e01

                                                                                Download Submit

                                                                              • \??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{49c14277-5b44-4f90-923d-ede4a670e355}_OnDiskSnapshotProp
                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                80e479d58ecc382223060cbddcc2f264

                                                                                SHA1

                                                                                d957286056a978c2024a1510117246b369bddb84

                                                                                SHA256

                                                                                ab51860cfa3148d1c2902a63086a6d4576b7ebd495db8dcdfd8f6e495d301041

                                                                                SHA512

                                                                                fa7d41d75f525afc9193e9d1e56ba3ab6a51e951552a1ad0be68e283371397a21f465cc5cce982409210219ab3fa966b1a8c3d9c5aa77e5488c3ff9783abe90c

                                                                                Download Submit

                                                                              • memory/628-1590-0x000002A758E40000-0x000002A758EF2000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/628-1595-0x000002A740690000-0x000002A7406B0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/628-1584-0x000002A73FD00000-0x000002A73FD0C000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/628-1587-0x000002A740670000-0x000002A740688000-memory.dmp

                                                                                Filesize

                                                                                96KB

                                                                                Download

                                                                              • memory/1664-1044-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/1664-515-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/1664-481-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/1664-905-0x00000000035E0000-0x00000000037A7000-memory.dmp

                                                                                Filesize

                                                                                1.8MB

                                                                                Download

                                                                              • memory/1664-484-0x00000000035A0000-0x0000000003767000-memory.dmp

                                                                                Filesize

                                                                                1.8MB

                                                                                Download

                                                                              • memory/1664-1858-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/1664-1045-0x0000000010000000-0x0000000010114000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/2108-1415-0x00000130DD610000-0x00000130DD664000-memory.dmp

                                                                                Filesize

                                                                                336KB

                                                                                Download

                                                                              • memory/2108-1108-0x00000130C4530000-0x00000130C4542000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/2108-1112-0x00000130C4EB0000-0x00000130C4ECC000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/2108-1125-0x00000130DD6D0000-0x00000130DD782000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/2272-80-0x0000000004B50000-0x0000000004EA4000-memory.dmp

                                                                                Filesize

                                                                                3.3MB

                                                                                Download

                                                                              • memory/2272-79-0x0000000002440000-0x0000000002462000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/2272-76-0x0000000002560000-0x0000000002612000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/2596-1599-0x0000023970870000-0x000002397087C000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/2596-1602-0x0000023970C80000-0x0000023970CCA000-memory.dmp

                                                                                Filesize

                                                                                296KB

                                                                                Download

                                                                              • memory/2596-1727-0x0000023971D20000-0x0000023971DFC000-memory.dmp

                                                                                Filesize

                                                                                880KB

                                                                                Download

                                                                              • memory/2596-1733-0x0000023971AE0000-0x0000023971AFC000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/2596-1604-0x0000023970C40000-0x0000023970C5C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/2596-1626-0x0000023971B90000-0x0000023971C40000-memory.dmp

                                                                                Filesize

                                                                                704KB

                                                                                Download

                                                                              • memory/2932-3622-0x00000000723B0000-0x000000007277D000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                                Download

                                                                              • memory/2932-3621-0x0000000073B70000-0x0000000073C8C000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/2972-2730-0x0000000073B70000-0x0000000073C8C000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/2972-2421-0x00000000723B0000-0x000000007277D000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                                Download

                                                                              • memory/2972-2420-0x0000000073B70000-0x0000000073C8C000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/2972-2731-0x00000000723B0000-0x000000007277D000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                                Download

                                                                              • memory/2972-2739-0x0000000073B70000-0x0000000073C8C000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/2972-2740-0x00000000723B0000-0x000000007277D000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                                Download

                                                                              • memory/3040-346-0x000001C350A50000-0x000001C350A98000-memory.dmp

                                                                                Filesize

                                                                                288KB

                                                                                Download

                                                                              • memory/3040-342-0x000001C34FF30000-0x000001C34FF94000-memory.dmp

                                                                                Filesize

                                                                                400KB

                                                                                Download

                                                                              • memory/3040-353-0x000001C350AE0000-0x000001C350AE8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/3040-354-0x000001C369340000-0x000001C3693A8000-memory.dmp

                                                                                Filesize

                                                                                416KB

                                                                                Download

                                                                              • memory/3040-355-0x000001C369300000-0x000001C36932A000-memory.dmp

                                                                                Filesize

                                                                                168KB

                                                                                Download

                                                                              • memory/3040-356-0x000001C3695D0000-0x000001C36960A000-memory.dmp

                                                                                Filesize

                                                                                232KB

                                                                                Download

                                                                              • memory/3040-352-0x000001C350AD0000-0x000001C350AD8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/3040-347-0x000001C350900000-0x000001C350908000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/3040-343-0x000001C350930000-0x000001C35097A000-memory.dmp

                                                                                Filesize

                                                                                296KB

                                                                                Download

                                                                              • memory/3040-357-0x000001C3692D0000-0x000001C3692F6000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3040-344-0x000001C3508E0000-0x000001C3508FC000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/3040-350-0x000001C369490000-0x000001C369542000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/3040-349-0x000001C3693B0000-0x000001C36948C000-memory.dmp

                                                                                Filesize

                                                                                880KB

                                                                                Download

                                                                              • memory/3040-348-0x000001C350910000-0x000001C35091A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/3040-351-0x000001C350AC0000-0x000001C350AC8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/3040-345-0x000001C350A00000-0x000001C350A4C000-memory.dmp

                                                                                Filesize

                                                                                304KB

                                                                                Download

                                                                              • memory/3276-1621-0x000001DBF7530000-0x000001DBF7576000-memory.dmp

                                                                                Filesize

                                                                                280KB

                                                                                Download

                                                                              • memory/3276-1729-0x000001DBF6CF0000-0x000001DBF6D0E000-memory.dmp

                                                                                Filesize

                                                                                120KB

                                                                                Download

                                                                              • memory/3276-1585-0x000001DBF6420000-0x000001DBF6432000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/3276-1713-0x000001DBF8300000-0x000001DBF8350000-memory.dmp

                                                                                Filesize

                                                                                320KB

                                                                                Download

                                                                              • memory/3276-1714-0x000001DBF83D0000-0x000001DBF8446000-memory.dmp

                                                                                Filesize

                                                                                472KB

                                                                                Download

                                                                              • memory/3276-1586-0x000001DBF6C60000-0x000001DBF6C70000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3276-1594-0x000001DBF6C90000-0x000001DBF6CB0000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/3276-1618-0x000001DBF88A0000-0x000001DBF8EFC000-memory.dmp

                                                                                Filesize

                                                                                6.4MB

                                                                                Download

                                                                              • memory/3276-1589-0x000001DBF75C0000-0x000001DBF7672000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/4224-278-0x000002097BA00000-0x000002097BA1C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/4224-277-0x000002097BA90000-0x000002097BB40000-memory.dmp

                                                                                Filesize

                                                                                704KB

                                                                                Download

                                                                              • memory/4224-274-0x0000020962990000-0x00000209629C0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/4268-299-0x00000142166C0000-0x00000142166D6000-memory.dmp

                                                                                Filesize

                                                                                88KB

                                                                                Download

                                                                              • memory/4268-300-0x000001422F820000-0x000001422F8D2000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/4268-301-0x0000014216F20000-0x0000014216F3C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/4272-165-0x0000029A8D7C0000-0x0000029A8D7FC000-memory.dmp

                                                                                Filesize

                                                                                240KB

                                                                                Download

                                                                              • memory/4272-164-0x0000029A8D760000-0x0000029A8D772000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/4272-39-0x0000000004970000-0x000000000499E000-memory.dmp

                                                                                Filesize

                                                                                184KB

                                                                                Download

                                                                              • memory/4272-43-0x00000000049B0000-0x00000000049BC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/4272-148-0x0000029A8D250000-0x0000029A8D278000-memory.dmp

                                                                                Filesize

                                                                                160KB

                                                                                Download

                                                                              • memory/4272-160-0x0000029A8F1E0000-0x0000029A8F278000-memory.dmp

                                                                                Filesize

                                                                                608KB

                                                                                Download

                                                                              • memory/4904-200-0x0000020CC85F0000-0x0000020CC86A2000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/4904-243-0x0000020CC8B80000-0x0000020CC8BB8000-memory.dmp

                                                                                Filesize

                                                                                224KB

                                                                                Download

                                                                              • memory/4904-205-0x0000020CC85B0000-0x0000020CC85D2000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/5080-1598-0x0000027C76190000-0x0000027C761C4000-memory.dmp

                                                                                Filesize

                                                                                208KB

                                                                                Download

                                                                              • memory/5080-1732-0x0000027C774B0000-0x0000027C774CC000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/5080-1731-0x0000027C77600000-0x0000027C77662000-memory.dmp

                                                                                Filesize

                                                                                392KB

                                                                                Download

                                                                              • memory/5080-1706-0x0000027C77540000-0x0000027C775F2000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/5080-1620-0x0000027C77300000-0x0000027C7734A000-memory.dmp

                                                                                Filesize

                                                                                296KB

                                                                                Download

                                                                              • memory/5080-1612-0x0000027C76590000-0x0000027C7659A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/5080-1609-0x0000027C76A30000-0x0000027C76A48000-memory.dmp

                                                                                Filesize

                                                                                96KB

                                                                                Download

                                                                              • memory/5080-1607-0x0000027C76A10000-0x0000027C76A2C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/5080-1707-0x0000027C776E0000-0x0000027C777BC000-memory.dmp

                                                                                Filesize

                                                                                880KB

                                                                                Download

                                                                              • memory/5080-1601-0x0000027C76A60000-0x0000027C76AAA000-memory.dmp

                                                                                Filesize

                                                                                296KB

                                                                                Download

                                                                              • memory/5096-110-0x0000000004D60000-0x0000000004DC6000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                                Download

                                                                              • memory/5404-1735-0x00000150B04A0000-0x00000150B0552000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/5404-1624-0x0000015097190000-0x00000150971A2000-memory.dmp

                                                                                Filesize

                                                                                72KB

                                                                                Download

                                                                              • memory/5404-1737-0x00000150B0640000-0x00000150B071C000-memory.dmp

                                                                                Filesize

                                                                                880KB

                                                                                Download

                                                                              • memory/5404-1628-0x0000015097B00000-0x0000015097B1C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/5404-1762-0x00000150B0400000-0x00000150B041A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                                Download

                                                                              • memory/5404-1625-0x0000015097B50000-0x0000015097B9A000-memory.dmp

                                                                                Filesize

                                                                                296KB

                                                                                Download

                                                                              • memory/5448-1623-0x00000294EFED0000-0x00000294EFEEC000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/5448-1715-0x00000294F0F10000-0x00000294F0FC2000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/5448-1734-0x00000294EFF20000-0x00000294EFF28000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/5448-1619-0x00000294F0C00000-0x00000294F0C4A000-memory.dmp

                                                                                Filesize

                                                                                296KB

                                                                                Download

                                                                              • memory/5448-1613-0x00000294EFB00000-0x00000294EFB10000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/5448-1630-0x00000294F0E30000-0x00000294F0F0C000-memory.dmp

                                                                                Filesize

                                                                                880KB

                                                                                Download

                                                                              • memory/5576-1716-0x0000019C60420000-0x0000019C60468000-memory.dmp

                                                                                Filesize

                                                                                288KB

                                                                                Download

                                                                              • memory/5576-1708-0x0000019C604E0000-0x0000019C60592000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/5576-1614-0x0000019C47270000-0x0000019C472AA000-memory.dmp

                                                                                Filesize

                                                                                232KB

                                                                                Download

                                                                              • memory/5576-1709-0x0000019C47B70000-0x0000019C47B8C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                                Download

                                                                              • memory/5656-1610-0x000002052F0C0000-0x000002052F0CA000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                                Download

                                                                              • memory/5656-1615-0x000002052FA30000-0x000002052FA4A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                                Download

                                                                              • memory/5656-1730-0x00000205488B0000-0x0000020548DD8000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                                Download

                                                                              • memory/5656-1622-0x0000020548290000-0x0000020548342000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/5764-2728-0x0000000073B70000-0x0000000073C8C000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/5764-2729-0x00000000723B0000-0x000000007277D000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                                Download

                                                                              • memory/5840-1606-0x000001F741C60000-0x000001F741C74000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                                Download

                                                                              • memory/5840-1605-0x000001F75AF60000-0x000001F75AFC6000-memory.dmp

                                                                                Filesize

                                                                                408KB

                                                                                Download

                                                                              • memory/5840-1592-0x000001F741C20000-0x000001F741C40000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                                Download

                                                                              • memory/5840-1596-0x000001F75A420000-0x000001F75A4D2000-memory.dmp

                                                                                Filesize

                                                                                712KB

                                                                                Download

                                                                              • memory/5840-1591-0x000001F7412C0000-0x000001F7412D0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/6072-2741-0x0000000073B70000-0x0000000073C8C000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                                Download

                                                                              • memory/6072-2742-0x00000000723B0000-0x000000007277D000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                                Download