Overview

overview

10

Static

static

10

NF---710.msi

windows7-x64

10

NF---710.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2024 03:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NF---710.msi

  • Size

    2.9MB

  • MD5

    98498752125993a3a0a6b02cfdd3d28e

  • SHA1

    7d1747d94950df564da98ef4dae8128fb1399a7a

  • SHA256

    30bfe9326b0554c6cd73359084ba1218d26e587542c1e2216e201b4c62a7fb71

  • SHA512

    4e271945c4ee0d65855d03a0ad5437f05e44fc00dedf2a9c38e2e534ac45253aa0b2ad6e51d6e3d13df9f7250714ef1b7be0e898fef9e8ec2b17940ac16c5a6b

  • SSDEEP

    49152:W+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:W+lUlz9FKbsodq0YaH7ZPxMb8tT

Score
10/10
ateraagentbootkitdiscoverypersistenceprivilege_escalationrat

Malware Config

Signatures

  • AteraAgent

    AteraAgent is a remote monitoring and management tool.

    ratateraagent
  • Ateraagent family
    ateraagent
  • Detects AteraAgent 1 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 48 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 13 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NF---710.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1356
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4648
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6CCB1DF60375D17F5823D8C8478357BF
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240649734 2 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:872
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI859.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240650328 6 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1420
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIDB9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240651703 10 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1384
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI225F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240657015 32 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4268
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AE13AF4CF1001A84410E20258A98702A E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3840
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="[email protected]" /CompanyId="1" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="0013z00002SMHs1AAH" /AgentId="dff7aed2-9ad0-4b26-a619-6cdf47fed95e"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:3952
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4EEE022F9A1BCC6F482600CEAE3A623D E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1768
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE2C2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240706421 37 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.GenerateAgentId
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:6088
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE488.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240706734 41 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiStart
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5924
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIE767.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240707437 46 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ShouldContinueInstallation
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5292
      • C:\Windows\SysWOW64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5992
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5324
      • C:\Windows\SysWOW64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:4016
      • C:\Windows\syswow64\NET.exe
        "NET" STOP AteraAgent
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1088
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 STOP AteraAgent
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5172
      • C:\Windows\syswow64\TaskKill.exe
        "TaskKill.exe" /f /im AteraAgent.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:3764
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI1111.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240718078 84 AlphaControlAgentInstallation!AlphaControlAgentInstallation.CustomActions.ReportMsiEnd
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4508
    • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe" /u
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      PID:1592
    • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
      "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe" /i /IntegratorLogin="" /CompanyId="" /IntegratorLoginUI="" /CompanyIdUI="" /FolderId="" /AccountId="" /AgentId="52ab700c-e1d3-43f0-b803-948c73afca97"
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      PID:4920
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8AF8A6C5C0921E76BD0EDAC4A6AE6102 E Global\MSI0000
      2⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:5136
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43C02029-8FF0-4489-BEF1-9A5306C89830}
        3⤵
        • Executes dropped EXE
        PID:5428
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3554CE59-20EA-4F06-AF26-9386AE7439D8}
        3⤵
        • Executes dropped EXE
        PID:2632
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{29A6FDBA-B470-4BDE-9B99-CA5B88F7EDF1}
        3⤵
        • Executes dropped EXE
        PID:1112
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{621BBEA7-E3D5-4102-A6A4-3C5EC44E136C}
        3⤵
        • Executes dropped EXE
        PID:2912
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2E3839A8-8A7D-42DF-8CAE-9FE01EB6BBC6}
        3⤵
        • Executes dropped EXE
        PID:3080
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14BB6D05-D7FB-490F-A6D9-54163C4B889F}
        3⤵
        • Executes dropped EXE
        PID:2652
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0DCBFA96-8A43-4E6B-8CE6-2C3AF12F47D3}
        3⤵
        • Executes dropped EXE
        PID:6136
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35C06DFD-F96E-4A62-A1EC-115E2F5F1B96}
        3⤵
        • Executes dropped EXE
        PID:5848
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B0802F09-87BB-4B6C-A229-2C29EDD539AC}
        3⤵
        • Executes dropped EXE
        PID:1608
      • C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe
        C:\Windows\TEMP\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isC01A.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A315E52-8150-4485-8DD0-C1C6AE6D1512}
        3⤵
        • Executes dropped EXE
        PID:5324
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRServer.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3148
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRServer.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3452
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRApp.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6108
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRApp.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3388
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAppPB.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3084
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAppPB.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5620
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeature.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5092
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeature.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1048
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRFeatMini.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2080
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRFeatMini.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRManager.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5780
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRManager.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5016
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAgent.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5204
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAgent.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1716
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6080
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:5504
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRAudioChat.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4000
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRAudioChat.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3800
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe /C "taskkill.exe /F /IM SRVirtualDisplay.exe /T"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3724
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill.exe /F /IM SRVirtualDisplay.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:2648
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B9772220-4389-4EFC-8F2E-4A0E47D7C944}
        3⤵
        • Executes dropped EXE
        PID:3480
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{200B49E7-5B85-44E8-9145-B65FDE237FE2}
        3⤵
        • Executes dropped EXE
        PID:3912
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DF0452A7-6A81-4DC9-A860-5D59E4EB47AA}
        3⤵
        • Executes dropped EXE
        PID:5140
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BC14C84A-3F56-487E-B28D-5D2739C84459}
        3⤵
        • Executes dropped EXE
        PID:2828
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CEE4966D-9EF0-47C7-BF0E-3D76E8738BEA}
        3⤵
        • Executes dropped EXE
        PID:6136
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BFDCBF5A-8971-401C-A69E-E20AA522C533}
        3⤵
        • Executes dropped EXE
        PID:4936
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9CACCC10-2350-49CE-B884-7E9D9364090C}
        3⤵
        • Executes dropped EXE
        PID:1072
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8B7AB54-68BD-47D0-A58D-D11D191F099A}
        3⤵
        • Executes dropped EXE
        PID:1028
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{27084AAC-643F-4947-9CD7-9BFF14230128}
        3⤵
        • Executes dropped EXE
        PID:5612
      • C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
        C:\Windows\TEMP\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8DD0C41-C6AF-4D9D-A90A-B180E0216A52}
        3⤵
        • Executes dropped EXE
        PID:2920
      • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
        C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE52C0C2-A314-4530-BD0B-C8A68D890B98}
        3⤵
        • Executes dropped EXE
        PID:4112
      • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
        C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{17FCE676-0F00-422A-AD1E-8698BB15D75D}
        3⤵
          PID:5980
        • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
          C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5922C85C-D9A9-4AD9-A5A0-C34141B374C3}
          3⤵
            PID:4568
          • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
            C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71D26745-0A7F-470D-94AB-8BB52FFADBED}
            3⤵
              PID:5728
            • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
              C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{24B1636A-D264-47CD-8892-C8A9A5268253}
              3⤵
                PID:2932
              • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
                C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B7C3EE78-9064-4486-9343-38F3F4013E9F}
                3⤵
                  PID:1756
                • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
                  C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BDDE89DC-BE15-4737-8D31-3AB2A3EBF6A1}
                  3⤵
                    PID:5232
                  • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
                    C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{42084B2A-FBD2-408A-9AF3-44AA29C03D71}
                    3⤵
                      PID:2760
                    • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
                      C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A3899D77-498C-49EC-8BD6-9D2AC93BD4F2}
                      3⤵
                        PID:964
                      • C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe
                        C:\Windows\TEMP\{25D6C41C-F3B2-4CCD-8C07-FA1140B4D597}\_isF584.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FAF67DDD-5135-4BDC-B93C-E397D1FBA0DF}
                        3⤵
                          PID:5532
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ADDUSERINFO /V "sec_opt=0,confirm_d=0,hidewindow=1"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1816
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P USERSESSIONID
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:540
                        • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe
                          "C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Support\SetupUtil.exe" /P ST_EVENT
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5800
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\sysnative\cmd.exe" /C "C:\Windows\system32\wevtutil.exe" um "C:\ProgramData\Splashtop\Common\Event\stevt_srs_provider.man"
                            4⤵
                              PID:4552
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4848
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                        1⤵
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Modifies system certificate store
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2464
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                          2⤵
                          • Launches sc.exe
                          PID:1680
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "7685921a-f919-4e43-b450-8cdb5c123e52" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002SMHs1AAH
                          2⤵
                          • Drops file in System32 directory
                          • Executes dropped EXE
                          PID:1168
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "3ae4740c-9e72-4ff5-b7c9-b0496ade91dc" agent-api.atera.com/Production 443 or8ixLi90Mf "minimalIdentification" 0013z00002SMHs1AAH
                          2⤵
                          • Drops file in System32 directory
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          PID:316
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "2945ab5a-6d30-4ff1-8b14-4b5adfe9c609" agent-api.atera.com/Production 443 or8ixLi90Mf "identified" 0013z00002SMHs1AAH
                          2⤵
                          • Executes dropped EXE
                          PID:4660
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "f1aa19cf-e3a0-437c-850b-dafec696803e" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo fromGui" 0013z00002SMHs1AAH
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of WriteProcessMemory
                          PID:4940
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2552
                            • C:\Windows\system32\cscript.exe
                              cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                              4⤵
                              • Modifies data under HKEY_USERS
                              PID:960
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "b24186bf-5d3f-4866-8fb7-f29290adb0c0" agent-api.atera.com/Production 443 or8ixLi90Mf "syncprofile" 0013z00002SMHs1AAH
                          2⤵
                          • Drops file in System32 directory
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3628
                      • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                        "C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe"
                        1⤵
                        • Drops file in Program Files directory
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4932
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                          2⤵
                          • Launches sc.exe
                          PID:3540
                        • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                          "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "198721ae-1222-424c-8781-26430e765cf9" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002SMHs1AAH
                          2⤵
                          • Executes dropped EXE
                          PID:4064
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                            3⤵
                              PID:5668
                              • C:\Windows\system32\cscript.exe
                                cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                4⤵
                                • Modifies data under HKEY_USERS
                                PID:2028
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "65b64869-36e9-4873-8d28-ce4b30d0fb5f" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3856
                            • C:\Windows\TEMP\SplashtopStreamer.exe
                              "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              • Suspicious use of SetWindowsHookEx
                              PID:2216
                              • C:\Windows\Temp\unpack\PreVerCheck.exe
                                "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:6108
                                • C:\Windows\SysWOW64\msiexec.exe
                                  msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2552
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "11342457-d0db-4441-b0f4-42b3408bf9d3" agent-api.atera.com/Production 443 or8ixLi90Mf "checkforupdates" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2556
                            • C:\Windows\SYSTEM32\msiexec.exe
                              "msiexec.exe" /i C:\Windows\TEMP\ateraAgentSetup64_1_8_7_2.msi /lv* AteraSetupLog.txt /qn /norestart
                              3⤵
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5976
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "7cb6789f-7cab-4b88-8f0a-7f89be035b5c" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:828
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "5c8569da-b2a0-42ad-8d28-e99cc05a0c62" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            PID:2256
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "854901be-bd8c-498a-b0f2-a63c9abd9a15" agent-api.atera.com/Production 443 or8ixLi90Mf "maintain" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1396
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "3618cbf2-89ed-4743-9a76-c46052b10936" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            PID:5284
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "7e56b3da-0e6a-4e85-aae1-db35694b0bd1" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            PID:5756
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "f2f771ca-8c89-4795-bb7d-6dbc80ad4a57" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5780
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "5d140a7c-83e7-4e62-9c3c-cee0311454ed" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            PID:5836
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /K "cd /d C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                              3⤵
                              • System Time Discovery
                              PID:4468
                              • C:\Program Files\dotnet\dotnet.exe
                                dotnet --list-runtimes
                                4⤵
                                • System Time Discovery
                                PID:3556
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "75a366f3-1718-41bc-aba4-92a4e1fefbb0" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            PID:4456
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "ea272d28-74db-4668-b43e-35fad0d07da1" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002SMHs1AAH
                            2⤵
                            • Writes to the Master Boot Record (MBR)
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1904
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "92d30e36-76fc-4375-ae5d-7b87d7e7eca8" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002SMHs1AAH
                            2⤵
                            • Executes dropped EXE
                            PID:3604
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "de53ad4c-00df-4863-888c-cbbf09971ec2" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            PID:5164
                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                            "C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "e22a422b-f2d9-4d86-af7b-ea57b8fc28d1" agent-api.atera.com/Production 443 or8ixLi90Mf "connect" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in System32 directory
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5804
                            • C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe
                              "C:\Windows\TEMP\Agent.Package.Availability\Agent.Package.Availability.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e e22a422b-f2d9-4d86-af7b-ea57b8fc28d1 agent-api.atera.com/Production 443 or8ixLi90Mf connect 0013z00002SMHs1AAH
                              3⤵
                              • Executes dropped EXE
                              PID:5556
                        • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe
                          "C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.exe"
                          1⤵
                          • Drops file in Program Files directory
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          PID:5508
                          • C:\Windows\System32\sc.exe
                            "C:\Windows\System32\sc.exe" failure AteraAgent reset= 600 actions= restart/25000
                            2⤵
                            • Launches sc.exe
                            PID:5656
                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "aeecb7ac-0c58-4e53-a75e-1bf66c16f9aa" agent-api.atera.com/Production 443 or8ixLi90Mf "heartbeat" 0013z00002SMHs1AAH
                            2⤵
                            • Executes dropped EXE
                            PID:1716
                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "800da517-3dc4-4740-8672-5bd3aa7c469d" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBcmd1bWVudHMiOiJ7XHUwMDIyQ29tbWFuZE5hbWVcdTAwMjI6XHUwMDIybWFpbnRlbmFuY2VcdTAwMjIsXHUwMDIyRW5hYmxlZFx1MDAyMjp0cnVlLFx1MDAyMlJlcGVhdEludGVydmFsTWludXRlc1x1MDAyMjoxMCxcdTAwMjJEYXlzSW50ZXJ2YWxcdTAwMjI6MSxcdTAwMjJSZXBlYXREdXJhdGlvbkRheXNcdTAwMjI6MX0ifQ==" 0013z00002SMHs1AAH
                            2⤵
                            • Executes dropped EXE
                            PID:3880
                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "646350e1-0212-4f54-8b08-6636a1e5e8ae" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJBZENvbW1hbmRUeXBlIjo1LCJJbnN0YWxsYXRpb25GaWxlVXJsIjoiaHR0cHM6Ly9nZXQuYW55ZGVzay5jb20vOENRc3U5a3YvQW55RGVza19DdXN0b21fQ2xpZW50Lm1zaSIsIkZvcmNlSW5zdGFsbCI6ZmFsc2UsIlRhcmdldFZlcnNpb24iOiIifQ==" 0013z00002SMHs1AAH
                            2⤵
                            • Executes dropped EXE
                            PID:5480
                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "d8b7d604-5186-44e2-86c0-f319f5d1bf83" agent-api.atera.com/Production 443 or8ixLi90Mf "pollAll" 0013z00002SMHs1AAH
                            2⤵
                            • Executes dropped EXE
                            PID:5904
                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                            "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "c9f00eef-9bd4-453f-8a7e-183f239d6660" agent-api.atera.com/Production 443 or8ixLi90Mf "generalinfo" 0013z00002SMHs1AAH
                            2⤵
                            • Drops file in Program Files directory
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            PID:1868
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                              3⤵
                                PID:2452
                                • C:\Windows\system32\cscript.exe
                                  cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /dstatus
                                  4⤵
                                  • Modifies data under HKEY_USERS
                                  PID:1800
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "4912a24e-590e-465d-9877-1b79caab116c" agent-api.atera.com/Production 443 or8ixLi90Mf "agentprovision" 0013z00002SMHs1AAH
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              PID:5624
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "12d4cce1-cf3d-4c30-832c-19fdf6aabdba" agent-api.atera.com/Production 443 or8ixLi90Mf "eyJDb21tYW5kTmFtZSI6Imluc3RhbGxkb3RuZXQiLCJEb3ROZXRWZXJzaW9uIjoiNi4wLjM1IiwiTWFjQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByLzU4OTc4Y2ViLTVkZTMtNDllMi1iNTcxLTk3MjgyNWIwOGYwYS9mMWJkOWIxYmI1YjI1YjhjOWNlZTQwZWQ5YTNkODAyMy9kb3RuZXQtcnVudGltZS02LjAuMzUtb3N4LWFybTY0LnBrZyIsIk1hY1g2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci8yNjkyMDY2NC1kNzU0LTRmNzYtOWM5OS1lNjkxMTYzNDhlODIvYTQwMzE1MzcxY2M2MDdjOWYxODQ3OGM5M2YyYTY3NmEvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LW9zeC14NjQucGtnIiwiV2luQVJNRG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2EyMjNjNDViLTQ3NzctNDA1Ni1hZWEyLTY1M2M1NzZkODExNS9iZjhhZjYzYzZlNjI1YmU0YWZhODVlYzA5M2U4MWU2NS9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLWFybTY0LmV4ZSIsIldpblg2NERvd25sb2FkVXJsIjoiaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9jNGY2NTYyMS1iMzZiLTQ2YTktODM4MC1kNWI2NjBiZWYyN2UvMDE4NWZkNzIwNTVkY2RjYTg2MTY2Yjk5YWRkNzE2ODYvZG90bmV0LXJ1bnRpbWUtNi4wLjM1LXdpbi14NjQuZXhlIiwiV2luWDg2RG93bmxvYWRVcmwiOiJodHRwczovL2Rvd25sb2FkLnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tL2Rvd25sb2FkL3ByL2E5MGZiNWRjLWY0ODgtNDAwZS04NWNhLTg0M2ExMzY0MGY1Ni80ODNkMjQ2MzhjYzJiZWRhZGRhYjQzNzM0YWEyZTQ0Ny9kb3RuZXQtcnVudGltZS02LjAuMzUtd2luLXg4Ni5leGUiLCJNYWNBUk1DaGVja3N1bSI6IlVlSmJHR0dWb2NwZmdpckU2eDVNN29MQzhBS2NOSjk4SDNFcmJ0L0taS0dPdWxpQ1Flc1x1MDAyQmx6Wno5XHUwMDJCcnQwdXJMZ2FEeng0cmtXZm0veWg5UWI1RFRKUT09IiwiTWFjWDY0Q2hlY2tzdW0iOiJaZFZQVmRFSG40ZXFkdlNPUksxRUpXcjdnOUt5b0RZSXp6czQzOUxKeHYvZkFRdG5iTjk3OE8yTm1pNGtRSFNkdlJJazEvNFx1MDAyQjlycTZPMEx2Q2FnL1d3PT0iLCJXaW5BUk1DaGVja3N1bSI6IldlTGhodXU3Vi96NEs2WGVubDBINDVWWDExb0ZhdHdvV1BNa2pEQ2dobmhrTm5US2tqZjc0eUFcdTAwMkJcdTAwMkJ0Ri9VU1ZDZXE2T2dRbHI2V1Y1dU1rRWwxUVdqUT09IiwiV2luWDY0Q2hlY2tzdW0iOiJEREtSSlRFanp6XHUwMDJCSWUxMldTM2Y0aHVKQlNpeXR4TkRwQlI2SXpFeHpkM2ZBb0toNVV5MkEwbTlKOFU0ZVh5VmJxeEhjZzB3M25hWW1FZFNFeEwzMEZnPT0iLCJXaW5YODZDaGVja3N1bSI6IjdtSUF5bG9IeWxIVFVJakhud3NXeVVOXHUwMDJCVWU0alk3eXBrZVx1MDAyQnEyM2xNbEdzR0hpVUc1b21scW1LOVEvYVViODhLXHUwMDJCTnBGMWNaUVpXQjVJb3ZtTzVucWN3PT0iLCJXb3Jrc3BhY2VJZCI6ImJmMGNlNDlkLTc3Y2YtNDcyMS1iZjcwLTU3Njg2MzgzYzlhYiIsIkxvZ05hbWUiOiJEb3ROZXRSdW50aW1lSW5zdGFsbGF0aW9uUmVwb3J0IiwiU2hhcmVkS2V5IjoialVJUy9UOUNSVkRlS3hZZzRVcjNhQ2hoV1F1Y1k3UFZ2d2cwekh1cUpzY3JUampRMkx3SzZVamZ1N2NBMk5wckFSMHIvU1JBWEpZWWxkUEtLRnlLS1E9PSJ9" 0013z00002SMHs1AAH
                              2⤵
                              • Executes dropped EXE
                              PID:4440
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /K "cd /d C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\" /
                                3⤵
                                • System Time Discovery
                                PID:404
                                • C:\Program Files\dotnet\dotnet.exe
                                  dotnet --list-runtimes
                                  4⤵
                                  • System Time Discovery
                                  PID:5596
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "d4937795-9bc6-48c3-96e5-2e5438495afa" agent-api.atera.com/Production 443 or8ixLi90Mf "probe" 0013z00002SMHs1AAH
                              2⤵
                              • Executes dropped EXE
                              PID:5404
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "c36b1928-0674-497d-85cf-786a143002be" agent-api.atera.com/Production 443 or8ixLi90Mf "downloadifneeded" 0013z00002SMHs1AAH
                              2⤵
                              • Executes dropped EXE
                              PID:2548
                              • C:\Windows\TEMP\SplashtopStreamer.exe
                                "C:\Windows\TEMP\SplashtopStreamer.exe" prevercheck /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Modifies data under HKEY_USERS
                                • Suspicious use of SetWindowsHookEx
                                PID:5956
                                • C:\Windows\Temp\unpack\PreVerCheck.exe
                                  "C:\Windows\Temp\unpack\PreVerCheck.exe" /s /i sec_opt=0,confirm_d=0,hidewindow=1
                                  4⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:2864
                                  • C:\Windows\SysWOW64\msiexec.exe
                                    msiexec /norestart /i "setup.msi" /qn /l*v "C:\Windows\TEMP\PreVer.log.txt" CA_EXTPATH=1 USERINFO="sec_opt=0,confirm_d=0,hidewindow=1"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3872
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "83b1e986-34a3-4206-9fc5-00f2db45a5ea" agent-api.atera.com/Production 443 or8ixLi90Mf "monitor" 0013z00002SMHs1AAH
                              2⤵
                              • Writes to the Master Boot Record (MBR)
                              • Executes dropped EXE
                              PID:5076
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "1678caff-c814-41b9-9a42-9ca8ef73e166" agent-api.atera.com/Production 443 or8ixLi90Mf "syncinstalledapps" 0013z00002SMHs1AAH
                              2⤵
                              • Drops file in Program Files directory
                              • Executes dropped EXE
                              PID:3708
                            • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                              "C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe" dff7aed2-9ad0-4b26-a619-6cdf47fed95e "c4a4c125-95a9-4525-80f4-ed4ef7c67a9e" agent-api.atera.com/Production 443 or8ixLi90Mf "getlistofallupdates" 0013z00002SMHs1AAH
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              PID:4840

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Persistence

                          Event Triggered Execution

                          2
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Installer Packages

                          1
                          T1546.016

                          Pre-OS Boot

                          1
                          T1542

                          Bootkit

                          1
                          T1542.003

                          Privilege Escalation

                          Event Triggered Execution

                          2
                          T1546

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Installer Packages

                          1
                          T1546.016

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Pre-OS Boot

                          1
                          T1542

                          Bootkit

                          1
                          T1542.003

                          Subvert Trust Controls

                          1
                          T1553

                          Install Root Certificate

                          1
                          T1553.004

                          System Binary Proxy Execution

                          1
                          T1218

                          Msiexec

                          1
                          T1218.007

                          Credential Access

                          Discovery

                          Peripheral Device Discovery

                          2
                          T1120

                          Query Registry

                          4
                          T1012

                          System Information Discovery

                          3
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Time Discovery

                          1
                          T1124

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Config.Msi\e580403.rbs
                            Filesize

                            8KB

                            MD5

                            307fc434289821d369e08291ef547587

                            SHA1

                            03f097419b8850498e61a61eea925078e3151675

                            SHA256

                            3ce2ae223b906b7de9b233ff36c1867312e0ce9f64e4c1e496e038a1f4269752

                            SHA512

                            db1662379e8bc15f0c80f2307cb3ffa15452f03f1cf1b155d5768258573b5f1617d9949acd6224e04c6a19e1abf36d0e00e2c1010a6b767e5a3fa41684b73c2c

                            Download Submit

                          • C:\Config.Msi\e58040a.rbs
                            Filesize

                            9KB

                            MD5

                            501441bcf418ff3cea27ff288822e539

                            SHA1

                            f89e8316a3fa096c46da40cf41a1509e01161560

                            SHA256

                            df7ab595fc9390cf36dc0a2db654c07fc0a117a283f31265af42a47a249319ba

                            SHA512

                            a465028091d8cb71ed04f06fdab493a2829416ead7e0eae7e50f983c31d15c3d2f6d0aa6a08c1341909131f80bdc086dea63c466617ba9b3a3e4e78295ad0cf5

                            Download Submit

                          • C:\Config.Msi\e580412.rbs
                            Filesize

                            8KB

                            MD5

                            6c6302adfd84ccd32ae35a6067b58594

                            SHA1

                            039bf336e0c4446cec1b717ceb5e25e143334526

                            SHA256

                            af1710ba900ee3ffb098b96ab7f75dc713ae8a0ed39d29eb462715fa9b8beed3

                            SHA512

                            e967b90374be8710fabf25240cc0b901e7163e4afdd0eed24247890cea0c9547bd5833c41d717768c6a02a4dde2190768fa3299961a7e030ba558f36c06c4811

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                            Filesize

                            1KB

                            MD5

                            3840b31c383fdf49bfd6740d945c9032

                            SHA1

                            a6f50164a69718bcef4664d7c47534f0d721866a

                            SHA256

                            1f119f4fda8028b420e70ee1637c65e2b4198b41eb3eb44d911afa6f1a0bbc64

                            SHA512

                            f5315421d4bc5f08fef4e1449e5799ddf311f08eda317a9eaad8c88c2e7b7c26182bd586c0221ffe5f4112e5d6e05f5d45d2d0382b0ed51ca25aa94d4d95a84d

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe
                            Filesize

                            142KB

                            MD5

                            477293f80461713d51a98a24023d45e8

                            SHA1

                            e9aa4e6c514ee951665a7cd6f0b4a4c49146241d

                            SHA256

                            a96a0ba7998a6956c8073b6eff9306398cc03fb9866e4cabf0810a69bb2a43b2

                            SHA512

                            23f3bd44a5fb66be7fea3f7d6440742b657e4050b565c1f8f4684722502d46b68c9e54dcc2486e7de441482fcc6aa4ad54e94b1d73992eb5d070e2a17f35de2f

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\AteraAgent.exe.config
                            Filesize

                            1KB

                            MD5

                            b3bb71f9bb4de4236c26578a8fae2dcd

                            SHA1

                            1ad6a034ccfdce5e3a3ced93068aa216bd0c6e0e

                            SHA256

                            e505b08308622ad12d98e1c7a07e5dc619a2a00bcd4a5cbe04fe8b078bcf94a2

                            SHA512

                            fb6a46708d048a8f964839a514315b9c76659c8e1ab2cd8c5c5d8f312aa4fb628ab3ce5d23a793c41c13a2aa6a95106a47964dad72a5ecb8d035106fc5b7ba71

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\ICSharpCode.SharpZipLib.dll
                            Filesize

                            210KB

                            MD5

                            c106df1b5b43af3b937ace19d92b42f3

                            SHA1

                            7670fc4b6369e3fb705200050618acaa5213637f

                            SHA256

                            2b5b7a2afbc88a4f674e1d7836119b57e65fae6863f4be6832c38e08341f2d68

                            SHA512

                            616e45e1f15486787418a2b2b8eca50cacac6145d353ff66bf2c13839cd3db6592953bf6feed1469db7ddf2f223416d5651cd013fb32f64dc6c72561ab2449ae

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Newtonsoft.Json.dll
                            Filesize

                            693KB

                            MD5

                            2c4d25b7fbd1adfd4471052fa482af72

                            SHA1

                            fd6cd773d241b581e3c856f9e6cd06cb31a01407

                            SHA256

                            2a7a84768cc09a15362878b270371daad9872caacbbeebe7f30c4a7ed6c03ca7

                            SHA512

                            f7f94ec00435466db2fb535a490162b906d60a3cfa531a36c4c552183d62d58ccc9a6bb8bbfe39815844b0c3a861d3e1f1178e29dbcb6c09fa2e6ebbb7ab943a

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\Agent.Package.Availability.exe
                            Filesize

                            158KB

                            MD5

                            1922740d2479c7d0cd6fb57c3d739543

                            SHA1

                            877a807a396156be1d0c2782391cabc29ea15760

                            SHA256

                            20443f66e184311fd412158cb162e36b0172332cd6d401cec9ee5fe17df75e58

                            SHA512

                            d624bad0fcd8afc190a5de241da341a3f39d6aaa0e5eacdf8b14e8e74515b688f06e2cdc75da0634880ea98238a1d26cd2d2bfaedb6d92067dace99d0963975c

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Availability\data\iot_conf.json
                            Filesize

                            189B

                            MD5

                            5c5f2a573ba00a8966d94c36a645c4dc

                            SHA1

                            d6ddd912f766aede7768c86f4ce785988ec18f58

                            SHA256

                            96e82ac944e2fe250700221dd17ad64b8927dd3dfcbdb8520acfa132d8b7a503

                            SHA512

                            dac029e82797621a38b89849b71c8ceb4e98c067fffa2442446b658a3bf5454cc1502395dfc788e615c9dc49ab9a1f432fc079b9b71990493b15b71b80652f11

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog\Agent.Package.Watchdog.exe
                            Filesize

                            157KB

                            MD5

                            242d415e238789fbc57c5ac7e8ca5d02

                            SHA1

                            09c1e25e035be67c9fbfa23b336e26bfd2c76d04

                            SHA256

                            7f3ded5bf167553a5a09ca8a9d80a451eb71ccecc043bda1dd8080a2cbe35fa2

                            SHA512

                            ac55d401951ecf0112051db033cc9014e824ab6a5ed9ea129a8793408d9bf2446cb3c15711e59a8577e0f60d858a4639e99e38d6232315f0f39df2c40217ea40

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote\AgentPackageADRemote.exe
                            Filesize

                            51KB

                            MD5

                            3180c705182447f4bcc7ce8e2820b25d

                            SHA1

                            ad6486557819a33d3f29b18d92b43b11707aae6e

                            SHA256

                            5b536eda4bff1fdb5b1db4987e66da88c6c0e1d919777623344cd064d5c9ba22

                            SHA512

                            228149e1915d8375aa93a0aff8c5a1d3417df41b46f5a6d9a7052715dbb93e1e0a034a63f0faad98d4067bcfe86edb5eb1ddf750c341607d33931526c784eb35

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.INI
                            Filesize

                            12B

                            MD5

                            eb053699fc80499a7185f6d5f7d55bfe

                            SHA1

                            9700472d22b1995c320507917fa35088ae4e5f05

                            SHA256

                            bce3dfdca8f0b57846e914d497f4bb262e3275f05ea761d0b4f4b778974e6967

                            SHA512

                            d66fa39c69d9c6448518cb9f98cbdad4ce5e93ceef8d20ce0deef91fb3e512b5d5a9458f7b8a53d4b68d693107872c5445e99f87c948878f712f8a79bc761dbf

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe
                            Filesize

                            173KB

                            MD5

                            fd9df72620bca7c4d48bc105c89dffd2

                            SHA1

                            2e537e504704670b52ce775943f14bfbaf175c1b

                            SHA256

                            847d0cd49cce4975bafdeb67295ed7d2a3b059661560ca5e222544e9dfc5e760

                            SHA512

                            47228cbdba54cd4e747dba152feb76a42bfc6cd781054998a249b62dd0426c5e26854ce87b6373f213b4e538a62c08a89a488e719e2e763b7b968e77fbf4fc02

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation\AgentPackageAgentInformation.exe.config
                            Filesize

                            546B

                            MD5

                            158fb7d9323c6ce69d4fce11486a40a1

                            SHA1

                            29ab26f5728f6ba6f0e5636bf47149bd9851f532

                            SHA256

                            5e38ef232f42f9b0474f8ce937a478200f7a8926b90e45cb375ffda339ec3c21

                            SHA512

                            7eefcc5e65ab4110655e71bc282587e88242c15292d9c670885f0daae30fa19a4b059390eb8e934607b8b14105e3e25d7c5c1b926b6f93bdd40cbd284aaa3ceb

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat\AgentPackageHeartbeat.exe
                            Filesize

                            27KB

                            MD5

                            797c9554ec56fd72ebb3f6f6bef67fb5

                            SHA1

                            40af8f7e72222ba9ec2ea2dd1e42ff51dc2eb1bb

                            SHA256

                            7138b6beda7a3f640871e232d93b4307065ab3cd9cfac1bd7964a6bec9e60f49

                            SHA512

                            4f461a8a25da59f47ced0c0dbf59318ddb30c21758037e22bbaa3b03d08ff769bfd1bfc7f43f0e020df8ae4668355ab4b9e42950dca25435c2dd3e9a341c4a08

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller\AgentPackageInternalPoller.exe
                            Filesize

                            214KB

                            MD5

                            01807774f043028ec29982a62fa75941

                            SHA1

                            afc25cf6a7a90f908c0a77f2519744f75b3140d4

                            SHA256

                            9d4727352bf6d1cca9cba16953ebd1be360b9df570fd7ba022172780179c251e

                            SHA512

                            33bd2b21db275dc8411da6a1c78effa6f43b34afd2f57959e2931aa966edea46c78d7b11729955879889cbe8b81a8e3fb9d3f7e4988e3b7f309cbd1037e0dc02

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.exe
                            Filesize

                            37KB

                            MD5

                            efb4712c8713cb05eb7fe7d87a83a55a

                            SHA1

                            c94d106bba77aecf88540807da89349b50ea5ae7

                            SHA256

                            30271d8a49c2547ab63a80bc170f42e9f240cf359a844b10bc91340444678e75

                            SHA512

                            3594955ad79a07f75c697229b0de30c60c2c7372b5a94186a705159a25d2e233e398b9e2dc846b8b47e295dcddd1765a8287b13456c0a3b3c4e296409a428ef8

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring.zip
                            Filesize

                            3.4MB

                            MD5

                            e010d1f614b1a830482d3df4ba056f24

                            SHA1

                            5873e22b8c51a808c06a3bbf425fcf02b2a80328

                            SHA256

                            98a98dd1df25d31a01d47eaf4fa65d5f88bc0ad166f8f31d68f2994b4f739a9b

                            SHA512

                            727877929530e08062611868fd751d1b64e4c7d28c26b70f14c7cd942b1ae1579cba2a2ef038bad07032ef728ae277963ffb3e1ab7a5c28351326fabad84daa6

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.exe
                            Filesize

                            389KB

                            MD5

                            5e3252e0248b484e76fcdbf8b42a645d

                            SHA1

                            11ae92fd16ac87f6ab755911e85e263253c16516

                            SHA256

                            01f464fbb9b0bfd0e16d4ad6c5de80f7aad0f126e084d7f41fef36be6ec2fc8e

                            SHA512

                            540d6b3ca9c01e3e09673601514af701a41e7d024070de1257249c3c077ac53852bd04ab4ac928a38c9c84f423a6a3a89ab0676501a9edc28f95de83818fb699

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                            Filesize

                            48KB

                            MD5

                            89a87d1aff5a4418dac706d33afdbfd6

                            SHA1

                            caf242ed747d11b8efe2926b8f067b96ae6289de

                            SHA256

                            82068fde5e2beff349feeeb0a093902cb807c6a91e13669290a3ea4b75dd96f9

                            SHA512

                            096174c65d1b91298c24f0969c1778aaf1344e39532cf8721da5667a60c44efe9cf92d162f95b86cf27250b47e14cd09120fe283d54d1cd4d92d324cf6a15608

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates\AgentPackageOsUpdates.exe
                            Filesize

                            196KB

                            MD5

                            680bac4393da4dafe0100d9483d3b6e4

                            SHA1

                            ed211ef61232c5aacee7ca168659f02f9d4f4e53

                            SHA256

                            c085580ab859de8fedba47ca694ab475fad9b87d4093586db3524e60d8383f73

                            SHA512

                            5756c46b3cf0c55957c4d885f7cba9fa71e051e1050fdbc18b6871db044109755e9e936ce984e9e3bd30cc6bae2902b9b618f895cc95ad3d605d9586ca5ac01b

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\AgentPackageProgramManagement.exe
                            Filesize

                            56KB

                            MD5

                            0f33a7acb33960d1306ba418405d8264

                            SHA1

                            bc24c37727b00d514446c8b5fb6c04f36254a067

                            SHA256

                            a43f099127bfe1640deca971252e573fe1745b04f29aa6b2fd672226799739c6

                            SHA512

                            72a99786acd4b1322e63eb253bbc651d5ec0fee83984e5214c3faf7aff489389375bf724ecfcfce5e78905bdb3e7d8a99dbae424a59b73d38a55be0657c1ec33

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config
                            Filesize

                            9KB

                            MD5

                            9d1528a2ce17522f6de064ae2c2b608e

                            SHA1

                            2f1ce8b589e57ab300bb93dde176689689f75114

                            SHA256

                            11c9ad150a0d6c391c96e2b7f8ad20e774bdd4e622fcdfbf4f36b6593a736311

                            SHA512

                            a19b54ed24a2605691997d5293901b52b42f6af7d6f6fda20b9434c9243cc47870ec3ae2b72bdea0e615f4e98c09532cb3b87f20c4257163e782c7ab76245e94

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\config\chocolatey.config.5780.update
                            Filesize

                            9KB

                            MD5

                            14ffcf07375b3952bd3f2fe52bb63c14

                            SHA1

                            ab2eadde4c614eb8f1f2cae09d989c5746796166

                            SHA256

                            6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

                            SHA512

                            14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\logs\chocolatey.log
                            Filesize

                            7KB

                            MD5

                            b624e12de8c072006e21926b27714df5

                            SHA1

                            970795a40d1ee28b0d2b7434bf7766191a781562

                            SHA256

                            249fbab354d06f6f57932fe32e1b85ff8b22e352a59a6f662062232f83835d7e

                            SHA512

                            78cab149d9f423b80d966f2aff57351432ed0efcb3cf2495544435ce30c001db686dd5c63b14269581cdd7c4ff8781bb0d6f8389c63c5d97e8643349e496f61c

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement\redirects\cpush.exe.ignore
                            Filesize

                            2B

                            MD5

                            81051bcc2cf1bedf378224b0a93e2877

                            SHA1

                            ba8ab5a0280b953aa97435ff8946cbcbb2755a27

                            SHA256

                            7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

                            SHA512

                            1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller\AgentPackageRuntimeInstaller.exe
                            Filesize

                            54KB

                            MD5

                            77c613ffadf1f4b2f50d31eeec83af30

                            SHA1

                            76a6bfd488e73630632cc7bd0c9f51d5d0b71b4c

                            SHA256

                            2a0ead6e9f424cbc26ef8a27c1eed1a3d0e2df6419e7f5f10aa787377a28d7cf

                            SHA512

                            29c8ae60d195d525650574933bad59b98cf8438d47f33edf80bbdf0c79b32d78f0c0febe69c9c98c156f52219ecd58d7e5e669ae39d912abe53638092ed8b6c3

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote\AgentPackageSTRemote.exe
                            Filesize

                            71KB

                            MD5

                            5129e29d4d9a8ed94e04099622316b37

                            SHA1

                            be1c537ad5fc51bd28bd3ea23e16cbfbdaf01dfd

                            SHA256

                            17c1a413747e1dbf203f1824e45ddc0dc7afe4c529bca88cdb670f019d95db11

                            SHA512

                            7b8a1d79c069cdcbebd57255d11d96e13e291df8b99c15d6c969a66ef8af8639fac92e22b233b4b6f8b33a9c52ba2936fe59ecee2acf78c571f4920ea075e4bb

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools\AgentPackageSystemTools.exe
                            Filesize

                            50KB

                            MD5

                            254dcbee3213189461b66e962ce8cc05

                            SHA1

                            cf970344713cdfad9e35f85acdb0fa1e1721ca1c

                            SHA256

                            e2e7190e062d57287e242730c9daa32f32eeec26836f75290e66fc566f1ea119

                            SHA512

                            7955ba42cbf7b36831e663be7c9591656f7ad2b4ea5e8249a5458a1598a226bb28f1e7130f135cf590011170117ddcf425acf93c0725899b4e4ca54404a93be4

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageTicketing\AgentPackageTicketing.exe
                            Filesize

                            32KB

                            MD5

                            db1db66ebd9b15b7dcd55374ea56ee5e

                            SHA1

                            c22897eb20900a66cf62023c37d6a7d1192aec3d

                            SHA256

                            0263a627bbea55a66deecd7a43f8537bb68b5f95bb3d4269d3e594bd1d851e64

                            SHA512

                            b56b2143a60e6153e7fb752029c72d78547d5253f32ecbd0dda5a8acc5c3859292e860162b11a041a37b4f618f4425484b4e2385d7e2c621c8cbced073e3a67e

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Packages\AgentPackageUpgradeAgent\AgentPackageUpgradeAgent.exe
                            Filesize

                            56KB

                            MD5

                            e9794f785780945d2dde78520b9bb59f

                            SHA1

                            293cae66cedbc7385cd49819587d3d5a61629422

                            SHA256

                            0568e0d210de9b344f9ce278291acb32106d8425bdd467998502c1a56ac92443

                            SHA512

                            1a3c15e18557a14f0df067478f683e8b527469126792fae7b78361dad29317ff7b9d307b5a35e303487e2479d34830aa7e894f2906efff046436428ada9a4534

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\Pubnub.dll
                            Filesize

                            588KB

                            MD5

                            17d74c03b6bcbcd88b46fcc58fc79a0d

                            SHA1

                            bc0316e11c119806907c058d62513eb8ce32288c

                            SHA256

                            13774cc16c1254752ea801538bfb9a9d1328f8b4dd3ff41760ac492a245fbb15

                            SHA512

                            f1457a8596a4d4f9b98a7dcb79f79885fa28bd7fc09a606ad3cd6f37d732ec7e334a64458e51e65d839ddfcdf20b8b5676267aa8ced0080e8cf81a1b2291f030

                            Download Submit

                          • C:\Program Files (x86)\ATERA Networks\AteraAgent\log.txt
                            Filesize

                            219B

                            MD5

                            1cf0c0396e56ca33a3ff2a8d3b4c1cc8

                            SHA1

                            52ba2518c878022a56a6308417e89a43e7bd86a8

                            SHA256

                            00aed787f8e1b7fb814c60d4929ece77cac12ad1b641eca1a28843ecd955823e

                            SHA512

                            6207076a6ea50e6576cdc4e920d2e3873be91bd40e51fc653f91e091f4d5c1a81c89624e1113038781d06daec30b50c320444fe70361c489082f4c50500ff6d9

                            Download Submit

                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd.exe
                            Filesize

                            9KB

                            MD5

                            1ef7574bc4d8b6034935d99ad884f15b

                            SHA1

                            110709ab33f893737f4b0567f9495ac60c37667c

                            SHA256

                            0814aad232c96a4661081e570cf1d9c5f09a8572cfd8e9b5d3ead0fa0f5ca271

                            SHA512

                            947c306a3a1eec7fce29eaa9b8d4b5e00fd0918fe9d7a25e262d621fb3ee829d5f4829949e766a660e990d1ac14f87e13e5dbd5f7c8252ae9b2dc82e2762fb73

                            Download Submit

                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVAD\utils\DIFxCmd64.exe
                            Filesize

                            10KB

                            MD5

                            f512536173e386121b3ebd22aac41a4e

                            SHA1

                            74ae133215345beaebb7a95f969f34a40dda922a

                            SHA256

                            a993872ad05f33cb49543c00dfca036b32957d2bd09aaa9dafe33b934b7a3e4a

                            SHA512

                            1efa432ef2d61a6f7e7fc3606c5c982f1b95eabc4912ea622d533d540ddca1a340f8a5f4652af62a9efc112ca82d4334e74decf6ddbc88b0bd191060c08a63b9

                            Download Submit

                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon.exe
                            Filesize

                            76KB

                            MD5

                            b40fe65431b18a52e6452279b88954af

                            SHA1

                            c25de80f00014e129ff290bf84ddf25a23fdfc30

                            SHA256

                            800e396be60133b5ab7881872a73936e24cbebd7a7953cee1479f077ffcf745e

                            SHA512

                            e58cf187fd71e6f1f5cf7eac347a2682e77bc9a88a64e79a59e1a480cac20b46ad8d0f947dd2cb2840a2e0bb6d3c754f8f26fcf2d55b550eea4f5d7e57a4d91d

                            Download Submit

                          • C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\Driver\STVideo\utils\devcon64.exe
                            Filesize

                            80KB

                            MD5

                            3904d0698962e09da946046020cbcb17

                            SHA1

                            edae098e7e8452ca6c125cf6362dda3f4d78f0ae

                            SHA256

                            a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289

                            SHA512

                            c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallLog
                            Filesize

                            433B

                            MD5

                            cf5f69533151675ab4f248fbc8cdedeb

                            SHA1

                            eb736e17118ac79e341b49eb29ea04433e65e66f

                            SHA256

                            e774620005d8e57306dcad1f2b427044f0be3da21897de56258fed1f8c565486

                            SHA512

                            e9954bab77bc76a3b85bcd988f05356c8dfa1f109c5fd58e5f2d214ed266ddbc520159a416fbfb0a4e24133b143e873ee3d9e88d62db4c486403215d76394f84

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\AteraAgent.InstallState
                            Filesize

                            7KB

                            MD5

                            362ce475f5d1e84641bad999c16727a0

                            SHA1

                            6b613c73acb58d259c6379bd820cca6f785cc812

                            SHA256

                            1f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899

                            SHA512

                            7630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\Agent.Package.Watchdog.zip
                            Filesize

                            1.9MB

                            MD5

                            8de5a7a19d882820893d8b911c1710fb

                            SHA1

                            95cdf5855bc5e454c8944952697ab142f77124f7

                            SHA256

                            2bee5835a45e74f454648c57fef0d6fca40d64308f813cb759ccab1b2ab576a9

                            SHA512

                            3056784d9a1ae5a8a5dd92d7ed6ad1311e863e41a6ca5971aac5d626da1338da44d0828448aa9ab1f9edb88afbaaacd57660c4c102812bc94240654b8d5237a7

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageADRemote.zip
                            Filesize

                            1.1MB

                            MD5

                            9a9b1fd85b5f1dcd568a521399a0d057

                            SHA1

                            34ed149b290a3a94260d889ba50cb286f1795fa6

                            SHA256

                            88d5a5a4a1b56963d509989b9be1a914afe3e9ee25c2d786328df85da4a7820d

                            SHA512

                            7c1259dddff406fdaadb236bf4c7dfb734c9da34fd7bad9994839772e298ebf3f19f02eb0655e773ba82702aa9175337ba4416c561dc2cb604d08e271cc74776

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageAgentInformation.zip
                            Filesize

                            375KB

                            MD5

                            4a09a87d2004dac4b00687e9c9f15036

                            SHA1

                            c78bb288e7a96642093abe44cb9b7bbd3ec447ba

                            SHA256

                            2dbc8cf2592604c09793cbed61e0b072b1b1ffa375fb3c9abca83fa0e18ab9a5

                            SHA512

                            f555f5a0bb80514bc71bb33a77620d28a9e6715e538372aaa7f0500bc8d5bfe8511f5ca982e15304422479ff693e6f38510d6616a94580fc1b105dd2da605eaa

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageHeartbeat.zip
                            Filesize

                            321KB

                            MD5

                            d3901e62166e9c42864fe3062cb4d8d5

                            SHA1

                            c9c19eec0fa04514f2f8b20f075d8f31b78bae70

                            SHA256

                            dbc0e52e6de93a0567a61c7b1e86daa51fbef725a4a31eef4c9bbff86f43671c

                            SHA512

                            ae33e57759e573773b9bb79944b09251f0dc4e07cdb8f373ec06963abfc1e6a6326df7f3b5fecf90bd2b060e3cb5a48b913b745cc853ac32d2558a8651c76111

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageInternalPoller.zip
                            Filesize

                            814KB

                            MD5

                            9b1f97a41bfb95f148868b49460d9d04

                            SHA1

                            768031d5e877e347a249dfdeab7c725df941324b

                            SHA256

                            09491858d849212847e4718d6cc8f2b1bc3caa671ceb165cf522290b960262e4

                            SHA512

                            9c8929a78cb459f519ace48db494d710efd588a19a7dbea84f46d02563cc9615db8aa78a020f08eca6fa2b99473d15c8192a513b4df8073aef595040d8962ae4

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace.zip
                            Filesize

                            1.2MB

                            MD5

                            e74d2a16da1ddb7f9c54f72b8a25897c

                            SHA1

                            32379af2dc1c1cb998dc81270b7d6be054f7c1a0

                            SHA256

                            a0c2f9479b5e3da9d7a213ebc59f1dd983881f4fc47a646ffc0a191e07966f46

                            SHA512

                            52b8de90dc9ca41388edc9ae637d5b4ce5c872538c87cc3e7d45edcf8eff78b0f5743ab4927490abda1cff38f2a19983b7ccc0fe3f854b0eacca9c9ce28eda75

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMarketplace\AgentPackageMarketplace.ini
                            Filesize

                            11B

                            MD5

                            5eda46a55c61b07029e7202f8cf1781c

                            SHA1

                            862ee76fc1e20a9cc7bc1920309aa67de42f22d0

                            SHA256

                            12bf7eb46cb4cb90fae054c798b8fd527f42a5efc8d7833bb4f68414e2383442

                            SHA512

                            4cf17d20064be9475e45d5f46b4a3400cdb8180e5e375ecac8145d18b34c8fca24432a06aeec937f5bedc7c176f4ee29f4978530be20edbd7fed38966fe989d6

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\AgentPackageMonitoring.ini
                            Filesize

                            12B

                            MD5

                            5796d1f96bb31a9d07f4db8ae9f0ddb3

                            SHA1

                            93012724e6cc0a298838aede678806e6c0c6517d

                            SHA256

                            a90d255cce3b419641fa0b9ba74d4da464e0ce70638a9c2eba03d6b34fca1dc4

                            SHA512

                            890112ddcb3b92b739c0dd06721efa81926ce3aab04c55cdadb8c4e6b7a28c9796f08f508249db189547dc4755804aa80cc8b104dd65c813a0450aad2cdda21c

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                            Filesize

                            48KB

                            MD5

                            b4a865268d5aca5f93bab91d7d83c800

                            SHA1

                            95ac9334096f5a38ca1c92df31b1e73ae4586930

                            SHA256

                            5cbf60b0873660b151cf8cd62e326fe8006d1d0cbde2fad697e7f8ad3f284203

                            SHA512

                            c46ee29861f7e2a1e350cf32602b4369991510804b4b87985465090dd7af64cf6d8dbfa2300f73b2f90f6af95fc0cb5fd1e444b5ddb41dbc89746f04dca6137b

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                            Filesize

                            48KB

                            MD5

                            3cd83123e666d6b95fd4df16bf18f013

                            SHA1

                            1e6f91a4a6d798a82702bd406513862aa2f353e0

                            SHA256

                            3fcd685577a28ff35b948fb9bc7b22dcef2b65924280947cbc20c5b733063a60

                            SHA512

                            880f259836ef7e25fd1d0e95fc54eb673169ae0e17ec1f3f3f623ffc7c6e6e03d8a33b06088d010d8a351906d0d1907d53f068335d8685737a2ad4caf079398c

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageMonitoring\package_2.db
                            Filesize

                            48KB

                            MD5

                            c7b0e680e0c04723c5b0e034b341138e

                            SHA1

                            1c385d454fb17eb2df9bec7351c048975fcc9985

                            SHA256

                            b27eec869d4c4671fa3e2b278bcc3dfb91b2364373f341d2bc48ec6b2437665f

                            SHA512

                            d594efba5b8abffecb2ca32b4e5fd155ec9062253050d48321dc4f647c1112762a1007d841a942f430e414c12f70395d69c148c9366a8ffa96538016f2199e2b

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageOsUpdates.zip
                            Filesize

                            2.8MB

                            MD5

                            a7bf0da8e308248aefd69586e1f8a312

                            SHA1

                            f1df1b8f00087260c9c7c2ba46cb98903f98bf73

                            SHA256

                            b8c4a5ec9357ace0e98bf2e7550d691af280a387fc9636260ea6bc2c2b5b6ba6

                            SHA512

                            e9edd7b668136e3a16b070c13bedb5465ab1cee02cc84f84f40a80aca12cd3ce2a781724f53fecae891a390fc257bec727fb6e4756f644597785ff21107071fd

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageProgramManagement.zip
                            Filesize

                            2.9MB

                            MD5

                            7805ea1a8dd15cac328b826efe38c2a9

                            SHA1

                            66ff8eafb2424717c4394bae28a8683db1244527

                            SHA256

                            7953e6a41847989284b02c4ef8022ac696dae38ee9faee69cd1ff7814563c514

                            SHA512

                            17b6b6ace9ab361fc2bc0c54a063ee67ea09a3ff01cae4fc31d4c7fc176a7c1bb076e8766acbe7fd5e3cd6d6b4357f926669f27bfc2523059f0465cc28fc162d

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageRuntimeInstaller.zip
                            Filesize

                            1.1MB

                            MD5

                            6c6f85e896655a6eb726482f04c49086

                            SHA1

                            2e0c55cd4894117428b34d21a1d53738fce4b02c

                            SHA256

                            e109400a93fede90201bbf37c1868c789888bce9d03a4ae5b46c48599939c34e

                            SHA512

                            b58303c149deffc9e374d5ba42a8a73b7ce890d35f9589fe0b09acec541a21d589d49fa5086b965277fa22dfe308357505124f13a6ff1e0de415ebc40ce61e15

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSTRemote.zip
                            Filesize

                            334KB

                            MD5

                            2e2e6e6702fa92da8c08fa85617fa861

                            SHA1

                            bee96d85e39faa0d6f60fc797e0c4f0e9c01ed67

                            SHA256

                            565bbd4ed69c929cb00ce6552633382bfe46248b6e9db3293b9c031875c02b35

                            SHA512

                            35eaf569f94c69749308d30722589331ea1957f3a11f440b1eccc4aa32284681162128b2febef76c75181b49e5e57d780685a22e14e1900ffc7add3f83ac075e

                            Download Submit

                          • C:\Program Files\ATERA Networks\AteraAgent\Packages\AgentPackageSystemTools.zip
                            Filesize

                            646KB

                            MD5

                            0e6af651f8be91dc9dde2faab59c9a77

                            SHA1

                            f199693bb55864f8497227c1c14244ff3e6e423e

                            SHA256

                            895f2593cf3f365046f33e9cf5ebcb2a17e7af1c592decc82bfe8ff5d5653a20

                            SHA512

                            fd770888310dd2e58124eae49bdc6e715fde9b100010ef224e10f6a757629c2c55d12c0e4cede3f8cf8e89d1267e4820c9bf82df5f6263675ecc3596895da4af

                            Download Submit

                          • C:\ProgramData\chocolatey\config\chocolatey.config
                            Filesize

                            809B

                            MD5

                            8b6737800745d3b99886d013b3392ac3

                            SHA1

                            bb94da3f294922d9e8d31879f2d145586a182e19

                            SHA256

                            86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

                            SHA512

                            654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

                            Download Submit

                          • C:\ProgramData\chocolatey\logs\chocolatey.log
                            Filesize

                            6KB

                            MD5

                            37ff6b50dd42708eef2285f5f4d57c7e

                            SHA1

                            4c7e7a2a0814122cc16cb62131a00e2f58f62c17

                            SHA256

                            75abf3c903c5b75d0f446749d4617103ac976c25c7b8109d3c130d51590fe91c

                            SHA512

                            95aff52a15b33f17910b564d0ec7e257ad6d90de9cc44f0e7f4d545901aea980f93fc4fbb2a70e1350fe64d5d62877d1f55932f2ea2d41b2d8b4abd8215921b5

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                            Filesize

                            471B

                            MD5

                            9b211057a04e0b18bf0040b5892ab8c8

                            SHA1

                            67bdb1f2ee9f3d27f2d1c4867b8d9b99ecfa7399

                            SHA256

                            8a9bb90e00e3cbc4b7978fedc7bd2313e5068924e0081205194d48a0fc2d6dc9

                            SHA512

                            b51d11824321cc0e3a876f1fa7923d0bb4d43a9df95bc4de71c66309aca24fd175b8b67738b3cf0e7c5a590a8639de4ebb80b7138ec7aa960569b64da4ab007d

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                            Filesize

                            727B

                            MD5

                            e7be7791d0c1baf7ab7110f5deac570e

                            SHA1

                            5eba5cde83647884b6f570bd39bbf0810493652e

                            SHA256

                            78ccc2eb627dfdf47fd133265205a563aa1b2557c986398bcb8cdad68a6964e4

                            SHA512

                            fd74f32588706358c5d226e38fc02a3cfdd1d22085fc75e35659ab2dd412c984b5b77077b4986ab9a536699ddf8bace8cb0ee3719eb210d44aa8e983cd1f9e84

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            Filesize

                            727B

                            MD5

                            5a9f34d0bd7074d978bca26efee83cea

                            SHA1

                            ea74177ba4a9b12793dbbb410ae50020cd7eacee

                            SHA256

                            266cf7f825c8eca0893d2b344853f0a4fe06a48bf76fd2ed9b5c4ccfe9ab69bd

                            SHA512

                            e220822af425d92a377c1ad644754809e31a3426040473f7fd9b8d99a6db8a0a3238193d38be912bfdacd231f8485161c5d64c41f4b3ae76beeec734a294f6be

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                            Filesize

                            400B

                            MD5

                            24f001440ff0a5c95dcf54a911617add

                            SHA1

                            5bd854a3b78c360b1388e1fc26020fc5e22b28ad

                            SHA256

                            e3e0722cf7055b2ffc4c2f32cf9b2c0a0109bfff3c693276a077b509b6a903f2

                            SHA512

                            89f4cd420c118ea1aa53a576c25355d50403d16dfe27973af49611488e7a59be326dbdc6369ca8fe411833347d8be03fa5624dd5517762755b13559d648a1aa2

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                            Filesize

                            404B

                            MD5

                            8033251886ff3afec64abaac70d412e3

                            SHA1

                            37da46d6dd036e2d9b1103a8ebd63c8c3b452282

                            SHA256

                            7c3a51bcdd1d1476c0de5aecf9d062c570323dfb597c2bf7a86e577174c3a09b

                            SHA512

                            a13eccc275e6f089c73577f074f6bf7371f3f1fc662d0383445e827e8ee9a04d7950add0d8aac162ebd7b1c2fe8bda7fcc9cf591eb1e4719ecaa3e040a6e4dc5

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            Filesize

                            412B

                            MD5

                            98180da6ea99ce337f8d7ab6867cb806

                            SHA1

                            b22cb5f039cb38c61c2ae420d9de122a44c38edf

                            SHA256

                            6b5aa5eff08922e9267812dbcadf7923aa49f0547b8d05653e5887f9ab642830

                            SHA512

                            869984f2b7dc2bb81b8e9da639b89f9647de65b2d24f95d0d56c3544ebd22650cc9089a9fc25d6be6277a5696d4ec4d83a69d014737b318dce3c44f90acdcb66

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
                            Filesize

                            651B

                            MD5

                            9bbfe11735bac43a2ed1be18d0655fe2

                            SHA1

                            61141928bb248fd6e9cd5084a9db05a9b980fb3a

                            SHA256

                            549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

                            SHA512

                            a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

                            Download Submit

                          • C:\Windows\Installer\MSI1358.tmp
                            Filesize

                            211KB

                            MD5

                            a3ae5d86ecf38db9427359ea37a5f646

                            SHA1

                            eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                            SHA256

                            c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                            SHA512

                            96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                            Download Submit

                          • C:\Windows\Installer\MSI4BE.tmp
                            Filesize

                            509KB

                            MD5

                            88d29734f37bdcffd202eafcdd082f9d

                            SHA1

                            823b40d05a1cab06b857ed87451bf683fdd56a5e

                            SHA256

                            87c97269e2b68898be87b884cd6a21880e6f15336b1194713e12a2db45f1dccf

                            SHA512

                            1343ed80dccf0fa4e7ae837b68926619d734bc52785b586a4f4102d205497d2715f951d9acacc8c3e5434a94837820493173040dc90fb7339a34b6f3ef0288d0

                            Download Submit

                          • C:\Windows\Installer\MSI4BE.tmp-\AlphaControlAgentInstallation.dll
                            Filesize

                            25KB

                            MD5

                            aa1b9c5c685173fad2dabebeb3171f01

                            SHA1

                            ed756b1760e563ce888276ff248c734b7dd851fb

                            SHA256

                            e44a6582cd3f84f4255d3c230e0a2c284e0cffa0ca5e62e4d749e089555494c7

                            SHA512

                            d3bfb4bd7e7fdb7159fbfc14056067c813ce52cdd91e885bdaac36820b5385fb70077bf58ec434d31a5a48245eb62b6794794618c73fe7953f79a4fc26592334

                            Download Submit

                          • C:\Windows\Installer\MSI4BE.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                            Filesize

                            179KB

                            MD5

                            1a5caea6734fdd07caa514c3f3fb75da

                            SHA1

                            f070ac0d91bd337d7952abd1ddf19a737b94510c

                            SHA256

                            cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

                            SHA512

                            a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

                            Download Submit

                          • C:\Windows\Installer\MSI859.tmp-\CustomAction.config
                            Filesize

                            1KB

                            MD5

                            bc17e956cde8dd5425f2b2a68ed919f8

                            SHA1

                            5e3736331e9e2f6bf851e3355f31006ccd8caa99

                            SHA256

                            e4ff538599c2d8e898d7f90ccf74081192d5afa8040e6b6c180f3aa0f46ad2c5

                            SHA512

                            02090daf1d5226b33edaae80263431a7a5b35a2ece97f74f494cc138002211e71498d42c260395ed40aee8e4a40474b395690b8b24e4aee19f0231da7377a940

                            Download Submit

                          • C:\Windows\Installer\MSI859.tmp-\Newtonsoft.Json.dll
                            Filesize

                            695KB

                            MD5

                            715a1fbee4665e99e859eda667fe8034

                            SHA1

                            e13c6e4210043c4976dcdc447ea2b32854f70cc6

                            SHA256

                            c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

                            SHA512

                            bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

                            Download Submit

                          • C:\Windows\Installer\MSIE2C2.tmp-\System.Management.dll
                            Filesize

                            60KB

                            MD5

                            878e361c41c05c0519bfc72c7d6e141c

                            SHA1

                            432ef61862d3c7a95ab42df36a7caf27d08dc98f

                            SHA256

                            24de61b5cab2e3495fe8d817fb6e80094662846f976cf38997987270f8bbae40

                            SHA512

                            59a7cbb9224ee28a0f3d88e5f0c518b248768ff0013189c954a3012463e5c0ba63a7297497131c9c0306332646af935dd3a1acf0d3e4e449351c28ec9f1be1fa

                            Download Submit

                          • C:\Windows\Installer\MSIF51F.tmp
                            Filesize

                            4.5MB

                            MD5

                            2207f96731ce2f9d9327c0baaf4959ef

                            SHA1

                            f56ea992c59ad669ec8ee5d6a827adc472159cc0

                            SHA256

                            e4ceddd5c37c90f8fc7787663a9bed31518fba82413e80b21230425e380c42db

                            SHA512

                            7e4bd781f879b593f722277839175aa895c863b2015d691c85c8eec4fe635d233cd94d2b0dce46cd058f08a005caa73888809df414983ff2a4c938770ef71fd4

                            Download Submit

                          • C:\Windows\Installer\e580402.msi
                            Filesize

                            2.9MB

                            MD5

                            98498752125993a3a0a6b02cfdd3d28e

                            SHA1

                            7d1747d94950df564da98ef4dae8128fb1399a7a

                            SHA256

                            30bfe9326b0554c6cd73359084ba1218d26e587542c1e2216e201b4c62a7fb71

                            SHA512

                            4e271945c4ee0d65855d03a0ad5437f05e44fc00dedf2a9c38e2e534ac45253aa0b2ad6e51d6e3d13df9f7250714ef1b7be0e898fef9e8ec2b17940ac16c5a6b

                            Download Submit

                          • C:\Windows\Temp\B7C5EA94-B96A-41F5-BE95-25D78B486678-03-15-21.dat
                            Filesize

                            602B

                            MD5

                            f687849c72817a218c2716da9b3b909a

                            SHA1

                            196ff60647f36a44d051ecb7e3a14f3699249054

                            SHA256

                            380ca6650276152ced222ff85fb34b4256481fda7fbb2f50fe6523648c498179

                            SHA512

                            9ced2e380afbf4cea18a7fa6085f6174dae9961a54f14bcc580a396f1b39d16d9f07206a5269fe07b87c808c4a891acd24804e236f48295f56be1d6eed720230

                            Download Submit

                          • C:\Windows\Temp\InstallUtil.log
                            Filesize

                            850B

                            MD5

                            2e6d3ab2712e377d72b6e5e127c47752

                            SHA1

                            40e4d7d9b5f9956f734f0d1b380153be38c963d0

                            SHA256

                            b35c94e77f3e350782d525dd196caaebf81362a722bef119c3a8b436b11efb57

                            SHA512

                            d9dfb0345a8bec9eab1e689af68a6c5a80a38fabb19279c1e1c3bee8d3606d3b9c5dd7d1fce1339dc38030ccf7b462b8b4b3b2994c6358534e8d63283359af1b

                            Download Submit

                          • C:\Windows\Temp\InstallUtil.log
                            Filesize

                            1KB

                            MD5

                            0aba9ca531e66cf8b3cde56ba0c25efb

                            SHA1

                            d310760d54c8bd0f3a72b68f3f5a24ffd8423858

                            SHA256

                            63bdea8e611ea5bd32e0797fdb194c8d526e9ece63b5657f761f85d4f44fd6c4

                            SHA512

                            bf9ceb3992cd8ae37caf863d784d8d372a8d7fef9142fe1348d60e5037e751d977bca64ab9652b1054145008392f5514e92a720c5a2c3a721612d5034bbbbee3

                            Download Submit

                          • C:\Windows\Temp\PreVer.log
                            Filesize

                            2KB

                            MD5

                            2f8d2717b2eea725246b0c8af129172a

                            SHA1

                            4fd1161ec33f480f504a26f83f0d8cac707c4763

                            SHA256

                            d768d3ec7bf44fdb4fb67afb0f2820f3634103e6b4dd5bb8812c76741a0c802d

                            SHA512

                            d046a5d2f0151a556ff0a07608d22bf1983715e29cf8fe30454e22bcc8929a143e1f1940cf8fcf61037af4be5adc44fe4f7705d476ac26c53a96dd459dfdf70b

                            Download Submit

                          • C:\Windows\Temp\PreVer.log
                            Filesize

                            5KB

                            MD5

                            8f32740500bd25999f7813a765002adb

                            SHA1

                            6ad48965c5c3e83d2098260539cf7799d42269da

                            SHA256

                            dcedcafc6bdc276fae79e2034ce095362de20d132ce17c543b2ce59139854306

                            SHA512

                            6cde574c86a43936752bc3335fe4928bc55fc3c162ba3b46a092ad6f29be6853d851b2d174b3a9dfd9eab22b710457c96efe78e9bb8d9988c641e5c64c351038

                            Download Submit

                          • C:\Windows\Temp\TmpE049.tmp
                            Filesize

                            3KB

                            MD5

                            560af444a6a7faa0b0ca94dc16ca2a58

                            SHA1

                            df31453fafde354870a0a9a8ca50b18e284c32e4

                            SHA256

                            94739ca46676bd602a78671257fbfce39feaabc9664c6326bf4970a0108e3429

                            SHA512

                            7c853176c088d56a517e52c6687b6debf08f6f9726376720ade9d13fafc9be0ca72f0f2b35562a61ece653aeb789c838c60447f463b2bbe70c21bfc8c039b681

                            Download Submit

                          • C:\Windows\Temp\unpack.log
                            Filesize

                            2KB

                            MD5

                            f407be07966a67bc279d81f5ae6d5557

                            SHA1

                            0bace4dd2477eb26a6bae2f90fcb54f3b604c45f

                            SHA256

                            69a93db3bcef16c94180ee025904f50ecd7ee1fedc36db0a768887933e861143

                            SHA512

                            0e3bbf1461335a64a7ab8b96a94ede758c81b6b1d3a4ce8482a87a1c84cfa60329f2b96be9037be01210788e9569a4c5a1de444ab584853889441f0246ade1e9

                            Download Submit

                          • C:\Windows\Temp\unpack.log
                            Filesize

                            5KB

                            MD5

                            850d56357d84629650046b5f41b189e4

                            SHA1

                            576c8634bb120c4266ff2f0e8bf2a66eb784c079

                            SHA256

                            ac18b4a434f39c330201e16e58850287da0883786fbac9541e49ff330563cc22

                            SHA512

                            93988d741bf1ecd4f2261f5cc55d7d742d8f48c9c531094825081cb248732d50a66c32d8e852f5c4be8363ed42b09f176c58a455f79b7651f6feccbf8ca03293

                            Download Submit

                          • C:\Windows\Temp\unpack\PreVerCheck.exe
                            Filesize

                            3.2MB

                            MD5

                            a7ce785b6cd1c9657040ca9b6cbeed10

                            SHA1

                            4b254fee47cc8a9eaec6ce7b714a2ce05b6ed8ec

                            SHA256

                            7ba6e401b8e78ab28e1ccf38d2cd05e12751f960661e159b4e35bc63d3544b4d

                            SHA512

                            39202f477017daa9428a0c1bbe1daae30aa1b7b9f57b04832c44a7b28af0144ff47edfc1ad3d6a940ad1c49471dfe190077b594c337bacc115c552d91a24c2d9

                            Download Submit

                          • C:\Windows\Temp\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\IsConfig.ini
                            Filesize

                            571B

                            MD5

                            38370175ce7d8dd5c3581030a9104259

                            SHA1

                            bbc1b4254c3e3da692c2667b4c5092d687ad8dc9

                            SHA256

                            ee90ca3f30aa75fe1c3b095ddd2b24680bd3b081829094c18d9c78ebed206b83

                            SHA512

                            e11494869b04a2206d3dda67411be294106f6363408399d9363b27720c6fe88fd393ae90fc2ab7cd4909e940e98f273c8869532b65a1f0b0f4b8b18a24589748

                            Download Submit

                          • C:\Windows\Temp\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\String1033.txt
                            Filesize

                            182KB

                            MD5

                            37a2c4ef0ff41955f1cb884b7790699f

                            SHA1

                            8e7dad0bc6ae65dfaec9fc29d0ef6e260dd83e9d

                            SHA256

                            6b629fdf1520ba40bb0d7bc8d9a7bb231624fd190e03bcacc607f248222b3c63

                            SHA512

                            fb3a109395872e6f116a75b39566f4b9efe0486512620deb33ef83ac0ac3165d96dbefbe3023ece1d3d0d6be7c8eb8abb58da90f01f225e1ed2d4add2b544d42

                            Download Submit

                          • C:\Windows\Temp\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\_isE4F8.exe
                            Filesize

                            179KB

                            MD5

                            7a1c100df8065815dc34c05abc0c13de

                            SHA1

                            3c23414ae545d2087e5462a8994d2b87d3e6d9e2

                            SHA256

                            e46c768950aad809d04c91fb4234cb4b2e7d0b195f318719a71e967609e3bbed

                            SHA512

                            bbec114913bc2f92e8de7a4dd9513bff31f6b0ef4872171b9b6b63fef7faa363cf47e63e2d710dd32e9fc84c61f828e0fae3d48d06b76da023241bee9d4a6327

                            Download Submit

                          • C:\Windows\Temp\{66FF9A03-D502-4F69-81A9-3E66C4CECE96}\setup.inx
                            Filesize

                            345KB

                            MD5

                            0376dd5b7e37985ea50e693dc212094c

                            SHA1

                            02859394164c33924907b85ab0aaddc628c31bf1

                            SHA256

                            c9e6af6fb0bdbeb532e297436a80eb92a2ff7675f9c777c109208ee227f73415

                            SHA512

                            69d79d44908f6305eee5d8e6f815a0fee0c6d913f4f40f0c2c9f2f2e50f24bf7859ebe12c85138d971e5db95047f159f077ae687989b8588f76517cab7d3e0d5

                            Download Submit

                          • C:\Windows\Temp\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\ISRT.dll
                            Filesize

                            427KB

                            MD5

                            85315ad538fa5af8162f1cd2fce1c99d

                            SHA1

                            31c177c28a05fa3de5e1f934b96b9d01a8969bba

                            SHA256

                            70735b13f629f247d6af2be567f2da8112039fbced5fbb37961e53a2a3ec1ec7

                            SHA512

                            877eb3238517eeb87c2a5d42839167e6c58f9ca7228847db3d20a19fb13b176a6280c37decda676fa99a6ccf7469569ddc0974eccf4ad67514fdedf9e9358556

                            Download Submit

                          • C:\Windows\Temp\{75D92220-CD3F-4E0B-A017-6EF7660524E3}\_isres_0x0409.dll
                            Filesize

                            1.8MB

                            MD5

                            befe2ef369d12f83c72c5f2f7069dd87

                            SHA1

                            b89c7f6da1241ed98015dc347e70322832bcbe50

                            SHA256

                            9652ffae3f5c57d1095c6317ab6d75a9c835bb296e7c8b353a4d55d55c49a131

                            SHA512

                            760631b05ef79c308570b12d0c91c1d2a527427d51e4e568630e410b022e4ba24c924d6d85be6462ba7f71b2f0ba05587d3ec4b8f98fcdb8bb4f57949a41743b

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_DEB07B5578A606ED6489DDA2E357A944
                            Filesize

                            404B

                            MD5

                            2bcf6a4ee5bf69ba3cff72624cabcc88

                            SHA1

                            41bd77a6bf8483838d19d3310321a8005de2f868

                            SHA256

                            ba307ab4470c77611613c5cb78e0f65a50f48978ac4ff5fdf2c8a3ee1e78a8f1

                            SHA512

                            43f768ae2e0e2502e2558b9aa2086a8b277a37f987988e64ff80558e3187bfdd453941d42c17ebf12113f967e630d4fb8c8856a41afd72fb31f7bdae5f478192

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                            Filesize

                            412B

                            MD5

                            4a7e5ce5451d0890a1d5e803ccf0da3e

                            SHA1

                            6d2691292b1d599bb187694996d8d2610585f582

                            SHA256

                            e9f3ad88b515977285cd7667a1ce3cc46607a008360491b2844a90b61b1fb617

                            SHA512

                            069ad929860b3c2114d61d614af0694c5b0ba79e9268542bd3efa85d02aedad9d99142cf0d58431a0a890a6784d3b92670edf90877c72355b957f3be6e3da089

                            Download Submit

                          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                            Filesize

                            24.1MB

                            MD5

                            c5c1ed8d45e537eb8cba846c75c0746e

                            SHA1

                            472353c32c12aebf709f9ee5fb771bd177a15d59

                            SHA256

                            d9dcd985b646b3d048d4ae031b4af94c26797506e92fd13340978a5056e25b63

                            SHA512

                            3b98572726b4a2529522e968918693030526e120251333d8cfb8c6cc4703d25bfea51b243c384ca7da6cdf953107635021d65920d255d324506864b6fa8b6624

                            Download Submit

                          • \??\Volume{ff55ba41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{adacef84-1d09-4c71-bdb1-f8d206292aec}_OnDiskSnapshotProp
                            Filesize

                            6KB

                            MD5

                            d627574ce1f252db985124278d44b4f1

                            SHA1

                            1c62baa90e56a95617817aa39cebdcf89f330a4f

                            SHA256

                            8fcc3cd942761200b89986ae525a0ad99513e6083c506168104564d527db06a2

                            SHA512

                            ab03b4aee58a9aab53f014f4ab7908b925711032a1d8d7a96697aa04a4c6f5cc929f3b865a837dc360f174ff31457eeba4c4ec79aabeb767610f072c9214a296

                            Download Submit

                          • memory/828-659-0x000002A55CCC0000-0x000002A55CCFA000-memory.dmp

                            Filesize

                            232KB

                            Download

                          • memory/828-764-0x000002A55D5C0000-0x000002A55D5DC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/828-1115-0x000002A575EF0000-0x000002A575F18000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/828-1112-0x000002A55D640000-0x000002A55D650000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/828-833-0x000002A575E70000-0x000002A575EB8000-memory.dmp

                            Filesize

                            288KB

                            Download

                          • memory/828-762-0x000002A575F60000-0x000002A576012000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/872-45-0x0000000004DE0000-0x0000000004DEC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/872-41-0x0000000004DA0000-0x0000000004DCE000-memory.dmp

                            Filesize

                            184KB

                            Download

                          • memory/1168-289-0x000002056BC80000-0x000002056BC9C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/1168-286-0x000002056B850000-0x000002056B880000-memory.dmp

                            Filesize

                            192KB

                            Download

                          • memory/1168-288-0x000002056CA10000-0x000002056CAC0000-memory.dmp

                            Filesize

                            704KB

                            Download

                          • memory/1384-112-0x0000000005660000-0x00000000056C6000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/1396-674-0x000001AB61020000-0x000001AB610D2000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/1396-722-0x000001AB60EB0000-0x000001AB60ED0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1396-666-0x000001AB60E90000-0x000001AB60EA8000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/1396-665-0x000001AB60520000-0x000001AB6052C000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/1420-81-0x0000000002B40000-0x0000000002B62000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1420-78-0x0000000004F50000-0x0000000005002000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/1420-82-0x0000000005010000-0x0000000005364000-memory.dmp

                            Filesize

                            3.3MB

                            Download

                          • memory/1904-1172-0x0000024EE0E70000-0x0000024EE0E96000-memory.dmp

                            Filesize

                            152KB

                            Download

                          • memory/2256-664-0x0000015049740000-0x000001504975A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/2256-723-0x0000015062090000-0x0000015062142000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/2256-1011-0x0000015062B50000-0x0000015063078000-memory.dmp

                            Filesize

                            5.2MB

                            Download

                          • memory/2256-662-0x0000015048EF0000-0x0000015048EFA000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/2464-194-0x000002433E100000-0x000002433E1B2000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/2464-203-0x0000024325690000-0x00000243256B2000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/2464-243-0x000002433E090000-0x000002433E0C8000-memory.dmp

                            Filesize

                            224KB

                            Download

                          • memory/2556-867-0x0000020CC7770000-0x0000020CC77C4000-memory.dmp

                            Filesize

                            336KB

                            Download

                          • memory/2556-430-0x0000020CC6D70000-0x0000020CC6D82000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/2556-431-0x0000020CC75C0000-0x0000020CC75DC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/2556-432-0x0000020CDFF10000-0x0000020CDFFC2000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/3628-333-0x00000197FBDE0000-0x00000197FBDFC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/3628-340-0x00000197FC790000-0x00000197FC798000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/3628-346-0x00000197FC940000-0x00000197FC966000-memory.dmp

                            Filesize

                            152KB

                            Download

                          • memory/3628-345-0x00000197FDCC0000-0x00000197FDCFA000-memory.dmp

                            Filesize

                            232KB

                            Download

                          • memory/3628-344-0x00000197FC910000-0x00000197FC93A000-memory.dmp

                            Filesize

                            168KB

                            Download

                          • memory/3628-343-0x00000197FC980000-0x00000197FC9E8000-memory.dmp

                            Filesize

                            416KB

                            Download

                          • memory/3628-342-0x00000197FC7B0000-0x00000197FC7B8000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/3628-331-0x00000197FB540000-0x00000197FB5A4000-memory.dmp

                            Filesize

                            400KB

                            Download

                          • memory/3628-332-0x00000197FC650000-0x00000197FC69A000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/3628-334-0x00000197FC6A0000-0x00000197FC6EC000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/3628-335-0x00000197FC6F0000-0x00000197FC738000-memory.dmp

                            Filesize

                            288KB

                            Download

                          • memory/3628-336-0x00000197FBE00000-0x00000197FBE08000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/3628-337-0x00000197FBE10000-0x00000197FBE1A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/3628-338-0x00000197FC9F0000-0x00000197FCACC000-memory.dmp

                            Filesize

                            880KB

                            Download

                          • memory/3628-339-0x00000197FCE20000-0x00000197FCED2000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/3628-341-0x00000197FC7A0000-0x00000197FC7A8000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/3856-426-0x000001E49E340000-0x000001E49E356000-memory.dmp

                            Filesize

                            88KB

                            Download

                          • memory/3856-428-0x000001E49ECD0000-0x000001E49ED82000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/3856-429-0x000001E49E8C0000-0x000001E49E8DC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/3952-166-0x00000244A9A00000-0x00000244A9A12000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/3952-162-0x00000244C3FC0000-0x00000244C4058000-memory.dmp

                            Filesize

                            608KB

                            Download

                          • memory/3952-150-0x00000244A9600000-0x00000244A9628000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/3952-167-0x00000244A9AC0000-0x00000244A9AFC000-memory.dmp

                            Filesize

                            240KB

                            Download

                          • memory/4456-1013-0x000001FD57E10000-0x000001FD57E24000-memory.dmp

                            Filesize

                            80KB

                            Download

                          • memory/4456-1007-0x000001FD57CC0000-0x000001FD57CE0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4456-1006-0x000001FD57470000-0x000001FD57480000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4456-1009-0x000001FD70610000-0x000001FD706C2000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/4456-1012-0x000001FD70550000-0x000001FD705B6000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/5136-3661-0x00000000037D0000-0x0000000003997000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/5136-3207-0x0000000003790000-0x0000000003957000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/5164-1018-0x0000023239370000-0x00000232393BA000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/5164-1028-0x0000023252160000-0x0000023252212000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/5164-1020-0x0000023239340000-0x000002323935C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/5164-1025-0x0000023251D30000-0x0000023251E0C000-memory.dmp

                            Filesize

                            880KB

                            Download

                          • memory/5164-1017-0x00000232389E0000-0x00000232389F0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5164-1110-0x0000023239360000-0x0000023239368000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/5284-1014-0x000001BDFF990000-0x000001BDFFA42000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/5284-763-0x000001BDFF6B0000-0x000001BDFF6CC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/5284-768-0x000001BDFF730000-0x000001BDFF748000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/5284-1016-0x000001BDFFB30000-0x000001BDFFC0C000-memory.dmp

                            Filesize

                            880KB

                            Download

                          • memory/5284-1021-0x000001BDFF8D0000-0x000001BDFF932000-memory.dmp

                            Filesize

                            392KB

                            Download

                          • memory/5284-832-0x000001BDFF690000-0x000001BDFF69A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/5284-1022-0x000001BDFF790000-0x000001BDFF7AC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/5284-686-0x000001BDFF320000-0x000001BDFF354000-memory.dmp

                            Filesize

                            208KB

                            Download

                          • memory/5284-747-0x000001BDFF6E0000-0x000001BDFF72A000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/5284-934-0x000001BDFF7E0000-0x000001BDFF82A000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/5756-809-0x000002B4AFF20000-0x000002B4AFF2C000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/5756-1002-0x000002B4B0760000-0x000002B4B077C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/5756-1101-0x000002B4C93D0000-0x000002B4C94AC000-memory.dmp

                            Filesize

                            880KB

                            Download

                          • memory/5756-1023-0x000002B4C9240000-0x000002B4C92F0000-memory.dmp

                            Filesize

                            704KB

                            Download

                          • memory/5756-1119-0x000002B4C9060000-0x000002B4C907C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/5756-866-0x000002B4B0790000-0x000002B4B07DA000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/5780-1015-0x0000018C55BD0000-0x0000018C5622C000-memory.dmp

                            Filesize

                            6.4MB

                            Download

                          • memory/5780-1109-0x0000018C556B0000-0x0000018C55726000-memory.dmp

                            Filesize

                            472KB

                            Download

                          • memory/5780-1001-0x0000018C55060000-0x0000018C55112000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/5780-1108-0x0000018C555E0000-0x0000018C55630000-memory.dmp

                            Filesize

                            320KB

                            Download

                          • memory/5780-1111-0x0000018C3C8D0000-0x0000018C3C8EE000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/5780-822-0x0000018C3BE90000-0x0000018C3BEA2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/5780-1019-0x0000018C3C920000-0x0000018C3C966000-memory.dmp

                            Filesize

                            280KB

                            Download

                          • memory/5780-1004-0x0000018C3C840000-0x0000018C3C860000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/5780-868-0x0000018C3C250000-0x0000018C3C260000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5836-1024-0x00000244FBF50000-0x00000244FC002000-memory.dmp

                            Filesize

                            712KB

                            Download

                          • memory/5836-904-0x00000244E2BC0000-0x00000244E2BD2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/5836-1026-0x00000244FC0F0000-0x00000244FC1CC000-memory.dmp

                            Filesize

                            880KB

                            Download

                          • memory/5836-1106-0x00000244FBE10000-0x00000244FBE2A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/5836-957-0x00000244FBCA0000-0x00000244FBCEA000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/5836-1008-0x00000244E3420000-0x00000244E343C000-memory.dmp

                            Filesize

                            112KB

                            Download